Possible Trojans? [Solved]

Great job!!

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\L
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\L
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U\00000001.@

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
———-

Here's the FixLog. No Internet connection yet. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-12-2012 Ran by [removed] at 2012-12-19 11:39:36 Run:1 Running from D:\ ============================================== C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b} moved successfully. C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@ not found. C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\L not found. C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U not found. C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b} moved successfully. C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@ not found. C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\L not found. C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U not found. C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U\00000001.@ not found. ==== End of Fixlog ====

Good job!

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

———-

FSS Log Farbar Service Scanner Version: 10-12-2012 Ran by [removed] (administrator) on 19-12-2012 at 13:11:02 Running from "D:\" Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Dhcp Service is not running. Checking service configuration: The start type of Dhcp service is OK. The ImagePath of Dhcp service is OK. The ServiceDll of Dhcp service is OK. afd Service is not running. Checking service configuration: Checking Start type: ATTENTION!=====> Unable to open afd registry key. The service key does not exist. Checking ImagePath: ATTENTION!=====> Unable to open afd registry key. The service key does not exist. Checking LEGACY_afd: ATTENTION!=====> Unable to open LEGACY_afd\0000 registry key. The key does not exist. Connection Status: ============== Attempt to access Local Host IP returned error: Localhost is blocked: Destination is offline There is no connection to network. Attempt to access Google IP returned error. Attempt to access Google.com returned error: Other errors Attempt to access Yahoo IP returned error. Attempt to access Yahoo.com returned error: Other errors Windows Firewall: ============= Firewall Disabled Policy: ================== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=DWORD:0 System Restore: ============ System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ wuauserv Service is not running. Checking service configuration: The start type of wuauserv service is OK. The ImagePath of wuauserv service is OK. The ServiceDll of wuauserv service is OK. BITS Service is not running. Checking service configuration: The start type of BITS service is set to Demand. The default start type is Auto. The ImagePath of BITS service is OK. The ServiceDll of BITS service is OK. Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== WinDefend Service is not running. Checking service configuration: The start type of WinDefend service is set to Demand. The default start type is Auto. The ImagePath of WinDefend service is OK. The ServiceDll of WinDefend service is OK. Windows Defender Disabled Policy: ========================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender] "DisableAntiSpyware"=DWORD:1 Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys [2012-02-14 20:06] - [2012-12-18 21:25] - 0022368 ____A (AVG Technologies CZ, s.r.o. ) 42B7E1AA0C7EC54652A50585793F1885 ATTENTION!=====> C:\Windows\System32\drivers\afd.sys IS INFECTED AND SHOULD BE REPLACED. C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log ****

Hi,

Looks like we need to fix some of the damage done by that infection.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Right-click and Run as Administrator SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  afd.sys

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

System Look Log SystemLook 30.07.11 by jpshortstuff Log created at 14:24 on 19/12/2012 by Kristen Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== filefind ========== Searching for "afd.sys" C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys –a—- 500224 bytes [23:21 13/07/2009] [23:21 13/07/2009] B9384E03479D2506BC924C16A3DB87BC C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys –a—- 499712 bytes [02:44 16/06/2011] [02:44 25/04/2011] 6EF20DDF3172E97D69F596FB90602F29 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16937_none_34154fcd77f3bbda\afd.sys –a—- 499200 bytes [01:06 15/02/2012] [03:59 28/12/2011] DB9D6C6B2CD95A9CA414D045B627422E C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys –a—- 499712 bytes [02:44 16/06/2011] [02:44 25/04/2011] FBFF8B7C9D116229E9208A0D1CAEB49B C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.21115_none_34b263fe91032456\afd.sys –a—- 499200 bytes [01:06 15/02/2012] [04:01 28/12/2011] CCA39961E76B491DDF44B1E90FC8971D C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys –a—- 499712 bytes [22:31 23/05/2011] [09:23 20/11/2010] D31DC7A16DEA4A9BAF179F3D6FBDB38C C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys –a—- 499200 bytes [02:44 16/06/2011] [02:34 25/04/2011] D5B031C308A409A0A576BFF4CF083D30 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys –a—- 498688 bytes [01:06 15/02/2012] [03:59 28/12/2011] 1C7857B62DE5994A75B054A9FD4C3825 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys –a—- 499200 bytes [02:44 16/06/2011] [03:09 25/04/2011] F4AD06143EAC303F55D0E86C40802976 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys –a—- 498176 bytes [01:06 15/02/2012] [04:01 28/12/2011] 36A14FD1A23F57046361733B792CA8DB -= EOF =-

I certainly apologize….your system is a 64bit computer.

Please perform the same set of instructions I provided for SystemLook, but download the version found here and use it instead. Sorry about that.

No Problem, Jeff. I do that sort of thing all the time. SystemLook 30.07.11 by jpshortstuff Log created at 15:10 on 19/12/2012 by Kristen Administrator - Elevation successful ========== filefind ========== Searching for "afd.sys" C:\Windows\System32\drivers\AFD.SYS –a—- 22368 bytes [01:06 15/02/2012] [02:25 19/12/2012] 42B7E1AA0C7EC54652A50585793F1885 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys –a—- 500224 bytes [23:21 13/07/2009] [23:21 13/07/2009] B9384E03479D2506BC924C16A3DB87BC C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys –a—- 499712 bytes [02:44 16/06/2011] [02:44 25/04/2011] 6EF20DDF3172E97D69F596FB90602F29 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16937_none_34154fcd77f3bbda\afd.sys –a—- 499200 bytes [01:06 15/02/2012] [03:59 28/12/2011] DB9D6C6B2CD95A9CA414D045B627422E C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys –a—- 499712 bytes [02:44 16/06/2011] [02:44 25/04/2011] FBFF8B7C9D116229E9208A0D1CAEB49B C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.21115_none_34b263fe91032456\afd.sys –a—- 499200 bytes [01:06 15/02/2012] [04:01 28/12/2011] CCA39961E76B491DDF44B1E90FC8971D C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys –a—- 499712 bytes [22:31 23/05/2011] [09:23 20/11/2010] D31DC7A16DEA4A9BAF179F3D6FBDB38C C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys –a—- 499200 bytes [02:44 16/06/2011] [02:34 25/04/2011] D5B031C308A409A0A576BFF4CF083D30 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys –a—- 498688 bytes [01:06 15/02/2012] [03:59 28/12/2011] 1C7857B62DE5994A75B054A9FD4C3825 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys –a—- 499200 bytes [02:44 16/06/2011] [03:09 25/04/2011] F4AD06143EAC303F55D0E86C40802976 C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys –a—- 498176 bytes [01:06 15/02/2012] [04:01 28/12/2011] 36A14FD1A23F57046361733B792CA8DB -= EOF =-

Thanks for your understanding.

Let's do the following in steps…

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

First open an elevated command prompt > Click Start and type cmd in Start Search.
When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.

Copy the contents of the code box > right click in the command window and select paste

copy C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys C:\Windows\System32\drivers\AFD.SYS

Press Enter
Close the Command Prompt window.

Let me know when you get that finished.

It's asking to overwrite C:\Windows\System32\drivers\afd.sys. I assume select "Yes"?

Yes

Finished!

Sorry, forgot to run ERUNT before doing this.

Ok good.

Sorry, forgot to run ERUNT before doing this.

Do this now.


Next I would like you to take the following steps:

• Click Start then in the Start Search bar type Run type Notepad and click Ok
• Copy and Paste the contents of the Code box below into Notepad
  
  

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AFD]
  "BootFlags"=dword:00000001
  "DisplayName"="@%systemroot%\\system32\\drivers\\afd.sys,-1000"
  "Group"="PNP_TDI"
  "ImagePath"=hex(2):5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
    74,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,\
    00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,66,00,64,00,2e,00,73,00,79,00,\
    73,00,00,00
  "Description"="@%systemroot%\\system32\\drivers\\afd.sys,-1000"
  "ErrorControl"=dword:00000001
  "Start"=dword:00000001
  "Type"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AFD\Parameters]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AFD\Enum]
  "0"="Root\\LEGACY_AFD\\0000"
  "Count"=dword:00000001
  "NextInstance"=dword:00000001

• Save as regfix.reg to your Desktop
• Make sure to save file type as All Files
• Now right-click regfix.reg and select Merge

———-

Please go to Start=>Run (alternatively use Windows key+R), type regedit and click OK.
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
Right-Click Root and select Permissions…
Click Advanced.
Under Owner tab select the entry starting with you user name, example: Farbar(Farbar-PC\Farbar)
Put a check mark next to Replace owner on subcontainers and objects and click Apply.(You will get notified: " Registry Editor could not set owner on the key currently selected, or some of its subkeys")
Repeat this step, this time select Administrators(your pc name\your user name).
Put a check mark next to Replace owner on subcontainers and objects and click Apply (You will get notified: " Registry Editor could not set owner on the key currently selected, or some of its subkeys").
Click OK.
Under Security type while Everyone is selected put a check mark in the box under Allow next to Full Control.
Click Apply and OK.
Download the .zip file I attached to this reply and Extract all Contents to your Desktop
Now double-click Legacy afd.reg and confirm the prompt.
Please go back to the the Root key again while Everyone is selected remove check mark in the box under Allow next to Full Control and close the registry editor.
———-

Reboot your system.

Check your internet connection (let me know if it works) and if it does not work, run a new scan with Farbar Service Scanner.

ERUNT asked to create Folder for backup. I said Yes then it says: Unable to create file: C:\Windows\ERUNT\12-19-2012\ERUNT.inf. Registry backup will continue but no restore information for the ERUNT program will be saved. This means that later restoration of the registry can only be done manually, by using another OS to copy back the files.