What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

FBI Moneypak [Solved]

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
The infection is preventing aswMBR from running.

Try the following tool. It may not run either, so don't be alarmed.

  • TDSSKiller

    Please download TDSSKiller.

    • Extract it to your desktop
    • Double click TDSSKiller.exe
    • When the window opens, click on Change parameters
    • Under ”Additional options”, put a check mark in the box next to “Detect TDLFS file system”
    • Click OK
    • Press Start Scan
    • IMPORTANT: As we are only looking for a log of what is on the machine right now, choose to Skip whatever is found
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
Post #17
No, that doesn't run either. I thought I had taken care of the virus that is hiding all of the icons and folders, but none of the things I have downloaded for this removal are on the desktop and the computer also randomly plays audio commercials even though no windows or progams are open. I think there are more issues than just FBI Moneypak, but you probably know that by looking at all of these logs. I thought I'd mention it just in case. Also, Security Essentials found something and removed it during a scan. I don't know what it was or if it matter. Pam
Post #18
Please disable any real-time security programs such as your anti-virus before proceeding with this scan.

Let's try running the Kaspersky Virus Removal Tool.

Download the tool from here and save it to your desktop.

Double click the set up icon to install it > click Run > Select your language > follow the steps in the wizard to install it. (This will take a few minutes to install)

When the tool launches, click the gear at the top right and make sure the following objects are selected under scan scope:

  • System memory
  • Hidden startup objects
  • Disk boot sectors
  • Local Disk (C:)
Now click Automatic Scan at the top left and Start scanning.

Allow it to remove any threats (choose the "select this option for all items")

This scan will take quite a while.

Once the scan has completed > select the report button at the top right > choose "save" > post the content of the report in your next reply
Post #19
When I click on the link for Kaspersky I was directed to a page to supply name and email address. When I did that, I was directed to a page to choose a version. I chose ver 11, english and was directed to a HTTP 404 not found Web Page Cannot Be Found. I cannot download this Kaspersky program.
Post #20
Disregard my last message. I was able to access that web page from a clean computer and save to a jump drive. I was able to install Kaspersky Virus Removal Tool and it is running now.
Post #21
Your web site kicks me off when I try to paste this entire log and it will not upload either, so I was going to try to send it in sections but even that is telling me two minutes worth of scan is too long for a post. The log is almost 68,000kb. Please let me know how you'd like me to proceed. Thanks, Pam
Post #23 last edited
When I powered up the computer today, the FBI MoneyPak is back covering the entire screen. Should I go back to the beginning of this thread and start from square one? The computer was working just ok yesterday after running kaspersky. It was very slow but I could still access everything, so I don't know what happened overnight to bring this back. When I saw filedropper requires me to agree to paypal, I got kind of uncomfortable with that, so I'm trying my MSN skydrive for the first time. Hopefully this url works for you.
Post #24
I take it you can't access your computer anymore?

Please perform the following steps on a clean PC. We are going to be putting a small Linux distro on a flash drive so we can boot to it on your infected PC.

  • Download and save a copy of the latest Slacko Puppy ISO file
  • Download and save a copy of Unetbootin for Windows.
  • Insert an empty formatted USB drive into a USB port on the computer that's being used to create the bootable USB.
  • Launch Unetbootin ….

[external image: Posted Image]

  • Ensure that Disk Image is selected.
  • Using the browse button … browse to and select the Puppy ISO file.
  • Ensure that Type: is set to USB Drive and that the Drive: letter corresponds to the USB drive.
  • Click OK

Next

You need to change the boot order of the infected computer to boot from a USB drive ….

Read HERE for instructions how to do this.


When fully booted you should see a Desktop similar to the one below.

[external image: Posted Image]

Next

Click on each of the drive items found in the bottom left corner to mount them (when mounted they will have a red cross next to them). In this example SDA is the hard drive and has 3 partitions, SDB is the USB drive that Puppy was loaded from.

[external image: Posted Image]

Next

Launch GParted which is found at Menu > System > GParted partition manager, when launched the following box will open ….

[external image: Posted Image]


Click to select All Drives then click Okay

GParted will scan the computer and then display a window similar to this ….

[external image: Posted Image]

To take a screenshot in Puppy ….

With the GParted window open …

  • Click menu > Graphic > mtPaint-snapshot screen capture
  • A small window will open ….
    • Click Capture Now
    • Click OK
  • The mtPaint program will open ….
    • Click File > Save
    • Double click on ../
    • Double click on mnt/
    • Double click on sdb1/ (or whatever corresponds to your flash drive)
    • Set File Format to JPEG
    • Enter screenshot1 into the text box
    • Click OK

This will save a file screenshot1.jpeg into the USB drive.

Next

Click menu > shutdown > power off computer
If prompted to save the session click on No


Puppy will now close down.

Please post screenshot1.jpg in your next reply.
Post #26
  • Boot into Puppy
  • Mount all drives
  • Click menu > System > GParted partition manager
  • Select to scan all drives.
  • When the scan is complete you should see exactly what you posted in the screenshot from earlier.
  • Right click on sda2, which should be the 55.82 GB partition, and select Manage Flags
  • Check the boot flag option
  • Click Close, and GParted will add the boot flag to sda2
Remove the USB drive, then click menu > shutdown > reboot computer to boot the computer back into Windows.

Are you able to get back into Windows? If so, how is your computer running?
Post #27
After following your instructions, I can log in to my screen name and the computer appears as if I'll be able to use it, but then the screen turns white and the FBI MoneyPak is there again. This is the craziest thing I've ever seen! Pam
Post #28
Hi gargoyle1210, Let's get another scan with FRST using the instructions from earlier. Please just post FRST.txt; you don't need to search for services.exe this time.
Post #29
Frst text Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 25-07-2012 01 Ran by [removed] at 12-08-2012 12:15:13 Running from E:\ Windows 7 Home Premium (X86) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\…\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe [176128 2005-10-07] (Alps Electric Co., Ltd.) HKLM\…\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1557800 2009-08-28] (Synaptics Incorporated) HKLM\…\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe -all [741376 2007-05-19] (Hewlett-Packard) HKLM\…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.) HKLM\…\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [49152 2005-12-09] (CyberLink Corp.) HKLM\…\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [141848 2009-09-23] (Intel Corporation) HKLM\…\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [173592 2009-09-23] (Intel Corporation) HKLM\…\Run: [Persistence] C:\Windows\system32\igfxpers.exe [150552 2009-09-23] (Intel Corporation) HKLM\…\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-26] (Microsoft Corporation) HKLM\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated) HKLM\…\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated) HKU\Scherer Electric 3\…\Run: [KSS] "C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun [202296 2012-04-25] (Kaspersky Lab ZAO) HKU\Scherer Electric 3\…\Run: [syshost32] C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9}\syshost.exe [340992 2012-08-08] (3D Connexion) HKU\Scherer Electric 3\…\Run: [9CEEE090CE59B7] C:\ProgramData\9CEEE090CE59B7\9CEEE090CE59B7.exe [61440 2012-08-08] () Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\Scherer Electric 3\Start Menu\Programs\Startup\Explorer.lnk ShortcutTarget: Explorer.lnk -> C:\ProgramData\9CEEE090CE59B7\9CEEE090CE59B7.exe () ================================ Services (Whitelisted) ================== 2 AccubidSecurityServer2; "C:\Program Files\Accubid\Accubid Security\SecurityService2.exe" [1082368 2009-05-29] (Accubid Systems) 2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation) 2 hasplms; C:\Windows\system32\hasplms.exe -run [4180576 2010-09-27] (SafeNet Inc.) 2 KSS; "C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" -r [202296 2012-04-25] (Kaspersky Lab ZAO) 3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x] ========================== Drivers (Whitelisted) ============= 2 aksfridge; C:\Windows\System32\DRIVERS\aksfridge.sys [356864 2010-09-27] (SafeNet Inc.) 3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [238208 2009-12-17] (Aladdin Knowledge Systems Ltd.) 3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [46336 2009-12-17] (Aladdin Knowledge Systems Ltd.) 3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [16384 2009-12-17] (Aladdin Knowledge Systems Ltd.) 2 hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [588800 2009-12-17] (SafeNet Inc.) 0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation) 3 QSerBus; C:\Windows\System32\DRIVERS\qserbus.sys [48976 2009-12-22] (Quatech, Incorporated) 3 QTSerial; C:\Windows\System32\DRIVERS\qtserial.sys [97488 2009-12-22] (Quatech, Incorporated) ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-08-08 12:42 - 2012-08-10 12:30 - 00003072 ____A C:\Users\Scherer Electric 3\AppData\Roaming\twain.dll 2012-08-08 12:42 - 2012-08-08 12:42 - 00000000 ____D C:\Users\All Users\9CEEE090CE59B7 2012-08-08 10:36 - 2012-08-08 10:36 - 00000000 ____D C:\Users\Scherer Electric 3\Downloads\tdsskiller 2012-08-08 10:35 - 2012-08-08 10:35 - 02117108 ____A C:\Users\Scherer Electric 3\Downloads\tdsskiller.zip 2012-08-08 10:28 - 2012-08-08 10:28 - 09827016 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerInstaller.exe 2012-08-08 10:07 - 2012-08-08 10:07 - 00000000 __SHD C:\Windows\System32\%APPDATA% 2012-08-08 10:03 - 2012-08-08 10:04 - 00003540 ____A C:\Users\Scherer Electric 3\govlog.dat 2012-08-08 10:00 - 2012-08-08 10:00 - 00000000 ____D C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9} 2012-08-08 09:59 - 2012-08-08 09:59 - 00145920 ____A (Labtec) C:\Users\Scherer Electric 3\goveuqc.exe 2012-08-08 08:12 - 2012-08-08 08:16 - 69354675 ____A C:\Users\Scherer Electric 3\Downloads\kaspersky report.txt 2012-08-08 04:22 - 2012-08-08 04:21 - 00001047 ____A C:\Users\Scherer Electric 3\Desktop\Kaspersky Security Scan.lnk 2012-08-08 04:20 - 2012-08-08 05:28 - 00000000 ____D C:\Users\All Users\Kaspersky Lab 2012-08-08 04:20 - 2012-08-08 04:20 - 00000000 ____D C:\Program Files\Kaspersky Lab 2012-08-08 04:11 - 2012-08-08 04:11 - 00180000 ____A (Kaspersky Lab) C:\Users\Scherer Electric 3\Downloads\kss12.0.1.117EN_RU_DE_FR_2926.exe 2012-08-07 07:16 - 2012-08-07 07:16 - 00000000 ____D C:\Users\Scherer Electric 3\New folder 2012-08-06 05:56 - 2012-08-06 05:56 - 04731392 ____A (AVAST Software) C:\Users\Scherer Electric 3\Downloads\aswMBR (1).exe 2012-08-06 05:50 - 2012-08-06 05:50 - 00006509 ____A C:\Users\Scherer Electric 3\Downloads\Result.txt 2012-08-06 05:48 - 2012-08-06 05:48 - 00306999 ____A (Farbar) C:\Users\Scherer Electric 3\Downloads\ListParts.exe 2012-08-06 05:38 - 2012-08-06 05:39 - 04731392 ____A (AVAST Software) C:\Users\Scherer Electric 3\Downloads\aswMBR.exe 2012-08-06 05:32 - 2012-08-06 05:32 - 00042550 ____A C:\Users\Scherer Electric 3\Documents\Extras.Txt 2012-08-06 05:31 - 2012-08-06 05:31 - 00053024 ____A C:\Users\Scherer Electric 3\Documents\OTL.Txt 2012-08-06 05:29 - 2012-08-06 05:29 - 00042550 ____A C:\Users\Scherer Electric 3\Desktop\Extras.Txt 2012-08-06 05:25 - 2012-08-06 05:25 - 00053024 ____A C:\Users\Scherer Electric 3\Desktop\OTL.Txt 2012-08-06 05:05 - 2012-08-06 05:05 - 00596480 ____A (OldTimer Tools) C:\Users\Scherer Electric 3\Desktop\OTL.exe 2012-08-05 16:05 - 2012-08-05 16:06 - 00000000 ____D C:\FRST 2012-08-03 06:59 - 2010-02-08 07:51 - 00000957 ____A C:\Users\Public\Desktop\Bidwinner 9.lnk 2012-08-03 06:59 - 2010-02-08 07:51 - 00000950 ____A C:\Users\Public\Desktop\Time & Material Billing 9.lnk 2012-08-03 06:51 - 2012-08-03 06:59 - 00002216 ____A C:\Users\Scherer Electric 3\Desktop\unhide.txt 2012-08-03 06:50 - 2012-08-03 06:49 - 00399264 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\unhide.exe 2012-08-03 04:57 - 2012-08-03 04:56 - 01051552 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\iExplore.exe 2012-08-02 09:24 - 2012-08-02 09:24 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-02 09:21 - 2012-08-09 07:28 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-08-02 09:21 - 2012-08-08 10:29 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe ============ 3 Months Modified Files ======================== 2012-08-10 12:30 - 2012-08-08 12:42 - 00003072 ____A C:\Users\Scherer Electric 3\AppData\Roaming\twain.dll 2012-08-10 12:28 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-08-10 12:28 - 2009-07-13 20:39 - 00025845 ____A C:\Windows\setupact.log 2012-08-09 07:28 - 2012-08-02 09:21 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-08-09 04:23 - 2009-07-13 20:34 - 00013760 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-08-09 04:23 - 2009-07-13 20:34 - 00013760 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-08-08 10:35 - 2012-08-08 10:35 - 02117108 ____A C:\Users\Scherer Electric 3\Downloads\tdsskiller.zip 2012-08-08 10:29 - 2012-08-02 09:21 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2012-08-08 10:29 - 2011-07-05 09:15 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2012-08-08 10:28 - 2012-08-08 10:28 - 09827016 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerInstaller.exe 2012-08-08 10:04 - 2012-08-08 10:03 - 00003540 ____A C:\Users\Scherer Electric 3\govlog.dat 2012-08-08 10:01 - 2010-02-05 14:35 - 01510162 ____A C:\Windows\WindowsUpdate.log 2012-08-08 09:59 - 2012-08-08 09:59 - 00145920 ____A (Labtec) C:\Users\Scherer Electric 3\goveuqc.exe 2012-08-08 08:57 - 2010-02-08 05:05 - 00022884 ____A C:\Windows\PFRO.log 2012-08-08 08:16 - 2012-08-08 08:12 - 69354675 ____A C:\Users\Scherer Electric 3\Downloads\kaspersky report.txt 2012-08-08 05:28 - 2010-02-05 11:56 - 00743162 ____A C:\Windows\System32\PerfStringBackup.INI 2012-08-08 04:21 - 2012-08-08 04:22 - 00001047 ____A C:\Users\Scherer Electric 3\Desktop\Kaspersky Security Scan.lnk 2012-08-08 04:11 - 2012-08-08 04:11 - 00180000 ____A (Kaspersky Lab) C:\Users\Scherer Electric 3\Downloads\kss12.0.1.117EN_RU_DE_FR_2926.exe 2012-08-06 05:56 - 2012-08-06 05:56 - 04731392 ____A (AVAST Software) C:\Users\Scherer Electric 3\Downloads\aswMBR (1).exe 2012-08-06 05:50 - 2012-08-06 05:50 - 00006509 ____A C:\Users\Scherer Electric 3\Downloads\Result.txt 2012-08-06 05:48 - 2012-08-06 05:48 - 00306999 ____A (Farbar) C:\Users\Scherer Electric 3\Downloads\ListParts.exe 2012-08-06 05:39 - 2012-08-06 05:38 - 04731392 ____A (AVAST Software) C:\Users\Scherer Electric 3\Downloads\aswMBR.exe 2012-08-06 05:32 - 2012-08-06 05:32 - 00042550 ____A C:\Users\Scherer Electric 3\Documents\Extras.Txt 2012-08-06 05:31 - 2012-08-06 05:31 - 00053024 ____A C:\Users\Scherer Electric 3\Documents\OTL.Txt 2012-08-06 05:29 - 2012-08-06 05:29 - 00042550 ____A C:\Users\Scherer Electric 3\Desktop\Extras.Txt 2012-08-06 05:25 - 2012-08-06 05:25 - 00053024 ____A C:\Users\Scherer Electric 3\Desktop\OTL.Txt 2012-08-06 05:05 - 2012-08-06 05:05 - 00596480 ____A (OldTimer Tools) C:\Users\Scherer Electric 3\Desktop\OTL.exe 2012-08-03 06:59 - 2012-08-03 06:51 - 00002216 ____A C:\Users\Scherer Electric 3\Desktop\unhide.txt 2012-08-03 06:49 - 2012-08-03 06:50 - 00399264 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\unhide.exe 2012-08-03 05:10 - 2011-10-18 05:24 - 00000361 ____A C:\rkill.log 2012-08-03 04:56 - 2012-08-03 04:57 - 01051552 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\iExplore.exe 2012-08-02 09:24 - 2012-08-02 09:24 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-07-12 02:38 - 2009-07-13 20:33 - 00386384 ____A C:\Windows\System32\FNTCACHE.DAT 2012-07-12 02:23 - 2010-02-08 05:24 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-07-12 02:21 - 2009-07-13 18:04 - 00000534 ____A C:\Windows\win.ini 2012-06-11 18:40 - 2012-07-12 02:22 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-06-08 20:41 - 2012-07-11 02:32 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-06-05 21:05 - 2012-07-11 02:32 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-06-05 21:05 - 2012-07-11 02:32 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-06-05 21:03 - 2012-07-11 02:32 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe 2012-06-02 14:19 - 2012-06-21 02:13 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll 2012-06-02 14:12 - 2012-06-21 02:13 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll 2012-06-02 14:12 - 2012-06-21 02:13 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll 2012-06-02 11:19 - 2012-06-21 02:12 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll 2012-06-02 11:12 - 2012-06-21 02:12 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe 2012-06-02 01:07 - 2012-07-12 02:28 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-06-02 00:43 - 2012-07-12 02:28 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-06-02 00:33 - 2012-07-12 02:29 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-06-02 00:26 - 2012-07-12 02:28 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-06-02 00:25 - 2012-07-12 02:29 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-06-02 00:25 - 2012-07-12 02:28 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-06-02 00:23 - 2012-07-12 02:29 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-06-02 00:21 - 2012-07-12 02:29 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-06-02 00:20 - 2012-07-12 02:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-06-02 00:19 - 2012-07-12 02:29 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-06-02 00:19 - 2012-07-12 02:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-06-02 00:17 - 2012-07-12 02:29 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-06-02 00:16 - 2012-07-12 02:29 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-06-02 00:14 - 2012-07-12 02:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-06-01 20:45 - 2012-07-11 02:32 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-06-01 20:45 - 2012-07-11 02:32 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-06-01 20:40 - 2012-07-11 02:32 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-06-01 20:40 - 2012-07-11 02:32 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-06-01 20:39 - 2012-07-11 02:32 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll ZeroAccess: C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931} C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\@ C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\L C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\n C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\U C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\L\00000004.@ C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\L\201d3dde C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\00000004.@ C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\00000008.@ C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\000000cb.@ C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\80000000.@ C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\80000032.@ ZeroAccess: C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931} C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931}\@ C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931}\L C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931}\n C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931}\U ZeroAccess: C:\Windows\assembly\GAC\Desktop.ini ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe A302BBFF2A7278C0E239EE5D471D86A9 ZeroAccess <==== ATTENTION!. C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 37% Total physical RAM: 1014.44 MB Available physical RAM: 634.56 MB Total Pagefile: 1014.44 MB Available Pagefile: 646.05 MB Total Virtual: 2047.88 MB Available Virtual: 1978.87 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:55.82 GB) (Free:18.66 GB) NTFS ==>[Drive with boot components (obtained from BCD)] 2 Drive d: (GRMCHPFRER_EN_DVD) (CDROM) (Total:2.33 GB) (Free:0 GB) UDF 3 Drive e: (CRUZER) (Removable) (Total:7.5 GB) (Free:5.92 GB) FAT32 4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 55 GB 4096 KB Disk 1 Online 7691 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 54 MB 31 KB Partition 2 Primary 55 GB 54 MB Partition 3 Primary 10 MB 55 GB ================================================================================ == Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 3 FAT Partition 54 MB Healthy Hidden ================================================================================ == Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 C NTFS Partition 55 GB Healthy ================================================================================ == Disk: 0 Partition 3 Type : 17 (Suspicious Type) Hidden: Yes Active: No There is no volume associated with this partition. ================================================================================ == Partitions of Disk 1: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 7691 MB 16 KB ================================================================================ == Disk: 1 Partition 1 Type : 0B Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 E CRUZER FAT32 Removable 7691 MB Healthy ================================================================================ == ========================================================== Last Boot: 2012-08-07 07:45 ======================= End Of Log ========================== Search text Farbar Recovery Scan Tool Version: 25-07-2012 01 Ran by [removed] at 2012-08-12 12:19:51 Running from E:\ ================== Search: "services.exe" =================== C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe [2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 C:\Windows\System32\services.exe [2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) A302BBFF2A7278C0E239EE5D471D86A9 C:\i386\services.exe [2007-06-06 04:57] - [2004-08-04 02:00] - 0108032 ____A (Microsoft Corporation) C6CE6EEC82F187615D1002BB3BB50ED4 === End Of Search ===
Post #30
Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

HKU\Scherer Electric 3\…\Run: [syshost32] C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9}\syshost.exe [340992 2012-08-08] (3D Connexion)
C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9}
HKU\Scherer Electric 3\…\Run: [9CEEE090CE59B7] C:\ProgramData\9CEEE090CE59B7\9CEEE090CE59B7.exe [61440 2012-08-08] ()
C:\ProgramData\9CEEE090CE59B7
ShortcutTarget: Explorer.lnk -> C:\ProgramData\9CEEE090CE59B7\9CEEE090CE59B7.exe ()
2012-08-08 12:42 - 2012-08-10 12:30 - 00003072 ____A C:\Users\Scherer Electric 3\AppData\Roaming\twain.dll
2012-08-08 12:42 - 2012-08-08 12:42 - 00000000 ____D C:\Users\All Users\9CEEE090CE59B7
2012-08-08 10:03 - 2012-08-08 10:04 - 00003540 ____A C:\Users\Scherer Electric 3\govlog.dat
2012-08-08 10:00 - 2012-08-08 10:00 - 00000000 ____D C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9}
2012-08-08 09:59 - 2012-08-08 09:59 - 00145920 ____A (Labtec) C:\Users\Scherer Electric 3\goveuqc.exe
C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931}
C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931}
C:\Windows\assembly\GAC\Desktop.ini
Replace: C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe C:\Windows\System32\services.exe

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Let me know if you can access your computer now. If so, how is it running?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI