HELP! SCAM ANTIVIRUS! grandpa fell for it....

Hello, My grandfather had a typical "your machine is infected" message last night. He then proceeded to give his credit card number to purchase the software. Now he has major problems! Can someone please help me get this thing cleaned up? Thank you! dz

Hello dzmr5s. Please follow these guidelines while we work on your Grandfather's PC:

• Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
• Please do not run any scans or install/uninstall any applications without being directed to do so.
• Please follow my instructions carefully and in the order they are posted.
• Any underlined text in my posts indicates a clickable link.
• You should print any instructions I give you for ease of use and reference.
• If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

• Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  
  [external image: Posted Image]
  Click the image to enlarge it
  
  
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:

• Make sure that your security software is disabled
• Uncheck the box next to "Files" this time also
• If you still can't run it, try in the Safe Mode

Please include the following in your next post:

• DDS and Attach.txt logs
• GMER log

Please run this instead of GMER:

🖼Click to load external image (Posted Image) Please download Rootkit Unhooker and save it on your desktop.

• Disable your security programs
• Double click RKUnhookerLE.exe to run it
• Click the Report tab, then click Scan
• Check Drivers, Stealth Code, Files, and Code Hooks
• Uncheck the rest, then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished then go File > Save Report
• Save the report somewhere you can find it. Click Close
• Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Please include the following in your next post:

• Rootkit Unhooker log

RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows Vista Version 6.0.6002 (Service Pack 2) Number of processors #2 ============================================== >Drivers ============================================== 0x8B00B000 C:\Windows\system32\DRIVERS\atikmdag.sys 7897088 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver) 0x81C3F000 C:\Windows\system32\ntoskrnl.exe 3846144 bytes (Microsoft Corporation, NT Kernel & System) 0x81C3F000 PnpManager 3846144 bytes 0x81C3F000 RAW 3846144 bytes 0x81C3F000 WMIxWDM 3846144 bytes 0x90CA0000 Win32k 2109440 bytes 0x90CA0000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0x862F0000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver) 0x8607A000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver) 0x8B891000 C:\Windows\system32\DRIVERS\AGRSM.sys 1028096 bytes (Agere Systems, SoftModem Device Driver) 0x861EB000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver) 0x828D4000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module) 0x936F3000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x9342E000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor) 0x86508000 C:\Windows\System32\drivers\dxgkrnl.sys 659456 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x86637000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x829B4000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic) 0x865A9000 C:\Windows\system32\DRIVERS\athr.sys 483328 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver) 0x86009000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0x8280A000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library) 0x93535000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack) 0x936A5000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver) 0x82AE6000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x8BACC000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x82A3D000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT) 0x82893000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver) 0x8672C000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver) 0x8B99B000 C:\Windows\system32\drivers\HdAudio.sys 258048 bytes (Microsoft Corporation, High Definition Audio Function Driver) 0x8B7A9000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x8BB7D000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x861B0000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem) 0x9362D000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x8640E000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0x8B84B000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x81C0C000 ACPI_HAL 208896 bytes 0x81C0C000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x82BA8000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0x8BB14000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x866FD000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver) 0x82B45000 C:\Windows\system32\DRIVERS\pcmcia.sys 184320 bytes (Microsoft Corporation, PCMCIA Bus Driver) 0x8B9DA000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x86185000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x8B80A000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library) 0x934EE000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver) 0x9982F000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver) 0x86463000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache) 0x82A94000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0x9367E000 C:\Windows\System32\DRIVERS\srv2.sys 159744 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x8BA07000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0x8679A000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x8649B000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll) 0x935ED000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0x8BA4F000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0x9360E000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x82B8A000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension) 0x935A2000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver) 0x862D5000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x9340B000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver) 0x935BF000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0x8661F000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0x93666000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x8BBC3000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x86778000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x99804000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver) 0x8BB46000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler) 0x8BAA2000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver) 0x935D8000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x867E0000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0x9981A000 C:\Windows\system32\DRIVERS\USBSTOR.SYS 86016 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0x99857000 C:\Windows\system32\DRIVERS\WUDFRd.sys 86016 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector) 0x867CC000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x8BAB8000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver) 0x866C4000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver) 0x93522000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x8BB6A000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0x9986C000 C:\Windows\system32\DRIVERS\WUDFPf.sys 73728 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0x8648A000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x8B880000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x8287A000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver) 0x82BDA000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver) 0x934DE000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x82B72000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager) 0x866ED000 C:\Windows\system32\DRIVERS\Rtnicxp.sys 65536 bytes (Realtek Semiconductor Corporation , Realtek 10/100 NDIS 5.1 Driver ) 0x82BEA000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver) 0x864F9000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver) 0x864C5000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver) 0x86454000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0x82ABB000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver) 0x867BD000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x8B7E7000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x82AD7000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver) 0x90EE0000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver) 0x8BB5C000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x8BA8B000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x82B37000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x8BBDA000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x8B98E000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver) 0x8B83E000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x82A30000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR) 0x937DB000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x8BA43000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x8B793000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver) 0x8BBE7000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes 0x866D7000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver) 0x866E2000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver) 0x8BA80000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x8678F000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x8676D000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x864E5000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x82ACD000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver) 0x8B800000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x8B834000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0x93518000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver) 0x8BBB9000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0x937D1000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0x8B79F000 C:\Windows\system32\DRIVERS\usbohci.sys 40960 bytes (Microsoft Corporation, OHCI USB Miniport Driver) 0x937E7000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver) 0x864BC000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver) 0x8BA2C000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0x9987E000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0x8BA99000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0x90EC0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x864F0000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x82A83000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x82B82000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x8288B000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x8BBF2000 C:\Windows\System32\Drivers\dump_atapi.sys 32768 bytes 0x82A8C000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x8BA70000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8BA78000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8644C000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0x8BA3C000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x8B7F6000 C:\Windows\SYSTEM32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CDRom Class Filter Driver) 0x82803000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0x8BA35000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x82B30000 C:\Windows\system32\drivers\pciide.sys 28672 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) 0x86447000 C:\Windows\system32\DRIVERS\TVALZ_O.SYS 20480 bytes (TOSHIBA Corporation, TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver) 0x8B000000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0x82ACA000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0x8B004000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x8B98C000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) ============================================== >Stealth ============================================== ============================================== >Files ============================================== ============================================== >Hooks ============================================== ntoskrnl.exe+0x0006948A, Type: Inline - RelativeJump 0x81CA848A–>81CA8491 [ntoskrnl.exe] [2440]explorer.exe–>kernel32.dll–>CreateProcessW, Type: Inline - RelativeJump 0x760A1BF3–>00000000 [unknown_code_page] [2572]MSDERUN.EXE–>kernel32.dll–>DeleteFiber, Type: IAT modification 0x00404190–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>GetBinaryTypeW, Type: IAT modification 0x004041A4–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>GetExitCodeProcess, Type: IAT modification 0x00404194–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>GetModuleHandleW, Type: IAT modification 0x004041B0–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x004041A8–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>GlobalFree, Type: IAT modification 0x0040419C–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>GlobalLock, Type: IAT modification 0x004041A0–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>LockResource, Type: IAT modification 0x004041AC–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>lstrlenW, Type: IAT modification 0x0040418C–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>SetLastError, Type: IAT modification 0x00404188–>00000000 [user32.dll] [2572]MSDERUN.EXE–>kernel32.dll–>SleepEx, Type: IAT modification 0x00404198–>00000000 [user32.dll] [3156]wscsvc32.exe–>kernel32.dll–>CreateProcessW, Type: IAT modification 0x00405038–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x00405044–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>EndUpdateResourceW, Type: IAT modification 0x0040504C–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>EnumSystemLocalesW, Type: IAT modification 0x0040503C–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>FreeEnvironmentStringsW, Type: IAT modification 0x00405028–>00000000 [advapi32.dll] [3156]wscsvc32.exe–>kernel32.dll–>GetACP, Type: IAT modification 0x0040502C–>00000000 [unknown_code_page] [3156]wscsvc32.exe–>kernel32.dll–>GetModuleHandleW, Type: IAT modification 0x00405050–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00405048–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>GlobalDeleteAtom, Type: IAT modification 0x00405034–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>GlobalFindAtomW, Type: IAT modification 0x00405040–>00000000 [kernel32.dll] [3156]wscsvc32.exe–>kernel32.dll–>TlsGetValue, Type: IAT modification 0x00405030–>00000000 [kernel32.dll] [3336]rundll32.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C814BC–>00000000 [shimeng.dll] [3336]rundll32.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B61170–>00000000 [shimeng.dll] [3336]rundll32.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x768E1414–>00000000 [shimeng.dll] [3336]rundll32.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [shimeng.dll] [3336]rundll32.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x4B0D11E8–>00000000 [shimeng.dll] [3356]defcnt.exe–>kernel32.dll–>CreateProcessW, Type: IAT modification 0x004AF744–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>EndUpdateResourceW, Type: IAT modification 0x004AF74C–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>GetAtomNameW, Type: IAT modification 0x004AF73C–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>GetDateFormatW, Type: IAT modification 0x004AF740–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>GetModuleHandleW, Type: IAT modification 0x004AF750–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x004AF748–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>GetStartupInfoW, Type: IAT modification 0x004AF72C–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>GlobalReAlloc, Type: IAT modification 0x004AF734–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>lstrcatA, Type: IAT modification 0x004AF738–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>lstrcmpi, Type: IAT modification 0x004AF728–>00000000 [user32.dll] [3356]defcnt.exe–>kernel32.dll–>TlsGetValue, Type: IAT modification 0x004AF730–>00000000 [user32.dll]

sorry, double posted

dzmr5s,

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please post the results.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report… at the bottom.
• Click the Save report… button.
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

• MBAM log
• Kaspersky log

I am sorry, but I cannot get Kaspersky to run completely. Sometimes it stops and other times my machine reboots. I have tried over and over! I do have the Malwarebytes log: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4339 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18928 7/22/2010 5:14:40 PM mbam-log-2010-07-22 (17-14-40).txt Scan type: Quick scan Objects scanned: 125687 Time elapsed: 10 minute(s), 20 second(s) Memory Processes Infected: 3 Memory Modules Infected: 2 Registry Keys Infected: 6 Registry Values Infected: 6 Registry Data Items Infected: 1 Folders Infected: 1 Files Infected: 35 Memory Processes Infected: C:\Users\Wayne\AppData\Local\Temp\MSDERUN.EXE (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Roaming\Defense Center\defcnt.exe (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> No action taken. Memory Modules Infected: C:\Users\Wayne\AppData\Roaming\Defense Center\defhook.dll (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\mschrt20ex.dll (Rogue.DefenseCenter) -> No action taken. Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba} (Rogue.Installer) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntiVirus2008) -> No action taken. HKEY_CURRENT_USER\Software\AVSolution (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\AVSolution (Trojan.Agent) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\defense center (Trojan.FakeAlert) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uxasecjw (Trojan.FakeAV) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mgizeyutezezuq (Trojan.Agent.U) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fyavulokuzox (Trojan.Agent.U) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\24d1ca9a-a864-4f7b-86fe-495eb56529d8 (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\7bde84a2-f58f-46ec-9eac-f1f90fead080 (Malware.Trace) -> No action taken. Registry Data Items Infected: HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> No action taken. Folders Infected: C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center (Rogue.DefenseCenter) -> No action taken. Files Infected: C:\Users\Wayne\AppData\Roaming\Defense Center\defhook.dll (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\MSDERUN.EXE (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Roaming\Defense Center\defcnt.exe (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\qcdobsvcy\symrpyltssd.exe (Trojan.FakeAV) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\07d96a26.exe (Trojan.Dropper) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\63e230ee.exe (Rootkit.TDSS) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\6517b5d4.exe (Trojan.FakeAV) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\qhKyGsqQIP.exe (Rootkit.TDSS) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\TMP36856.tmp (Trojan.Downloader) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\tmpBAB1.tmp (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\d12cdb63.exe (Rootkit.TDSS) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\dhdhtrdhdrtr5y (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\topwesitjh (Trojan.FakeAlert) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\VQBZgaAKLZ.exe (Trojan.Dropper) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\About.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Activate.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Buy.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Defense Center Support.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Defense Center.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Scan.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Settings.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Update.lnk (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\Desktop\nudetube.com.lnk (Rogue.Link) -> No action taken. C:\Users\Wayne\Desktop\pornotube.com.lnk (Rogue.Link) -> No action taken. C:\Users\Wayne\Desktop\spam001.exe (Malware.Trace) -> No action taken. C:\Users\Wayne\Desktop\spam003.exe (Malware.Trace) -> No action taken. C:\Users\Wayne\Desktop\troj000.exe (Malware.Trave) -> No action taken. C:\Users\Wayne\Desktop\youporn.com.lnk (Rogue.Link) -> No action taken. C:\Users\Wayne\Favorites\_favdata.dat (Malware.Trace) -> No action taken. C:\Users\Wayne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Defense Center.LNK (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\0.4288639316565428.exe (Trojan.Dropper) -> No action taken. C:\Users\Wayne\AppData\Local\Temp\mschrt20ex.dll (Rogue.DefenseCenter) -> No action taken. C:\Users\Wayne\AppData\Local\plpret.dll (Trojan.Agent.U) -> No action taken. C:\Users\Wayne\AppData\Local\ezafifizosowuwu.dll (Trojan.Agent.U) -> No action taken.

dzmr5s,

No problem, Kaspersky can be finnicky. Please have MBAM remove all of those detections, reboot and then try Kaspersky. If it still gives you trouble, run this instead:

🖼Click to load external image (Posted Image) Please run Eset Online Scanner

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button.
• Click Start. The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button. The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Please include the following in your next post:

• MBAM log
• Kaspersky (or ESET) log

Well, … I have tried to run the Eset scan several times. It always closes at 87% and the computer reboots. It finds about 20 items. I will post the Malwarebytes log. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4339 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18928 7/23/2010 12:46:11 AM mbam-log-2010-07-23 (00-46-11).txt Scan type: Quick scan Objects scanned: 126633 Time elapsed: 9 minute(s), 15 second(s) Memory Processes Infected: 3 Memory Modules Infected: 2 Registry Keys Infected: 6 Registry Values Infected: 6 Registry Data Items Infected: 1 Folders Infected: 1 Files Infected: 35 Memory Processes Infected: C:\Users\Wayne\AppData\Local\Temp\MSDERUN.EXE (Trojan.FakeAlert) -> Unloaded process successfully. C:\Users\Wayne\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Unloaded process successfully. C:\Users\Wayne\AppData\Roaming\Defense Center\defcnt.exe (Trojan.FakeAlert) -> Unloaded process successfully. Memory Modules Infected: C:\Users\Wayne\AppData\Roaming\Defense Center\defhook.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Users\Wayne\AppData\Local\Temp\mschrt20ex.dll (Rogue.DefenseCenter) -> Delete on reboot. Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntiVirus2008) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\AVSolution (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\AVSolution (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\defense center (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uxasecjw (Trojan.FakeAV) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mgizeyutezezuq (Trojan.Agent.U) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fyavulokuzox (Trojan.Agent.U) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\24d1ca9a-a864-4f7b-86fe-495eb56529d8 (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\7bde84a2-f58f-46ec-9eac-f1f90fead080 (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully. Folders Infected: C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center (Rogue.DefenseCenter) -> Quarantined and deleted successfully. Files Infected: C:\Users\Wayne\AppData\Roaming\Defense Center\defhook.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Users\Wayne\AppData\Local\Temp\MSDERUN.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Defense Center\defcnt.exe (Trojan.FakeAlert) -> Delete on reboot. C:\Users\Wayne\AppData\Local\qcdobsvcy\symrpyltssd.exe (Trojan.FakeAV) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\07d96a26.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\63e230ee.exe (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\6517b5d4.exe (Trojan.FakeAV) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\qhKyGsqQIP.exe (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\TMP36856.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\tmpBAB1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\d12cdb63.exe (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\dhdhtrdhdrtr5y (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\topwesitjh (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\VQBZgaAKLZ.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\About.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Activate.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Buy.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Defense Center Support.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Defense Center.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Scan.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Settings.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Defense Center\Update.lnk (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\Desktop\nudetube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Users\Wayne\Desktop\pornotube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Users\Wayne\Desktop\spam001.exe (Malware.Trace) -> Quarantined and deleted successfully. C:\Users\Wayne\Desktop\spam003.exe (Malware.Trace) -> Quarantined and deleted successfully. C:\Users\Wayne\Desktop\troj000.exe (Malware.Trave) -> Quarantined and deleted successfully. C:\Users\Wayne\Desktop\youporn.com.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Users\Wayne\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Defense Center.LNK (Rogue.DefenseCenter) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\0.4288639316565428.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Wayne\AppData\Local\Temp\mschrt20ex.dll (Rogue.DefenseCenter) -> Delete on reboot. C:\Users\Wayne\AppData\Local\plpret.dll (Trojan.Agent.U) -> Delete on reboot. C:\Users\Wayne\AppData\Local\ezafifizosowuwu.dll (Trojan.Agent.U) -> Delete on reboot.

dzmr5s,

Time for a bigger hammer:

🖼Click to load external image (Posted Image) Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt.

Please include the following in your next post:

• ComboFix log

dzmr5s,

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

http://forums.whatthetech.com/index.php?showtopic=113377
Collect::
c:\users\Wayne\AppData\Roaming\Defense Center\Uninstall.exe
c:\users\Wayne\AppData\Roaming\Defense Center\defext.dll
c:\users\Wayne\AppData\Local\Jgihebaj.bin
c:\users\Wayne\AppData\Local\Dtabusuqikuw.dat
Folder::
c:\users\Wayne\AppData\Roaming\Defense Center
c:\users\Wayne\AppData\Local\qcdobsvcy

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

• ComboFix log

dzmr5s,

I have one more ComboFix script for you, then I need to to apply an update and try MBAM and Kaspersky one more time:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

SecCenter::
{2CC57799-C906-4c6b-B4A0-B77E78EBF31B}

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Your Java is out of date.

Java™ 6 Update 18 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. If it does not, let me know.

Once the install is complete…

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

• On the General tab, under Temporary Internet Files, click the Settings button.
• Next, click on the Delete Files button
• There are two options in the window to clear the cache - Leave BOTH Checked
  
  • Applications and Applets
  • Trace and Log Files
• Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

• Click OK to leave the Temporary Files Window
• Click OK to leave the Java Control Panel.

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
• Click Check for Updates
• If an update is found, it will download and install the latest version.
• The program will close to update and reopen.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report… at the bottom.
• Click the Save report… button.
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

• ComboFix log
• MBAM log
• Kaspersky log