As you can see you have some very nasty Backdoor Trojans, as I said before I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
For some reason I could not submit e8v08PB.dat. Virus Total would inform me that it was sending the file but then would go back to the submit page.[
Did you try the other online scanners? if you didn't could you please try and run C:\ProgramData\e8v08PB.dat again. jotti.org Kaspersky Virus File Scanner
ComboFix - CFScript
This script is for this user and computer ONLY! Using this tool incorrectly could cause problems with your operating system… preventing it from ever starting again!
You will not have Internet access when you execute ComboFix. All open windows will need to be closed!
Open notepad and copy/paste the text in the quotebox below into it:
Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
===================== NEXT
Please run another set of OTL scan for me please.
Double click OTL.exe to launch the programme.
Check the following.
Scan all users.
Standard Output.
Lop check.
Purity check.
Under Extra Registry section, select Use SafeList
Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).
When finished it will produce two logs. OTL.txt (open on your desktop). Extras.txt (minimised in your taskbar)
Please post me both logs.
Summary of the logs I need from you in your next post:
Results from the scan
CFScript log
OTL.txt
Extras.txt
Before I run the ComboFix script, do you think I should do so in normal mode or safe mode with networking? I remember I had to run ComboFix in safe mode with networking in order to get it to work correctly before.
Ok, I tried to submit C:\ProgramData\e8v08PB.dat on Jotti but it came back and stated that the file was empty (0 bytes). On Kaspersky's site the online scanner does not appear to be there. There was some links to download virus removal tools and a message stating that a new and improved online virus scanner was coming soon. I dragged the text file onto ComboFix and it started runnning but then I got a messge stating the following:
Current date is 2011-12-23. ComboFix has expired
Click 'Yes' to run in REDUCED FUNCTIONALITY mode
Click 'No' to exit
I am going to leave it as is for now and wait for your direction. Happy Holidays
Please go ahead and right click to delete the copy of Combofix and download a new copy. Then run the ComboFix script.
Thank you cjdragon and you have a Happy Holidays too.
OTL logfile created on: 12/26/2011 3:30:37 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\daniel rodriguez\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.93 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 59.07% Memory free
5.86 Gb Paging File | 4.39 Gb Available in Paging File | 74.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 216.47 Gb Total Space | 165.90 Gb Free Space | 76.64% Space Free | Partition Type: NTFS
Drive D: | 16.12 Gb Total Space | 2.33 Gb Free Space | 14.43% Space Free | Partition Type: NTFS
Drive E: | 7.95 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 61.97 Mb Total Space | 56.85 Mb Free Space | 91.73% Space Free | Partition Type: FAT
Computer Name: DANIELRODRIGUEZ | User Name: daniel rodriguez | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
OTL Extras logfile created on: 12/26/2011 3:30:37 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\daniel rodriguez\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.93 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 59.07% Memory free
5.86 Gb Paging File | 4.39 Gb Available in Paging File | 74.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 216.47 Gb Total Space | 165.90 Gb Free Space | 76.64% Space Free | Partition Type: NTFS
Drive D: | 16.12 Gb Total Space | 2.33 Gb Free Space | 14.43% Space Free | Partition Type: NTFS
Drive E: | 7.95 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 61.97 Mb Total Space | 56.85 Mb Free Space | 91.73% Space Free | Partition Type: FAT
Computer Name: DANIELRODRIGUEZ | User Name: daniel rodriguez | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
[ Application Events ]
Error - 11/30/2011 1:34:10 AM | Computer Name = danielrodriguez | Source = CVHSVC | ID = 100
Description = Information only. (Patch task for {90140011-0066-0409-0000-0000000FF1CE}):
DownloadLatest Failed: There are currently no active network connections. Background
Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error - 11/30/2011 4:19:43 AM | Computer Name = danielrodriguez | Source = System Restore | ID = 8193
Description =
Error - 11/30/2011 4:22:38 AM | Computer Name = danielrodriguez | Source = MsiInstaller | ID = 11314
Description =
Error - 12/5/2011 11:31:10 PM | Computer Name = danielrodriguez | Source = CVHSVC | ID = 100
Description = Information only. (Patch task for {90140011-0066-0409-0000-0000000FF1CE}):
DownloadLatest Failed: There are currently no active network connections. Background
Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error - 12/6/2011 4:44:16 AM | Computer Name = danielrodriguez | Source = CVHSVC | ID = 100
Description = Information only. (Patch task for {90140011-0066-0409-0000-0000000FF1CE}):
DownloadLatest Failed: There are currently no active network connections. Background
Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error - 12/8/2011 2:35:21 AM | Computer Name = danielrodriguez | Source = CVHSVC | ID = 100
Description = Information only. Error: Initialization failed 0x8007041d Type: 88::UnexpectedError.
Error - 12/8/2011 3:36:06 AM | Computer Name = danielrodriguez | Source = CVHSVC | ID = 100
Description = Information only. (Patch task for {90140011-0066-0409-0000-0000000FF1CE}):
DownloadLatest Failed: There are currently no active network connections. Background
Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error - 12/17/2011 1:59:13 PM | Computer Name = danielrodriguez | Source = HPSFMsgr.exe | ID = 2000
Description = HP Error ID: -2147467259HPSFMsgr.exe at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo
startInfo) at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
at HPSA_Messenger.Utilities.TaskScheduler.DeleteTask(ScheduleTask task) Message:
Illegal operation attempted on a registry key that has been marked for deletion StackTrace:
at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)
at System.Diagnostics.Process.Start(ProcessStartInfo startInfo) at HPSA_Messenger.Utilities.TaskScheduler.DeleteTask(ScheduleTask
task) Source: System Name: HPSFMsgr.exe Version: 01.00.00.00 Path: C:\Program Files
(x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Format:
en-US RAM: 3002 Ram Utilization: 30 TargetSite: Boolean StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
Error - 12/17/2011 2:00:43 PM | Computer Name = danielrodriguez | Source = HPSFMsgr.exe | ID = 2000
Description = HP Error ID: -2147467259HPSFMsgr.exe at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo
startInfo) at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
at HPSA_Messenger.Utilities.TaskScheduler.DeleteTask(ScheduleTask task) Message:
Illegal operation attempted on a registry key that has been marked for deletion StackTrace:
at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)
at System.Diagnostics.Process.Start(ProcessStartInfo startInfo) at HPSA_Messenger.Utilities.TaskScheduler.DeleteTask(ScheduleTask
task) Source: System Name: HPSFMsgr.exe Version: 01.00.00.00 Path: C:\Program Files
(x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Format:
en-US RAM: 3002 Ram Utilization: 30 TargetSite: Boolean StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
[ HP Wireless Assistant Events ]
Error - 12/21/2011 12:13:48 AM | Computer Name = danielrodriguez | Source = HP WA Application | ID = 0
Description = HardwareAccess.UnableToConnectException Application.ApplicationStartup;
failed to create hardware layer Error in the application. at HardwareAccess.Hardware..ctor(Dispatcher
dispatcher, ServicePort port, Int32 timeout) at HardwareAccess.Hardware.Create(Dispatcher
dispatcher, ServicePort port, Int32 timeout) at HPWA_Main.App.ApplicationStartup(Object
sender, StartupEventArgs args)
Error - 12/21/2011 12:14:25 AM | Computer Name = danielrodriguez | Source = HP WA Application | ID = 0
Description = MainWindow.ShowImpl; not initialized, closing application…
Error - 12/21/2011 12:35:56 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/21/2011 12:45:27 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/21/2011 12:50:46 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/21/2011 1:06:34 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/21/2011 1:11:42 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/21/2011 1:20:11 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/21/2011 1:24:51 AM | Computer Name = danielrodriguez | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at HPPA_Service.CurrentConfiguration.b__c()
Error - 12/23/2011 3:47:22 PM | Computer Name = danielrodriguez | Source = HP WA Application | ID = 0
Description = System.Exception HardwareAccess hasn't been instantiated properly.
at PAProgramAccess.Impl.UpdatePowerSchemeInformation(PowerScheme powerScheme)
[ System Events ]
Error - 9/6/2011 10:05:48 AM | Computer Name = danielrodriguez | Source = WMPNetworkSvc | ID = 866300
Description =
Error - 9/7/2011 9:15:49 AM | Computer Name = danielrodriguez | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Roxio
Hard Drive Watcher 9 service to connect.
Error - 9/7/2011 7:55:25 PM | Computer Name = danielrodriguez | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Roxio
Hard Drive Watcher 9 service to connect.
Error - 9/7/2011 8:22:00 PM | Computer Name = danielrodriguez | Source = BROWSER | ID = 8032
Description =
Error - 9/8/2011 9:32:35 AM | Computer Name = danielrodriguez | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Roxio
Hard Drive Watcher 9 service to connect.
Error - 9/8/2011 9:33:01 AM | Computer Name = danielrodriguez | Source = WMPNetworkSvc | ID = 866300
Description =
Error - 9/8/2011 10:03:56 AM | Computer Name = danielrodriguez | Source = BROWSER | ID = 8032
Description =
Error - 9/8/2011 1:31:37 PM | Computer Name = danielrodriguez | Source = BROWSER | ID = 8032
Description =
Error - 9/9/2011 11:11:42 AM | Computer Name = danielrodriguez | Source = BROWSER | ID = 8032
Description =
Error - 9/9/2011 4:39:33 PM | Computer Name = danielrodriguez | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Roxio
Hard Drive Watcher 9 service to connect.
Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:OTL
O3 - HKU\S-1-5-21-1009066323-1172440340-2828773592-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
:Commands
[createrestorepoint]
[purity]
[emptytemp]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
=============== NEXT
Please download Malwarebytes from Here or Here
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan. [external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please
=============== NEXT
ESET Online Scanner:
Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
Please go here then click on: [external image: Posted Image]
Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install. All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Summary of the logs I need from you in your next post:
OTL log
malwarebytes log
ESET log
Hows the computer running?
Ok, I have the new OTL log and Malwarebytes log. ESET Scanner has been running now for around 11 hours. I can see that it is actively scanning files and the scan time clock is accurate. I was just wondering if it normally takes this long. As I can't always be near the laptop, it does go into sleep mode occasionally. Not sure if this would affect it, but I thought I would let you know.
Well, it looks like the laptop decided to install an update and restart itself while I was away. I will have to run the ESET scan again. I tried this morning but I could not get IE to open. This actually seems to be an ongoing problem. Although the laptop is running better, sometimes it is still really slow and this makes it difficult to do troubleshooting. When I checked this morning something is maxing out the CPU at 100%. Do you think running RKill would help with this? Also, I am beginning to consider reinstallation of the OS. You never know what nasty boogers may lurking around on there. I spoke to my friend, the owner of the laptop, and he is ok with this. I noticed there is another harddrive on the laptop labeled RECOVERY. Do you think a copy of the OS could be there?
The MBAM scan could be a false positive, lets scan it with one of the websites below
Please go to one of the below sites to scan the following files:
Virus Total jotti.org Kaspersky Virus File Scanner
click on Browse, and upload the following file for analysis:
c:\Users\daniel rodriguez\Desktop\spybotsd-2.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
============ NEXT
Since you had a hard time with the ESET scanner we will try Kaspersky Online Scanner.
I'd like for you to run this next online scan to check for remnants or anything that might be hidden.
The below scan can take up to an hour or longer, please be patient.
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so no conflicts and to speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once scan is finished remember to re-enable resident antivirus protection along with whatever antispyware app you use.
Please do a scan with Kaspersky Online Scanner Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
Click on the Accept button and install any components it needs.
The program will install and then begin downloading the latest definition files.
After the files have been downloaded on the left side of the page in the Scan section select My Computer.
This will start the program and scan your system.
The scan will take a while, so be patient and let it run. (At times it may appear to stall)
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Once the scan is complete, click on View scan report To obtain the report:
Click on: Save Report As
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.
(Note.. for Internet Explorer 7 users:
If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
Or use Firefox with IE-Tab plugin https://addons.mozilla.org/en-US/firefox/addon/1419
Summary of the logs I need from you in your next post:
virustotal results
kaspersky log
How is your computer running?
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
