What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

FBI Moneypak [Solved]

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Unfortunately, I still have the white screen. I pulled the internet cable from the computer before I restarted so I just have a blank web page asking me refresh the page but I do not have any way of closing the page because there is no option to close. I even tried alt F4 hoping that would work but it did not. I opened in Safe Mode and as of right now, I do have access to the desktop. I don't know if it will last. I did not choose the Safe Mode with networking option, just Safe Mode. I should mention that when I ran Slacko Puppy and clicked on all the drives to mount them, the red x did not appear on the third drive would not mount and showed the drive is hidden. I don't know if it's relevant or not. Also, I mentioned I had a virus that hid all the icons and everything on the start menu. I had run malwarebytes in safe mode and then a fix to unhide the stuff that was hidden. My Icons and menu came back and shortly after that, this FBI Moneypak appeared. That is when I posted on WhattheTech. I haven't done anything other than follow your instructions since then. I'm only mentioning this because I wanted to let you know there are hidden things. I no longer have icons on my desktop and even during the time I could use the infected computer, nothing I downloaded to the desktop was there so I probably still have that virus too. I don't know if you can tell all of the problems I have when I respond to your request and post logs so I just wanted to mention. Pam
Post #32
Yes, I realize from your logs that your computer is badly infected. When you say you still have the white screen, is that after running the latest FRST fix I posted? If so, as I said it should have produced a log named fixlog.txt on your flash drive. It is important that I see that log in order to see what may or may not have gone wrong.
Post #33
Sorry, I forgot that step. And fyi, the computer is still okay in safe mode. Here's the log. Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 25-07-2012 01 Ran by [removed] at 2012-08-12 18:40:32 Run:2 Running from E:\ ============================================== HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows\CurrentVersion\Run\\syshost32 Value deleted successfully. C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9} moved successfully. HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows\CurrentVersion\Run\\9CEEE090CE59B7 Value deleted successfully. C:\ProgramData\9CEEE090CE59B7 moved successfully. C:\ProgramData\9CEEE090CE59B7\9CEEE090CE59B7.exe not found. C:\Users\Scherer Electric 3\AppData\Roaming\twain.dll moved successfully. C:\Users\All Users\9CEEE090CE59B7 not found. C:\Users\Scherer Electric 3\govlog.dat moved successfully. C:\Users\Scherer Electric 3\AppData\Local\{AAF44BF1-6044-FE61-76CF-178F568329F9} not found. C:\Users\Scherer Electric 3\goveuqc.exe moved successfully. C:\Windows\Installer\{1785dc02-490c-8308-3df3-61a04aa5d931} moved successfully. C:\Users\Scherer Electric 3\AppData\Local\{1785dc02-490c-8308-3df3-61a04aa5d931} moved successfully. C:\Windows\assembly\GAC\Desktop.ini moved successfully. C:\Windows\System32\services.exe moved successfully. C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe copied successfully to C:\Windows\System32\services.exe ==== End of Fixlog ====
Post #34
Try carrying out the following instructions in safe mode with networking. If you cannot access safe mode with networking, you will need to download these tools from a clean PC and copy them over from a flash drive to the infected PC where they can be run in safe mode. ComboFix is a powerful program that in some cases requires a very long time in order to complete its stages. Please allow it ample time to run. Assuming a successful run, let me know if you can access normal mode.

  • unhide.exe should help you with your missing icons.

  • ComboFix

    Refer to the ComboFix User's Guide


  • Download ComboFix from HERE.

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouse click ComboFix's window whilst it's running. That may cause it to stall.

    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Post #35
Here is the Combofix log. The computer still does not start normally without the Moneypak window opening up. ComboFix 12-08-10.02 - Scherer Electric 3 08/12/2012 23:10:44.1.1 - x86 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1014.609 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\users\Awrcs 2\AppData\Roaming\Adobe\plugs c:\users\Awrcs 2\AppData\Roaming\Adobe\shed c:\users\Awrcs 2\AppData\Roaming\Microsoft\Windows\Start Menu\Zentom System Guard.lnk c:\users\Awrcs 2\WINDOWS c:\users\Scherer Electric 3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk c:\users\Scherer Electric 3\AppData\Roaming\Roaming c:\users\Scherer Electric 3\AppData\Roaming\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#otscfr.com\settings.sol c:\users\Scherer Electric 3\AppData\Roaming\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol c:\users\Scherer Electric 3\AppData\Roaming\twain.dll c:\windows\system32\URTTemp c:\windows\system32\URTTemp\regtlib.exe . . ((((((((((((((((((((((((( Files Created from 2012-07-13 to 2012-08-13 ))))))))))))))))))))))))))))))) . . 2012-08-13 03:16 . 2012-08-13 03:16 ——– d—–w- c:\users\Scherer Electric 3\AppData\Local\temp 2012-08-13 03:16 . 2012-08-13 03:16 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-13 03:16 . 2012-08-13 03:16 ——– d—–w- c:\users\Awrcs 2\AppData\Local\temp 2012-08-12 22:42 . 2012-08-12 22:42 ——– d—–w- c:\programdata\9CEEE09014A67 2012-08-08 18:28 . 2012-08-08 18:28 9827016 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe 2012-08-08 18:07 . 2012-08-08 18:07 ——– d-sh–w- c:\windows\system32\%APPDATA% 2012-08-08 17:10 . 2012-06-29 08:44 6891424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D23795DC-AFDB-47CA-BBC3-881BB1EA9DE2}\mpengine.dll 2012-08-08 12:20 . 2012-08-08 12:20 ——– d—–w- c:\program files\Kaspersky Lab 2012-08-08 12:20 . 2012-08-08 13:28 ——– d—–w- c:\programdata\Kaspersky Lab 2012-08-07 15:16 . 2012-08-07 15:16 ——– d—–w- c:\users\Scherer Electric 3\New folder 2012-08-07 14:00 . 2012-06-29 08:44 6891424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-08-06 02:55 . 2012-08-06 02:55 ——– d—–w- c:\users\Scherer Electric 3\AppData\Local\Diagnostics 2012-08-06 00:05 . 2012-08-06 00:06 ——– d—–w- C:\FRST 2012-08-02 17:21 . 2012-08-08 18:29 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-08 18:29 . 2011-07-05 17:15 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-06-12 02:40 . 2012-07-12 10:22 2345984 —-a-w- c:\windows\system32\win32k.sys 2012-06-06 05:05 . 2012-07-11 10:32 1390080 —-a-w- c:\windows\system32\msxml6.dll 2012-06-06 05:05 . 2012-07-11 10:32 1236992 —-a-w- c:\windows\system32\msxml3.dll 2012-06-06 05:03 . 2012-07-11 10:32 805376 —-a-w- c:\windows\system32\cdosys.dll 2012-06-02 22:19 . 2012-06-21 10:13 45080 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-21 10:13 53784 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-21 10:13 35864 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-21 10:13 577048 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:19 . 2012-06-21 10:13 1933848 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:12 . 2012-06-21 10:13 2422272 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:12 . 2012-06-21 10:13 88576 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-21 10:12 171904 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:12 . 2012-06-21 10:12 33792 —-a-w- c:\windows\system32\wuapp.exe 2012-06-02 08:33 . 2012-07-12 10:29 1800192 —-a-w- c:\windows\system32\jscript9.dll 2012-06-02 08:25 . 2012-07-12 10:29 1129472 —-a-w- c:\windows\system32\wininet.dll 2012-06-02 08:25 . 2012-07-12 10:28 1427968 —-a-w- c:\windows\system32\inetcpl.cpl 2012-06-02 08:20 . 2012-07-12 10:29 142848 —-a-w- c:\windows\system32\ieUnatt.exe 2012-06-02 08:16 . 2012-07-12 10:29 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-06-02 04:45 . 2012-07-11 10:32 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-06-02 04:45 . 2012-07-11 10:32 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-06-02 04:40 . 2012-07-11 10:32 369336 —-a-w- c:\windows\system32\drivers\cng.sys 2012-06-02 04:40 . 2012-07-11 10:32 225280 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 04:39 . 2012-07-11 10:32 219136 —-a-w- c:\windows\system32\ncrypt.dll 2012-05-25 10:10 . 2012-05-25 10:10 163048 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KSS"="c:\program files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" [2012-04-25 202296] "9CEEE09014A67"="c:\programdata\9CEEE09014A67\9CEEE09014A67.exe" [2012-08-08 61440] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800] "TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2007-05-19 741376] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R2 AccubidSecurityServer2;Accubid Security Server v2.00;c:\program files\Accubid\Accubid Security\SecurityService2.exe [x] R2 hasplms;Sentinel HASP License Manager;c:\windows\system32\hasplms.exe [x] R2 KSS;Kaspersky Security Scan Service;c:\program files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x] R3 QSerBus;Quatech PCI/PCMCIA/ISA Multiport Serial Device Enumerator;c:\windows\system32\DRIVERS\qserbus.sys [x] R3 QTSerial;Quatech Multiport Serial Driver;c:\windows\system32\DRIVERS\qtserial.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-08-09 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 18:29] . . ——- Supplementary Scan ——- . uStart Page = hxxp://msn.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings/include/vzTCPConfig.CAB . - - - - ORPHANS REMOVED - - - - . SafeBoot-MsMpSvc . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-12 23:19:24 ComboFix-quarantined-files.txt 2012-08-13 03:19 . Pre-Run: 21,217,165,312 bytes free Post-Run: 23,274,336,256 bytes free . - - End Of File - - B129F00694B91D733B6ADB5DB71C9003
Post #36
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here.

Open notepad and copy/paste the text in the code box below into it (including the URL, excluding "CODE"):

http://forums.whatthetech.com/index.php?showtopic=123947&st=30&p=794391&#entry794391

Collect::
c:\programdata\9CEEE09014A67\9CEEE09014A67.exe

DirLook::
c:\windows\system32\%APPDATA%

Folder::
c:\programdata\9CEEE09014A67

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"9CEEE09014A67"=-

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe


[external image: Posted Image]

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.

Can you boot into normal mode now?
Post #37
All of the icons on my desktop have disappeared again I just ran unhide for the 3rd time but this time nothing on the desktop came back. That is where combofix is. I had disabled Security essentials the last time I was able to access the computer in normal start up and it is not showing in the system tray while I'm in safe mode so I can only assume it is not on. Should I download combofix again to a folder or do I need to use the version that I ran the scan from? Pam
Post #38
Highlight the following line and copy it:

del c:\programdata\9CEEE09014A67\9CEEE09014A67.exe

Click Start and type cmd in Start Search.
When cmd.exe populates in the window above, right click it and select Run as Administrator to open an elevated command prompt.

Right click in the command window, select Paste then hit Enter.

Now reboot and see if your icons are back. Try unhide.exe if not. If your icons come back, do the following:

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here.

Open notepad and copy/paste the text in the code box below into it (including the URL, excluding "CODE"):

DirLook::
c:\windows\system32\%APPDATA%

Folder::
c:\programdata\9CEEE09014A67

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"9CEEE09014A67"=-

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe


[external image: Posted Image]

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.


Can you boot into normal mode now?
Post #40
Please copy and paste the following quoted text into notepad:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"9CEEE09014A67"=-


Save the file as fix.reg with type All Files (*.*) to your desktop.

Double click fix.reg and allow it to merge with the registry. Reboot your computer.

If your icons are back, please do the following:

1. Close any open browsers.

2. IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here..

3. Open notepad and copy/paste the text in the quotebox below into it:

DirLook::
c:\windows\system32\%APPDATA%

Folder::
c:\programdata\9CEEE09014A67]


Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe


[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

If your icons are not back, download a fresh copy of ComboFix HERE and save it to the root of your C: drive. Follow the above steps for creating the CFScript.txt, but save it to the root of your C: drive as well instead of your desktop. Then open up a run box (WindowsKey + R) and copy and paste the following into it, then hit Enter:

ComboFix "C:\CFscript.txt"
Post #41
The desktop icons are still missing. All of the menus and icons within the folders are viewable and I can access the Desktop folder and see combofix and the cfscript text file I created. Would you like me to drag the script text while in the desktop folder? Pam
Post #42
Yes, try that. Failing that, you can open a run box (WindowsKey + R), copy and paste the following text, and hit Enter: ComboFix "c:\users\Scherer Electric 3\Desktop\CFScript.txt"
Post #43
The computer restarted during or after combofix was running. There is an old installation bootup I can't seem to get rid of, so when it restarted it went straight into trying to Install Windows because I wasn't there to choose the correct option. I exited the install and started windows normally and am able to log in normally, but the combofix window for the log never produced a log. There was a message that the window would close shortly and I could find the log at combofix.txt but the log is not on the computer. I don't know if restarting normally instead of in safe mode caused a problem or if I just didn't wait long enough, but the window was there for a really long time. Is there some way I can retrieve this log or can I run combofix again and get another log? Also, my icons are still not on the desktop. Pam
Post #44
See if there is a log in the root of C: named ComboFix.txt. ComboFix's latest log is stored there. See if it is from the latest run or the run from a few days ago.
Post #45
Found it! ComboFix 12-08-10.02 - Scherer Electric 3 08/15/2012 21:15:20.2.1 - x86 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1014.718 [GMT -4:00] Running from: C:\Users\[removed]\Desktop\ComboFix.exe Command switches used :: C:\Users\Scherer Electric 3\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) c:\programdata\9CEEE09014A67 C:\Users\Scherer Electric 3\AppData\Roaming\Twain.dll ((((((((((((((((((((((((( Files Created from 2012-07-16 to 2012-08-16 ))))))))))))))))))))))))))))))) 2012-08-16 01:24:12 . 2012-08-16 01:36:16 ——– d—–w- C:\Users\Scherer Electric 3\AppData\Local\temp 2012-08-16 01:24:12 . 2012-08-16 01:24:12 ——– d—–w- C:\Users\Default\AppData\Local\temp 2012-08-16 01:24:12 . 2012-08-16 01:24:12 ——– d—–w- C:\Users\Awrcs 2\AppData\Local\temp 2012-08-14 00:46:40 . 2012-08-14 00:46:40 ——– d—–w- C:\Users\Scherer Electric 3\AppData\Local\ElevatedDiagnostics 2012-08-08 18:28:51 . 2012-08-08 18:28:51 9827016 —-a-w- C:\Windows\system32\FlashPlayerInstaller.exe 2012-08-08 18:07:22 . 2012-08-08 18:07:22 ——– d-sh–w- C:\Windows\system32\%APPDATA% 2012-08-08 17:10:54 . 2012-06-29 08:44:13 6891424 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D23795DC-AFDB-47CA-BBC3-881BB1EA9DE2}\mpengine.dll 2012-08-08 12:20:08 . 2012-08-08 12:20:08 ——– d—–w- C:\Program Files\Kaspersky Lab 2012-08-08 12:20:05 . 2012-08-08 13:28:38 ——– d—–w- C:\ProgramData\Kaspersky Lab 2012-08-07 15:16:13 . 2012-08-07 15:16:27 ——– d—–w- C:\Users\Scherer Electric 3\New folder 2012-08-07 14:00:09 . 2012-06-29 08:44:13 6891424 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-08-06 02:55:46 . 2012-08-06 02:55:46 ——– d—–w- C:\Users\Scherer Electric 3\AppData\Local\Diagnostics 2012-08-06 00:05:29 . 2012-08-06 00:06:04 ——– d—–w- C:\FRST 2012-08-02 17:21:37 . 2012-08-08 18:29:01 426184 —-a-w- C:\Windows\system32\FlashPlayerApp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2012-08-08 18:29:01 . 2011-07-05 17:15:51 70344 —-a-w- C:\Windows\system32\FlashPlayerCPLApp.cpl 2012-06-12 02:40:48 . 2012-07-12 10:22:44 2345984 —-a-w- C:\Windows\system32\win32k.sys 2012-06-06 05:05:52 . 2012-07-11 10:32:22 1390080 —-a-w- C:\Windows\system32\msxml6.dll 2012-06-06 05:05:52 . 2012-07-11 10:32:21 1236992 —-a-w- C:\Windows\system32\msxml3.dll 2012-06-06 05:03:06 . 2012-07-11 10:32:17 805376 —-a-w- C:\Windows\system32\cdosys.dll 2012-06-02 22:19:33 . 2012-06-21 10:13:56 45080 —-a-w- C:\Windows\system32\wups2.dll 2012-06-02 22:19:33 . 2012-06-21 10:13:55 53784 —-a-w- C:\Windows\system32\wuauclt.exe 2012-06-02 22:19:32 . 2012-06-21 10:13:37 35864 —-a-w- C:\Windows\system32\wups.dll 2012-06-02 22:19:23 . 2012-06-21 10:13:37 577048 —-a-w- C:\Windows\system32\wuapi.dll 2012-06-02 22:19:17 . 2012-06-21 10:13:54 1933848 —-a-w- C:\Windows\system32\wuaueng.dll 2012-06-02 22:12:32 . 2012-06-21 10:13:54 2422272 —-a-w- C:\Windows\system32\wucltux.dll 2012-06-02 22:12:13 . 2012-06-21 10:13:37 88576 —-a-w- C:\Windows\system32\wudriver.dll 2012-06-02 19:19:42 . 2012-06-21 10:12:33 171904 —-a-w- C:\Windows\system32\wuwebv.dll 2012-06-02 19:12:20 . 2012-06-21 10:12:32 33792 —-a-w- C:\Windows\system32\wuapp.exe 2012-06-02 08:33:25 . 2012-07-12 10:29:01 1800192 —-a-w- C:\Windows\system32\jscript9.dll 2012-06-02 08:25:08 . 2012-07-12 10:29:02 1129472 —-a-w- C:\Windows\system32\wininet.dll 2012-06-02 08:25:03 . 2012-07-12 10:28:59 1427968 —-a-w- C:\Windows\system32\inetcpl.cpl 2012-06-02 08:20:33 . 2012-07-12 10:29:03 142848 —-a-w- C:\Windows\system32\ieUnatt.exe 2012-06-02 08:16:52 . 2012-07-12 10:29:06 2382848 —-a-w- C:\Windows\system32\mshtml.tlb 2012-06-02 04:45:04 . 2012-07-11 10:32:24 67440 —-a-w- C:\Windows\system32\drivers\ksecdd.sys 2012-06-02 04:45:03 . 2012-07-11 10:32:25 134000 —-a-w- C:\Windows\system32\drivers\ksecpkg.sys 2012-06-02 04:40:59 . 2012-07-11 10:32:26 369336 —-a-w- C:\Windows\system32\drivers\cng.sys 2012-06-02 04:40:39 . 2012-07-11 10:32:25 225280 —-a-w- C:\Windows\system32\schannel.dll 2012-06-02 04:39:10 . 2012-07-11 10:32:25 219136 —-a-w- C:\Windows\system32\ncrypt.dll 2012-05-25 10:10:23 . 2012-05-25 10:10:04 163048 —-a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) —- Directory of c:\windows\system32\%APPDATA% —- 2012-08-08 18:07:22 . 2012-08-09 12:40:25 262144 –sha-w- c:\windows\system32\%APPDATA%\Microsoft\Windows\IETldCache\index.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KSS"="C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" [2012-04-25 23:53:38 202296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 19:13:38 176128] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 14:32:24 1557800] "TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2007-05-19 08:44:00 741376] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 02:52:38 49152] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 01:29:52 49152] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2009-09-23 23:30:48 141848] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2009-09-23 23:30:48 173592] "Persistence"="C:\Windows\system32\igfxpers.exe" [2009-09-23 23:30:48 150552] "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe" [2012-03-26 21:08:12 931200] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 12:41:07 37296] "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 14:07:56 843712] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 R2 AccubidSecurityServer2;Accubid Security Server v2.00;C:\Program Files\Accubid\Accubid Security\SecurityService2.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\Program Files\Microsoft Security Client\NisSrv.exe [x] R3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL3.SYS [x] R3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV3.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [x] R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [x] S1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys [x] S2 hasplms;Sentinel HASP License Manager;C:\Windows\system32\hasplms.exe [x] S2 KSS;Kaspersky Security Scan Service;C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [x] S3 QSerBus;Quatech PCI/PCMCIA/ISA Multiport Serial Device Enumerator;C:\Windows\system32\DRIVERS\qserbus.sys [x] S3 QTSerial;Quatech Multiport Serial Driver;C:\Windows\system32\DRIVERS\qtserial.sys [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc Contents of the 'Scheduled Tasks' folder 2012-08-09 C:\Windows\Tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 17:21:38 . 2012-08-08 18:29:02] ——- Supplementary Scan ——- uStart Page = hxxp://msn.com/ IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings/include/vzTCPConfig.CAB

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI