[RESOLVED] FBI After You!

Printable View

Show 40 post(s) from this thread on one page

March 27th, 2013, 11:07 AM
tomoni1

[RESOLVED] FBI After You!

Hi There Guys: My wife only uses her computer to send or retrieve emails,and to surf the web for beauty and fashion stuff,and only on sites with the green seal of approval by WOT. Yesterday out of the blue her computer was locked by the famous FBI warning virus demanding to send money $ 300.00 via Moneygram. I know this is a hoax,but the computer is locked and we can not pass the dreaded FBI screen.My wife has never downloaded anything that is not legal,but I guess these hackers are getting more and more daring.
I would appreciate your assistance on how to access the PC and start the cleaning process.
Thanks in advance for your assistance.:confused:
March 27th, 2013, 11:55 AM
Broni

What Windows version is it?
March 27th, 2013, 01:00 PM
tomoni1

Hi Broni: It has Windows Vista Basic Home Edition. It also has Avira Antivirus and MalwareBytes installed, and did not stopped the attack!
Thanks!
March 27th, 2013, 01:03 PM
Broni

Let's try a simple step first.

Turn the computer off.
Disconnect it physically from the internet (disconnect ethernet cable).

Start computer in safe mode and see if the warning is still there.
March 27th, 2013, 02:10 PM
tomoni1

Hi Broni: I tried your reccomendation,and this is what happens: PC try to star up on Safe Mode but does not finish to the actual Safe Mode desktop Screen,instead it will go to regular start up, and shows the regular desktop screen for a few seconds,and then no FBI warning page,only a white black screen,and stays like that,with no further action.

Thanks!
March 27th, 2013, 02:30 PM
Broni
For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

If you are using Vista or Windows 7 enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
- Use the arrow keys to select the Repair your computer menu item.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account an click Next.
To enter System Recovery Options by using Windows installation disc:
- Insert the installation disc.
- Restart your computer.
- If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
- Click Repair your computer.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account and click Next.
On the System Recovery Options menu you will get the following options:
- - Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
- Select Command Prompt
- In the command window type in notepad and press Enter.
- The notepad opens. Under File menu select Open.
- Select "Computer" and find your flash drive letter and close the notepad.
- In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
- The tool will start to run.
- When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
March 27th, 2013, 07:12 PM
tomoni1

FBI Ater you!

Hi Broni: Followed your latest instructions and I am posting the Farbar Recovery Tool log:
Thanks!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 14 days old)
Ran by graceport at 27-03-2013 17:50:38
Running from F:\
Service Pack 2 (X86) OS Language: English(US)
Attention: Could not load system hive.
ERROR: The process cannot access the file because it is being used by another process.

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNCTION PROPERLY.

==================== One Month Created Files and Folders ========

2013-03-27 17:50 - 2013-03-27 17:50 - 00000000 ____D C:\FRST
2013-03-26 12:00 - 2013-03-27 17:43 - 00000000 ____A C:\Users\graceport\AppData\Roaming\skype.ini
2013-03-22 19:26 - 2013-03-22 19:26 - 00002075 ____A C:\Users\Public\Desktop\Google Earth.lnk
2013-03-21 13:06 - 2013-03-22 10:40 - 00000000 ____D C:\GE Remote Control RC 24977
2013-03-21 12:54 - 2013-01-03 21:38 - 02048512 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-03-21 12:51 - 2013-01-05 01:26 - 03602808 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-03-21 12:51 - 2013-01-05 01:26 - 03550072 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-03-21 12:51 - 2013-01-04 07:28 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-03-21 12:51 - 2012-11-21 23:54 - 00353280 ____A (Microsoft Corporation) C:\Windows\System32\shlwapi.dll
2013-03-21 12:51 - 2012-11-20 00:22 - 00204288 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-03-21 12:51 - 2012-11-07 23:48 - 01314816 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2013-03-21 12:51 - 2012-11-02 06:19 - 01400832 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2013-03-21 11:58 - 2013-02-11 21:57 - 00015872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023x.sys
2013-03-21 11:58 - 2013-02-11 21:57 - 00015872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys
2013-03-19 12:32 - 2013-03-19 12:33 - 00000000 ____D C:\ADOBE READER 11
2013-03-18 12:15 - 2013-03-18 12:17 - 00000000 ____D C:\Alfredo Sadel Romanticas MP3
2013-03-18 11:29 - 2013-03-18 11:47 - 00000000 ___RD C:\Alfredo Sadel Romanticas
2013-03-18 09:53 - 2013-03-18 11:34 - 00000000 ____D C:\Users\graceport\AppData\Roaming\ConverterLite
2013-03-18 09:53 - 2013-03-18 09:53 - 00001734 ____A C:\Users\Public\Desktop\ConverterLite.lnk
2013-03-18 09:53 - 2013-03-18 09:53 - 00000000 ____D C:\Program Files\ConverterLite
2013-03-18 09:52 - 2013-03-18 09:52 - 00000000 ____D C:\ProgramData\APN
2013-03-17 19:47 - 2013-03-19 12:33 - 00000000 ____D C:\TomTom GPS FIX
2013-03-17 16:24 - 2013-03-17 16:24 - 00000000 ____D C:\Foto Tio Victor y Guillermo
2013-03-15 15:50 - 2013-03-15 15:51 - 00000000 ____D C:\Padre Palmar y Chavez
2013-03-15 15:06 - 2013-03-15 15:06 - 00000000 ____D C:\Users\graceport\AppData\Local\HP
2013-03-15 08:34 - 2013-03-15 08:34 - 04758445 ____A C:\Users\graceport\Downloads\Nem-1.wmv
2013-03-15 08:32 - 2013-03-15 08:33 - 00000000 ____D C:\Lina Maria Perros
2013-03-14 14:29 - 2013-03-14 14:29 - 00001178 ____A C:\Users\Public\Desktop\HP Solution Center.lnk
2013-03-14 14:29 - 2013-03-14 14:29 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-03-14 14:25 - 2013-03-14 14:25 - 00000000 ____D C:\Windows\hpoj4500g510n-z
2013-03-14 14:24 - 2009-05-26 13:32 - 00716288 ____A (Hewlett-Packard) C:\Windows\System32\hpwwiax9.dll
2013-03-14 14:24 - 2009-05-26 13:32 - 00593920 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpwtscl5.dll
2013-03-14 14:24 - 2009-05-26 13:32 - 00315392 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpwvst01.dll
2013-03-14 14:24 - 2009-05-21 09:14 - 00452408 ____A (Hewlett-Packard) C:\Windows\System32\hpzids01.dll
2013-03-14 14:24 - 2009-05-18 17:49 - 00372736 ____A (Hewlett-Packard) C:\Windows\System32\hppldcoi.dll
2013-03-14 14:23 - 2009-06-09 01:43 - 00122880 ____A (Hewlett-Packard Company) C:\Windows\System32\hpf3l092.dll
2013-03-14 14:21 - 2013-03-14 14:33 - 00207143 ____A C:\Windows\hpwins28.dat
2013-03-13 20:51 - 2013-03-13 20:58 - 00000000 ____D C:\Alfredo Sadel
2013-03-13 17:35 - 2013-03-13 17:58 - 00000000 ____D C:\DVD Coverters
2013-03-13 17:28 - 2013-03-13 17:28 - 00000000 ____D C:\Codec Identifier
2013-03-13 10:09 - 2013-02-28 13:41 - 06011392 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-03-13 10:09 - 2013-02-27 22:49 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-03-13 10:09 - 2013-02-02 05:18 - 00916480 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-03-13 10:09 - 2013-02-02 05:17 - 01212928 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-03-13 10:09 - 2013-02-02 05:17 - 00105984 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-03-13 10:09 - 2013-02-02 05:15 - 00206848 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-03-13 10:09 - 2013-02-02 05:13 - 00630272 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-03-13 10:09 - 2013-02-02 05:13 - 00611840 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-03-13 10:09 - 2013-02-02 05:13 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-03-13 10:09 - 2013-02-02 05:13 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-03-13 10:09 - 2013-02-02 05:12 - 01469440 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-03-13 10:09 - 2013-02-02 05:12 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-03-13 10:09 - 2013-02-02 05:12 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 11111424 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 02004992 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 00387584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 00164352 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-03-13 10:09 - 2013-02-02 05:11 - 00055808 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-03-13 10:09 - 2013-02-02 03:37 - 00385024 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-03-13 10:09 - 2013-02-02 01:52 - 00174080 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-03-13 10:09 - 2013-02-02 01:52 - 00133632 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-03-13 10:09 - 2013-02-02 01:51 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-03-13 10:04 - 2013-03-13 10:11 - 00000000 ____D C:\PER 9
2013-03-13 10:03 - 2013-03-13 10:03 - 00000000 ____D C:\Users\graceport\Documents\PER 8
2013-03-08 13:15 - 2013-03-08 13:16 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-03-07 11:58 - 2013-03-07 12:00 - 00000000 ____D C:\29a6a137e6ffd8959222
2013-02-27 13:51 - 2013-02-27 13:49 - 04912214 ___RA C:\Users\graceport\Documents\IMG_2947-1.MOV
2013-02-27 13:51 - 2013-02-27 13:47 - 05263096 ___RA C:\Users\graceport\Documents\IMG_2947.MOV
2013-02-27 13:38 - 2013-02-27 13:39 - 00000000 ____D C:\Program Files\Mozilla Firefox(29)

==================== One Month Modified Files and Folders ========

2013-03-27 17:50 - 2013-03-27 17:50 - 00000000 ____D C:\FRST
2013-03-27 17:43 - 2013-03-26 12:00 - 00000000 ____A C:\Users\graceport\AppData\Roaming\skype.ini
2013-03-27 17:43 - 2012-12-26 16:56 - 00005758 ____A C:\Windows\PFRO.log
2013-03-27 17:43 - 2011-05-27 13:48 - 00000320 ____A C:\Windows\Tasks\GlaryInitialize.job
2013-03-27 17:43 - 2010-01-30 14:29 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-03-27 17:43 - 2006-11-02 08:58 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-27 17:43 - 2006-11-02 08:45 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-27 17:43 - 2006-11-02 08:45 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-27 17:31 - 2006-11-02 08:58 - 00032630 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-03-27 14:02 - 2010-02-28 12:38 - 01795406 ____A C:\Windows\WindowsUpdate.log
2013-03-27 10:52 - 2008-08-01 10:00 - 00000000 ____D C:\ProgramData\LogMeIn
2013-03-26 11:55 - 2008-03-13 01:56 - 00000000 ____D C:\users\graceport
2013-03-26 11:47 - 2008-03-14 12:41 - 00002609 ____A C:\Users\graceport\Desktop\Microsoft Office Word 2003.lnk
2013-03-26 11:37 - 2012-04-04 10:10 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-03-26 11:23 - 2010-01-30 14:29 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-03-26 10:31 - 2008-03-13 17:36 - 00000000 ____D C:\MDT
2013-03-26 10:21 - 2009-04-19 18:55 - 00000868 ____A C:\Windows\Tasks\Google Software Updater.job
2013-03-26 10:17 - 2009-04-25 14:54 - 00000000 ____D C:\Users\graceport\AppData\Roaming\dvdcss
2013-03-25 11:58 - 2013-02-04 23:50 - 00002521 ____A C:\Windows\setupact.log
2013-03-23 19:40 - 2006-11-02 06:33 - 00703388 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-22 19:26 - 2013-03-22 19:26 - 00002075 ____A C:\Users\Public\Desktop\Google Earth.lnk
2013-03-22 19:25 - 2008-03-06 10:46 - 00000000 ____D C:\Program Files\Google
2013-03-22 10:40 - 2013-03-21 13:06 - 00000000 ____D C:\GE Remote Control RC 24977
2013-03-21 19:18 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-03-21 13:21 - 2006-11-02 08:44 - 00453888 ____A C:\Windows\System32\FNTCACHE.DAT
2013-03-21 13:06 - 2006-11-02 06:23 - 00000289 ____A C:\Windows\win.ini
2013-03-21 12:30 - 2010-10-02 13:09 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-03-20 12:17 - 2008-03-06 10:42 - 00000000 ____D C:\ProgramData\Roxio
2013-03-19 21:37 - 2008-08-03 14:48 - 00002609 ____A C:\Users\graceport\Desktop\Word.lnk
2013-03-19 12:37 - 2008-03-13 17:06 - 00000000 ____D C:\Users\graceport\Desktop\Miscellaneous
2013-03-19 12:36 - 2008-05-01 12:20 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-03-19 12:35 - 2008-03-06 10:45 - 00000000 ____D C:\ProgramData\Adobe
2013-03-19 12:34 - 2008-05-01 12:20 - 00000000 ____D C:\Program Files\Adobe
2013-03-19 12:33 - 2013-03-19 12:32 - 00000000 ____D C:\ADOBE READER 11
2013-03-19 12:33 - 2013-03-17 19:47 - 00000000 ____D C:\TomTom GPS FIX
2013-03-19 12:11 - 2011-03-07 20:47 - 00020992 ____A C:\Users\graceport\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-03-19 00:04 - 2009-02-06 18:55 - 00000000 ____D C:\Users\graceport\AppData\Roaming\Skype
2013-03-18 12:17 - 2013-03-18 12:15 - 00000000 ____D C:\Alfredo Sadel Romanticas MP3
2013-03-18 11:47 - 2013-03-18 11:29 - 00000000 ___RD C:\Alfredo Sadel Romanticas
2013-03-18 11:34 - 2013-03-18 09:53 - 00000000 ____D C:\Users\graceport\AppData\Roaming\ConverterLite
2013-03-18 09:53 - 2013-03-18 09:53 - 00001734 ____A C:\Users\Public\Desktop\ConverterLite.lnk
2013-03-18 09:53 - 2013-03-18 09:53 - 00000000 ____D C:\Program Files\ConverterLite
2013-03-18 09:52 - 2013-03-18 09:52 - 00000000 ____D C:\ProgramData\APN
2013-03-17 16:24 - 2013-03-17 16:24 - 00000000 ____D C:\Foto Tio Victor y Guillermo
2013-03-15 15:51 - 2013-03-15 15:50 - 00000000 ____D C:\Padre Palmar y Chavez
2013-03-15 15:30 - 2006-11-02 08:35 - 00000000 ____D C:\Windows\twain_32
2013-03-15 15:06 - 2013-03-15 15:06 - 00000000 ____D C:\Users\graceport\AppData\Local\HP
2013-03-15 15:06 - 2008-11-22 21:15 - 00000000 ____D C:\Users\graceport\AppData\Roaming\HP
2013-03-15 08:34 - 2013-03-15 08:34 - 04758445 ____A C:\Users\graceport\Downloads\Nem-1.wmv
2013-03-15 08:33 - 2013-03-15 08:32 - 00000000 ____D C:\Lina Maria Perros
2013-03-14 15:10 - 2011-03-01 14:08 - 00141712 ____A C:\Users\graceport\AppData\Local\GDIPFONTCACHEV1.DAT
2013-03-14 15:10 - 2008-11-22 21:16 - 00003196 ____A C:\ProgramData\hpzinstall.log
2013-03-14 14:57 - 2008-11-22 21:55 - 00000000 ____D C:\ProgramData\HP
2013-03-14 14:33 - 2013-03-14 14:21 - 00207143 ____A C:\Windows\hpwins28.dat
2013-03-14 14:31 - 2008-11-22 21:21 - 00000000 ____D C:\Program Files\HP
2013-03-14 14:29 - 2013-03-14 14:29 - 00001178 ____A C:\Users\Public\Desktop\HP Solution Center.lnk
2013-03-14 14:29 - 2013-03-14 14:29 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-03-14 14:25 - 2013-03-14 14:25 - 00000000 ____D C:\Windows\hpoj4500g510n-z
2013-03-13 20:58 - 2013-03-13 20:51 - 00000000 ____D C:\Alfredo Sadel
2013-03-13 17:58 - 2013-03-13 17:35 - 00000000 ____D C:\DVD Coverters
2013-03-13 17:28 - 2013-03-13 17:28 - 00000000 ____D C:\Codec Identifier
2013-03-13 10:37 - 2012-04-04 10:10 - 00693976 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-03-13 10:37 - 2011-09-10 13:51 - 00073432 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-03-13 10:11 - 2013-03-13 10:04 - 00000000 ____D C:\PER 9
2013-03-13 10:03 - 2013-03-13 10:03 - 00000000 ____D C:\Users\graceport\Documents\PER 8
2013-03-08 13:36 - 2012-05-13 11:20 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-03-08 13:16 - 2013-03-08 13:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-03-07 15:13 - 2006-11-02 06:22 - 53477376 ____A C:\Windows\System32\config\software_previous
2013-03-07 15:13 - 2006-11-02 06:22 - 32768000 ____A C:\Windows\System32\config\system_previous
2013-03-07 15:12 - 2011-05-27 13:48 - 00000000 ____D C:\Program Files\Glary Utilities
2013-03-07 15:12 - 2009-04-25 14:53 - 00000000 ____D C:\Users\graceport\AppData\Roaming\vlc
2013-03-07 15:12 - 2008-03-13 01:58 - 00000000 ____D C:\Users\graceport\AppData\Local\PowerDVD DX
2013-03-07 15:12 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\System32\spool
2013-03-07 15:12 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\System32\Msdtc
2013-03-07 15:12 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\registration
2013-03-07 15:05 - 2006-11-02 06:22 - 43515904 ____A C:\Windows\System32\config\components_previous
2013-03-07 15:05 - 2006-11-02 06:22 - 00262144 ____A C:\Windows\System32\config\sam_previous
2013-03-07 12:04 - 2006-11-02 06:22 - 00524288 ____A C:\Windows\System32\config\default_previous
2013-03-07 12:04 - 2006-11-02 06:22 - 00262144 ____A C:\Windows\System32\config\security_previous
2013-03-07 12:00 - 2013-03-07 11:58 - 00000000 ____D C:\29a6a137e6ffd8959222
2013-03-04 14:15 - 2006-11-02 06:24 - 69796088 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-02-28 13:41 - 2013-03-13 10:09 - 06011392 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-02-27 22:49 - 2013-03-13 10:09 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-02-27 13:49 - 2013-02-27 13:51 - 04912214 ___RA C:\Users\graceport\Documents\IMG_2947-1.MOV
2013-02-27 13:47 - 2013-02-27 13:51 - 05263096 ___RA C:\Users\graceport\Documents\IMG_2947.MOV
2013-02-27 13:39 - 2013-02-27 13:38 - 00000000 ____D C:\Program Files\Mozilla Firefox(29)

ZeroAccess:
C:\Users\graceport\AppData\Local\e1fbdd18
C:\Users\graceport\AppData\Local\e1fbdd18\@
C:\Users\graceport\AppData\Local\e1fbdd18\U

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2012-12-13 10:40] - [2012-08-21 07:47] - 0224640 ____A (Microsoft Corporation) 786DB5771F05EF300390399F626BF30A

==================== Memory info ===========================

Percentage of memory in use: 20%
Total physical RAM: 2036.45 MB
Available physical RAM: 1612.43 MB
Total Pagefile: 4310.15 MB
Available Pagefile: 4066.86 MB
Total Virtual: 2047.88 MB
Available Virtual: 1954.65 MB

==================== Partitions =============================

1 Drive c: (OS) (Fixed) (Total:222.78 GB) (Free:107.64 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:0.28 GB) NTFS
4 Drive f: () (Removable) (Total:0.96 GB) (Free:0.96 GB) FAT

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 233 GB 0 B
Disk 1 Online 986 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 47 MB 32 KB
Partition 2 Primary 10 GB 48 MB
Partition 3 Primary 223 GB 10 GB

=========================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 D RECOVERY NTFS Partition 10 GB Healthy

=========================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 223 GB Healthy System (partition with boot components)

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 986 MB 426 KB

=========================================================

Disk: 1
Partition 1
Type : 06
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT Removable 986 MB Healthy

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 08000000

Partition 1:
=========
Hex: 00010100DEFE3F053F00000047780100
Active: NO
Type: DE
Size: 47 MB

Partition 2:
=========
Hex: 001E190607FEFFFF0080010000004001
Active: NO
Type: 07 (NTFS)
Size: 10 GB

Partition 3:
=========
Hex: 80FEFFFF07FEFFFF008041010008D91B
Active: YES
Type: 07 (NTFS)
Size: 223 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 5B76F3BA

Partition 1:
=========
Hex: 000D22000614F4E954030000ACCC1E00
Active: NO
Type: 06
Size: 986 MB

Last Boot: 2013-03-26 09:59

==================== End Of Log
March 27th, 2013, 07:57 PM
Broni

That won't work.
You ran the tool from within Windows.
You need to re-read my instructions.

On the other hand I thought you can't use Windows at all because of FBI infection.
March 28th, 2013, 10:47 AM
tomoni1

I apologize for the mistake, I will follow your instructions to the letter and post the log as requested. I exactly do not know what happened,but I still can not use windows; after the boot sequence I get the white blank screen.
Thanks!
March 28th, 2013, 01:09 PM
tomoni1

Broni: This time I think I did it the proper way,and I am posting the FARBAR Log:
Thanks!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 15 days old)
Ran by SYSTEM at 28-03-2013 11:37:59
Running from E:\
Windows Vista (TM) Home Basic (X86) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe [215552 2006-11-02] (Microsoft Corporation)
HKLM\...\Run: [EMET Notifier] C:\Program Files\EMET\EMET_notifier.exe [152152 2012-05-09] (Microsoft Corporation)
HKLM\...\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [63048 2011-09-16] (LogMeIn, Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)
HKU\graceport\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [68856 2008-03-06] (Google Inc.)
HKU\graceport\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation)
HKU\graceport\...\Winlogon: [Shell] explorer.exe,C:\Users\graceport\AppData\Roaming\skype.dat [94208 2011-11-18] ()
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
AppInit_DLLs: c:\progra~1\google\google~2\goec62~1.dll
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Services (Whitelisted) ===================

2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE.EXE" [116608 2012-12-19] (SUPERAntiSpyware.com)
2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
4 AcrSch2Svc; "C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe" [808704 2011-08-20] (Acronis)
2 AERTFilters; C:\Windows\System32\AERTSrv.exe [77824 2007-12-05] (Andrea Electronics Corporation)
2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3409872 2012-09-05] (Acronis)
2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [136360 2011-03-28] (Avira GmbH)
2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [269480 2011-06-28] (Avira GmbH)
3 GoogleDesktopManager-051210-111108; "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [30192 2010-11-01] (Google)
2 LexBceS; C:\Windows\System32\LEXBCES.EXE [303104 2003-02-27] (Lexmark International, Inc.)
4 PanService; C:\Program Files\PANDORA.TV\PanService\PandoraService.exe [625816 2012-06-22] (Pandora.TV)
2 Skype C2C Service; "C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [3289208 2013-01-31] (Skype Technologies S.A.)
2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [201968 2008-08-13] (SupportSoft, Inc.)
2 StkASSrv; C:\Windows\System32\StkASv2K.exe [24576 2006-05-23] (Syntek America Inc.)
2 syncagentsrv; "C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe" [5729328 2011-08-20] (Acronis)
2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-09-28] (Ulead Systems, Inc.)
3 WLSetupSvc; "C:\Program Files\Windows Live\installer\WLSetupSvc.exe" [266240 2007-10-25] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-06-28] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-06-28] (Avira GmbH)
3 Eplpdx02; \??\C:\Windows\system32\Drivers\EPLPDX02.SYS [70084 2001-08-09] (MK Systems CO., LTD.)
3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-06] ()
3 pepifilter; C:\Windows\System32\DRIVERS\lv302af.sys [13976 2009-04-30] (Logitech Inc.)
3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [2687512 2009-04-30] (Logitech Inc.)
1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-08-04] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
3 SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [12872 2010-12-11] ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [67664 2011-08-04] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
3 StkAMini; C:\Windows\System32\Drivers\StkAMini.sys [241628 2006-09-26] (Syntek America Inc.)
3 StkScan; C:\Windows\System32\Drivers\StkScan.sys [4772 2006-08-01] (Syntek America Inc.)
0 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [766208 2012-09-05] (Acronis)
3 UsbFltr; C:\Windows\System32\Drivers\UsbFltr.sys [9600 2007-04-09] (Waytech Development, Inc.)
0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [126112 2012-09-05] (Acronis)
0 vidsflt58; C:\Windows\System32\DRIVERS\vsflt58.sys [84512 2012-09-05] (Acronis)
3 XIRLINK; C:\Windows\System32\DRIVERS\C-itnt.sys [453475 1999-11-13] (Xirlink, Inc)
3 ZD1211BU(ZyDAS); C:\Windows\System32\DRIVERS\zd1211Bu.sys [402432 2005-10-27] (ZyDAS Technology Corporation)
4 blbdrive; C:\Windows\system32\drivers\blbdrive.sys [x]
3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x]
4 LMIRfsClientNP; [x]
3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x]
3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x]
3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [x]
3 ZDPSp60; C:\Windows\System32\Drivers\ZDPSp60.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-03-27 13:50 - 2013-03-27 13:50 - 00000000 ____D C:\FRST
2013-03-26 08:00 - 2013-03-27 13:43 - 00000000 ____A C:\Users\graceport\AppData\Roaming\skype.ini
2013-03-22 15:26 - 2013-03-22 15:26 - 00002075 ____A C:\Users\Public\Desktop\Google Earth.lnk
2013-03-21 09:06 - 2013-03-22 06:40 - 00000000 ____D C:\GE Remote Control RC 24977
2013-03-21 08:54 - 2013-01-03 17:38 - 02048512 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-03-21 08:51 - 2013-01-04 21:26 - 03602808 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-03-21 08:51 - 2013-01-04 21:26 - 03550072 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-03-21 08:51 - 2013-01-04 03:28 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-03-21 08:51 - 2012-11-21 19:54 - 00353280 ____A (Microsoft Corporation) C:\Windows\System32\shlwapi.dll
2013-03-21 08:51 - 2012-11-19 20:22 - 00204288 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-03-21 08:51 - 2012-11-07 19:48 - 01314816 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2013-03-21 08:51 - 2012-11-02 02:19 - 01400832 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2013-03-21 07:58 - 2013-02-11 17:57 - 00015872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023x.sys
2013-03-21 07:58 - 2013-02-11 17:57 - 00015872 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys
2013-03-19 08:32 - 2013-03-19 08:33 - 00000000 ____D C:\ADOBE READER 11
2013-03-18 08:15 - 2013-03-18 08:17 - 00000000 ____D C:\Alfredo Sadel Romanticas MP3
2013-03-18 07:29 - 2013-03-18 07:47 - 00000000 ___RD C:\Alfredo Sadel Romanticas
2013-03-18 05:53 - 2013-03-18 07:34 - 00000000 ____D C:\Users\graceport\AppData\Roaming\ConverterLite
2013-03-18 05:53 - 2013-03-18 05:53 - 00001734 ____A C:\Users\Public\Desktop\ConverterLite.lnk
2013-03-18 05:53 - 2013-03-18 05:53 - 00000000 ____D C:\Program Files\ConverterLite
2013-03-18 05:52 - 2013-03-18 05:52 - 00000000 ____D C:\ProgramData\APN
2013-03-17 15:47 - 2013-03-19 08:33 - 00000000 ____D C:\TomTom GPS FIX
2013-03-17 12:24 - 2013-03-17 12:24 - 00000000 ____D C:\Foto Tio Victor y Guillermo
2013-03-15 11:50 - 2013-03-15 11:51 - 00000000 ____D C:\Padre Palmar y Chavez
2013-03-15 11:06 - 2013-03-15 11:06 - 00000000 ____D C:\Users\graceport\AppData\Local\HP
2013-03-15 04:34 - 2013-03-15 04:34 - 04758445 ____A C:\Users\graceport\Downloads\Nem-1.wmv
2013-03-15 04:32 - 2013-03-15 04:33 - 00000000 ____D C:\Lina Maria Perros
2013-03-14 10:29 - 2013-03-14 10:29 - 00001178 ____A C:\Users\Public\Desktop\HP Solution Center.lnk
2013-03-14 10:29 - 2013-03-14 10:29 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-03-14 10:25 - 2013-03-14 10:25 - 00000000 ____D C:\Windows\hpoj4500g510n-z
2013-03-14 10:24 - 2009-05-26 09:32 - 00716288 ____A (Hewlett-Packard) C:\Windows\System32\hpwwiax9.dll
2013-03-14 10:24 - 2009-05-26 09:32 - 00593920 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpwtscl5.dll
2013-03-14 10:24 - 2009-05-26 09:32 - 00315392 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpwvst01.dll
2013-03-14 10:24 - 2009-05-21 05:14 - 00452408 ____A (Hewlett-Packard) C:\Windows\System32\hpzids01.dll
2013-03-14 10:24 - 2009-05-18 13:49 - 00372736 ____A (Hewlett-Packard) C:\Windows\System32\hppldcoi.dll
2013-03-14 10:23 - 2009-06-08 21:43 - 00122880 ____A (Hewlett-Packard Company) C:\Windows\System32\hpf3l092.dll
2013-03-14 10:21 - 2013-03-14 10:33 - 00207143 ____A C:\Windows\hpwins28.dat
2013-03-13 16:51 - 2013-03-13 16:58 - 00000000 ____D C:\Alfredo Sadel
2013-03-13 13:35 - 2013-03-13 13:58 - 00000000 ____D C:\DVD Coverters
2013-03-13 13:28 - 2013-03-13 13:28 - 00000000 ____D C:\Codec Identifier
2013-03-13 06:09 - 2013-02-28 09:41 - 06011392 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-03-13 06:09 - 2013-02-27 18:49 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-03-13 06:09 - 2013-02-02 01:18 - 00916480 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-03-13 06:09 - 2013-02-02 01:17 - 01212928 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-03-13 06:09 - 2013-02-02 01:17 - 00105984 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-03-13 06:09 - 2013-02-02 01:15 - 00206848 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-03-13 06:09 - 2013-02-02 01:13 - 00630272 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-03-13 06:09 - 2013-02-02 01:13 - 00611840 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-03-13 06:09 - 2013-02-02 01:13 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-03-13 06:09 - 2013-02-02 01:13 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-03-13 06:09 - 2013-02-02 01:12 - 01469440 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-03-13 06:09 - 2013-02-02 01:12 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-03-13 06:09 - 2013-02-02 01:12 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 11111424 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 02004992 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 00387584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 00164352 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-03-13 06:09 - 2013-02-02 01:11 - 00055808 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-03-13 06:09 - 2013-02-01 23:37 - 00385024 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-03-13 06:09 - 2013-02-01 21:52 - 00174080 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-03-13 06:09 - 2013-02-01 21:52 - 00133632 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-03-13 06:09 - 2013-02-01 21:51 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-03-13 06:04 - 2013-03-13 06:11 - 00000000 ____D C:\PER 9
2013-03-13 06:03 - 2013-03-13 06:03 - 00000000 ____D C:\Users\graceport\Documents\PER 8
2013-03-08 09:15 - 2013-03-08 09:16 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-03-07 07:58 - 2013-03-07 08:00 - 00000000 ____D C:\29a6a137e6ffd8959222
2013-02-27 09:51 - 2013-02-27 09:49 - 04912214 ___RA C:\Users\graceport\Documents\IMG_2947-1.MOV
2013-02-27 09:51 - 2013-02-27 09:47 - 05263096 ___RA C:\Users\graceport\Documents\IMG_2947.MOV
2013-02-27 09:38 - 2013-02-27 09:39 - 00000000 ____D C:\Program Files\Mozilla Firefox(29)

==================== One Month Modified Files and Folders ========

2013-03-27 13:51 - 2006-11-02 02:33 - 00703388 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-27 13:50 - 2013-03-27 13:50 - 00000000 ____D C:\FRST
2013-03-27 13:43 - 2013-03-26 08:00 - 00000000 ____A C:\Users\graceport\AppData\Roaming\skype.ini
2013-03-27 13:43 - 2012-12-26 12:56 - 00005758 ____A C:\Windows\PFRO.log
2013-03-27 13:43 - 2011-05-27 09:48 - 00000320 ____A C:\Windows\Tasks\GlaryInitialize.job
2013-03-27 13:43 - 2010-01-30 10:29 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-03-27 13:43 - 2006-11-02 04:58 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-27 13:43 - 2006-11-02 04:45 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-27 13:43 - 2006-11-02 04:45 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-27 13:31 - 2006-11-02 04:58 - 00032630 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-03-27 10:02 - 2010-02-28 08:38 - 01795406 ____A C:\Windows\WindowsUpdate.log
2013-03-27 06:52 - 2008-08-01 06:00 - 00000000 ____D C:\ProgramData\LogMeIn
2013-03-26 07:55 - 2008-03-12 21:56 - 00000000 ____D C:\users\graceport
2013-03-26 07:47 - 2008-03-14 08:41 - 00002609 ____A C:\Users\graceport\Desktop\Microsoft Office Word 2003.lnk
2013-03-26 07:37 - 2012-04-04 06:10 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-03-26 07:23 - 2010-01-30 10:29 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-03-26 06:31 - 2008-03-13 13:36 - 00000000 ____D C:\MDT
2013-03-26 06:21 - 2009-04-19 14:55 - 00000868 ____A C:\Windows\Tasks\Google Software Updater.job
2013-03-26 06:17 - 2009-04-25 10:54 - 00000000 ____D C:\Users\graceport\AppData\Roaming\dvdcss
2013-03-25 07:58 - 2013-02-04 19:50 - 00002521 ____A C:\Windows\setupact.log
2013-03-22 15:26 - 2013-03-22 15:26 - 00002075 ____A C:\Users\Public\Desktop\Google Earth.lnk
2013-03-22 15:25 - 2008-03-06 06:46 - 00000000 ____D C:\Program Files\Google
2013-03-22 06:40 - 2013-03-21 09:06 - 00000000 ____D C:\GE Remote Control RC 24977
2013-03-21 15:18 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-03-21 09:21 - 2006-11-02 04:44 - 00453888 ____A C:\Windows\System32\FNTCACHE.DAT
2013-03-21 09:06 - 2006-11-02 02:23 - 00000289 ____A C:\Windows\win.ini
2013-03-21 08:30 - 2010-10-02 09:09 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-03-20 08:17 - 2008-03-06 06:42 - 00000000 ____D C:\ProgramData\Roxio
2013-03-19 17:37 - 2008-08-03 10:48 - 00002609 ____A C:\Users\graceport\Desktop\Word.lnk
2013-03-19 08:37 - 2008-03-13 13:06 - 00000000 ____D C:\Users\graceport\Desktop\Miscellaneous
2013-03-19 08:36 - 2008-05-01 08:20 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-03-19 08:35 - 2008-03-06 06:45 - 00000000 ____D C:\ProgramData\Adobe
2013-03-19 08:34 - 2008-05-01 08:20 - 00000000 ____D C:\Program Files\Adobe
2013-03-19 08:33 - 2013-03-19 08:32 - 00000000 ____D C:\ADOBE READER 11
2013-03-19 08:33 - 2013-03-17 15:47 - 00000000 ____D C:\TomTom GPS FIX
2013-03-19 08:11 - 2011-03-07 16:47 - 00020992 ____A C:\Users\graceport\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-03-18 20:04 - 2009-02-06 14:55 - 00000000 ____D C:\Users\graceport\AppData\Roaming\Skype
2013-03-18 08:17 - 2013-03-18 08:15 - 00000000 ____D C:\Alfredo Sadel Romanticas MP3
2013-03-18 07:47 - 2013-03-18 07:29 - 00000000 ___RD C:\Alfredo Sadel Romanticas
2013-03-18 07:34 - 2013-03-18 05:53 - 00000000 ____D C:\Users\graceport\AppData\Roaming\ConverterLite
2013-03-18 05:53 - 2013-03-18 05:53 - 00001734 ____A C:\Users\Public\Desktop\ConverterLite.lnk
2013-03-18 05:53 - 2013-03-18 05:53 - 00000000 ____D C:\Program Files\ConverterLite
2013-03-18 05:52 - 2013-03-18 05:52 - 00000000 ____D C:\ProgramData\APN
2013-03-17 12:24 - 2013-03-17 12:24 - 00000000 ____D C:\Foto Tio Victor y Guillermo
2013-03-15 11:51 - 2013-03-15 11:50 - 00000000 ____D C:\Padre Palmar y Chavez
2013-03-15 11:30 - 2006-11-02 04:35 - 00000000 ____D C:\Windows\twain_32
2013-03-15 11:06 - 2013-03-15 11:06 - 00000000 ____D C:\Users\graceport\AppData\Local\HP
2013-03-15 11:06 - 2008-11-22 17:15 - 00000000 ____D C:\Users\graceport\AppData\Roaming\HP
2013-03-15 04:34 - 2013-03-15 04:34 - 04758445 ____A C:\Users\graceport\Downloads\Nem-1.wmv
2013-03-15 04:33 - 2013-03-15 04:32 - 00000000 ____D C:\Lina Maria Perros
2013-03-14 11:10 - 2011-03-01 10:08 - 00141712 ____A C:\Users\graceport\AppData\Local\GDIPFONTCACHEV1.DAT
2013-03-14 11:10 - 2008-11-22 17:16 - 00003196 ____A C:\ProgramData\hpzinstall.log
2013-03-14 10:57 - 2008-11-22 17:55 - 00000000 ____D C:\ProgramData\HP
2013-03-14 10:33 - 2013-03-14 10:21 - 00207143 ____A C:\Windows\hpwins28.dat
2013-03-14 10:31 - 2008-11-22 17:21 - 00000000 ____D C:\Program Files\HP
2013-03-14 10:29 - 2013-03-14 10:29 - 00001178 ____A C:\Users\Public\Desktop\HP Solution Center.lnk
2013-03-14 10:29 - 2013-03-14 10:29 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-03-14 10:25 - 2013-03-14 10:25 - 00000000 ____D C:\Windows\hpoj4500g510n-z
2013-03-13 16:58 - 2013-03-13 16:51 - 00000000 ____D C:\Alfredo Sadel
2013-03-13 13:58 - 2013-03-13 13:35 - 00000000 ____D C:\DVD Coverters
2013-03-13 13:28 - 2013-03-13 13:28 - 00000000 ____D C:\Codec Identifier
2013-03-13 06:37 - 2012-04-04 06:10 - 00693976 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-03-13 06:37 - 2011-09-10 09:51 - 00073432 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-03-13 06:11 - 2013-03-13 06:04 - 00000000 ____D C:\PER 9
2013-03-13 06:03 - 2013-03-13 06:03 - 00000000 ____D C:\Users\graceport\Documents\PER 8
2013-03-08 09:36 - 2012-05-13 07:20 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-03-08 09:16 - 2013-03-08 09:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-03-07 11:13 - 2006-11-02 02:22 - 53477376 ____A C:\Windows\System32\config\software_previous
2013-03-07 11:13 - 2006-11-02 02:22 - 32768000 ____A C:\Windows\System32\config\system_previous
2013-03-07 11:12 - 2011-05-27 09:48 - 00000000 ____D C:\Program Files\Glary Utilities
2013-03-07 11:12 - 2009-04-25 10:53 - 00000000 ____D C:\Users\graceport\AppData\Roaming\vlc
2013-03-07 11:12 - 2008-03-12 21:58 - 00000000 ____D C:\Users\graceport\AppData\Local\PowerDVD DX
2013-03-07 11:12 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\spool
2013-03-07 11:12 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\Msdtc
2013-03-07 11:12 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\registration
2013-03-07 11:05 - 2006-11-02 02:22 - 43515904 ____A C:\Windows\System32\config\components_previous
2013-03-07 11:05 - 2006-11-02 02:22 - 00262144 ____A C:\Windows\System32\config\sam_previous
2013-03-07 08:04 - 2006-11-02 02:22 - 00524288 ____A C:\Windows\System32\config\default_previous
2013-03-07 08:04 - 2006-11-02 02:22 - 00262144 ____A C:\Windows\System32\config\security_previous
2013-03-07 08:00 - 2013-03-07 07:58 - 00000000 ____D C:\29a6a137e6ffd8959222
2013-03-04 10:15 - 2006-11-02 02:24 - 69796088 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-02-28 09:41 - 2013-03-13 06:09 - 06011392 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-02-27 18:49 - 2013-03-13 06:09 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-02-27 09:49 - 2013-02-27 09:51 - 04912214 ___RA C:\Users\graceport\Documents\IMG_2947-1.MOV
2013-02-27 09:47 - 2013-02-27 09:51 - 05263096 ___RA C:\Users\graceport\Documents\IMG_2947.MOV
2013-02-27 09:39 - 2013-02-27 09:38 - 00000000 ____D C:\Program Files\Mozilla Firefox(29)

ZeroAccess:
C:\Users\graceport\AppData\Local\e1fbdd18
C:\Users\graceport\AppData\Local\e1fbdd18\@
C:\Users\graceport\AppData\Local\e1fbdd18\U

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2012-12-13 06:40] - [2012-08-21 03:47] - 0224640 ____A (Microsoft Corporation) 786DB5771F05EF300390399F626BF30A

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-02-23 09:32:54
Restore point made on: 2013-02-26 08:00:39
Restore point made on: 2013-03-03 09:27:33
Restore point made on: 2013-03-03 10:36:32
Restore point made on: 2013-03-07 07:57:05
Restore point made on: 2013-03-07 07:58:34
Restore point made on: 2013-03-08 08:53:27
Restore point made on: 2013-03-12 04:45:43
Restore point made on: 2013-03-13 11:53:01
Restore point made on: 2013-03-14 10:19:20
Restore point made on: 2013-03-14 10:23:35
Restore point made on: 2013-03-16 07:00:37
Restore point made on: 2013-03-19 08:07:45
Restore point made on: 2013-03-19 08:09:36
Restore point made on: 2013-03-19 08:34:06
Restore point made on: 2013-03-19 16:29:46
Restore point made on: 2013-03-19 17:53:59
Restore point made on: 2013-03-19 18:43:30
Restore point made on: 2013-03-21 08:12:16
Restore point made on: 2013-03-21 08:58:31
Restore point made on: 2013-03-25 08:29:44
Restore point made on: 2013-03-26 07:00:43

==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 2036.56 MB
Available physical RAM: 1741.75 MB
Total Pagefile: 1968.46 MB
Available Pagefile: 1821.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1982.35 MB

==================== Partitions =============================

1 Drive c: (OS) (Fixed) (Total:222.78 GB) (Free:107.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
3 Drive e: () (Removable) (Total:0.96 GB) (Free:0.96 GB) FAT
4 Drive x: (RECOVERY) (Fixed) (Total:10 GB) (Free:0.28 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 233 GB 1550 KB
Disk 1 Online 986 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 47 MB 32 KB
Partition 2 Primary 10 GB 48 MB
Partition 3 Primary 223 GB 10 GB

=========================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 FAT Partition 47 MB Healthy Hidden

=========================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 0 X RECOVERY NTFS Partition 10 GB Healthy Boot

=========================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 223 GB Healthy

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 986 MB 426 KB

=========================================================

Disk: 1
Partition 1
Type : 06
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E FAT Removable 986 MB Healthy

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 08000000

Partition 1:
=========
Hex: 00010100DEFE3F053F00000047780100
Active: NO
Type: DE
Size: 47 MB

Partition 2:
=========
Hex: 001E190607FEFFFF0080010000004001
Active: NO
Type: 07 (NTFS)
Size: 10 GB

Partition 3:
=========
Hex: 80FEFFFF07FEFFFF008041010008D91B
Active: YES
Type: 07 (NTFS)
Size: 223 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 5B76F3BA

Partition 1:
=========
Hex: 000D22000614F4E954030000ACCC1E00
Active: NO
Type: 06
Size: 986 MB

Last Boot: 2013-03-26 05:59

==================== End Of Log
March 28th, 2013, 02:43 PM
Broni

1 Attachment(s)

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if you can boot normally.
March 29th, 2013, 02:13 PM
tomoni1

Hi Broni: I did what you told me on the last post.I have a little bit of difficulty because when I tried a couple of times with FRST/FRST it would tell me it could not find the specified path. So, I do not know if what I did next was the proper thing to do. I onnly type FRST since this Windows Vista ia a 32 system not a 64,and it took me to the next screen wit scan.....and Fix. I did the Fix option, I am posting the Log.
Please let me know if what I did was the wrigth procedure,if not please advise!

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 13-03-2013
Ran by SYSTEM at 2013-03-29 13:57:57 Run:1
Running from E:\

==============================================

HKEY_USERS\graceport\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
C:\Users\graceport\AppData\Roaming\skype.dat moved successfully.
C:\Users\graceport\AppData\Local\e1fbdd18 moved successfully.

==== End of Fixlog ====

Thanks again!
March 29th, 2013, 05:31 PM
Broni

Can you boot now?
March 29th, 2013, 08:04 PM
tomoni1

Hi Broni: The Pc is booting,and I am getting my regular desktop. Should I keep it like that on continue the cleanig process. Do you think this virus migth leave some residual malware in the system.Please Advise.
Thanks again for your great assistance.
March 29th, 2013, 08:45 PM
Broni

Good news :)

Please, complete all steps listed here: http://discussions.virtualdr.com/sho...d.php?t=167915

Show 40 post(s) from this thread on one page