Just need ESET scan and FRST.
Post those when you can. I'll be back in 12 +/- hrs.
Post those when you can. I'll be back in 12 +/- hrs.
Re: Root Kit....Zero Access25th June 2012, 9:38 pmRe: Root Kit....Zero Access25th June 2012, 10:31 pmRe: Root Kit....Zero Access25th June 2012, 10:39 pmRe: Root Kit....Zero Access26th June 2012, 10:16 am
- But really...this is getting kinda old. By now, I would have reformatted/reinstalled my PC. 
Folder::
C:\Users\All Users\PC Optimizer Pro
C:\Users\JonEJet\AppData\Local\SavingsApp
C:\Users\All Users\WeCareReminder
C:\Program Files\Free Offers from Freeze.com
C:\Users\JonEJet\AppData\Local\Seven Zip
C:\Users\JonEJet\AppData\Local\blekkotb_031
File::
C:\Users\JonEJet\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
DirLook::
c:\users\JonEJet\AppData\Local
SRPEEK::
c:\windows\explorer.exe
c:\windows\system32\services.exe
c:\windows\system32\svchost.exe
c:\windows\system32\drivers\volsnap.sys
c:\windows\system32\user32.dll
ClearJavaCache::
SysRst::
MBR::
Code:
:regfind
mohegansun-hotel.comRe: Root Kit....Zero Access26th June 2012, 3:37 pmRe: Root Kit....Zero Access26th June 2012, 4:22 pmRe: Root Kit....Zero Access26th June 2012, 4:59 pmRe: Root Kit....Zero Access26th June 2012, 5:03 pmRe: Root Kit....Zero Access26th June 2012, 5:10 pmRe: Root Kit....Zero Access26th June 2012, 9:09 pmSecCenter::
{2B2D1395-420B-D5C9-657E-930FE358FC3C}
{904CF271-6431-DA47-5FCE-A87D98DFB681}
ClearJavaCache::
NoOrphans::
Re: Root Kit....Zero Access26th June 2012, 9:14 pmRe: Root Kit....Zero Access26th June 2012, 10:28 pmRe: Root Kit....Zero Access28th June 2012, 10:50 amRe: Root Kit....Zero Access28th June 2012, 2:23 pmRe: Root Kit....Zero Access28th June 2012, 2:27 pmRe: Root Kit....Zero Access28th June 2012, 2:35 pmRe: Root Kit....Zero Access28th June 2012, 3:45 pmRe: Root Kit....Zero Access28th June 2012, 3:53 pmRe: Root Kit....Zero Access28th June 2012, 4:56 pmRe: Root Kit....Zero Access28th June 2012, 5:07 pmRe: Root Kit....Zero Access28th June 2012, 5:12 pm
Re: Root Kit....Zero Access28th June 2012, 5:14 pmRe: Root Kit....Zero Access28th June 2012, 5:16 pm
Let's do this!Re: Root Kit....Zero Access28th June 2012, 6:11 pmRe: Root Kit....Zero Access28th June 2012, 6:15 pm
Re: Root Kit....Zero Access28th June 2012, 8:30 pmRe: Root Kit....Zero Access28th June 2012, 8:39 pmRe: Root Kit....Zero Access28th June 2012, 9:31 pmRe: Root Kit....Zero Access28th June 2012, 9:43 pmRe: Root Kit....Zero Access28th June 2012, 10:11 pmRe: Root Kit....Zero Access28th June 2012, 11:57 pmRe: Root Kit....Zero Access29th June 2012, 11:07 amRe: Root Kit....Zero Access29th June 2012, 2:01 pmFinished
Congratulations! Your system's DNS settings do not have any signs of known DNSChanger infections
Re: Root Kit....Zero Access29th June 2012, 6:52 pmRe: Root Kit....Zero Access29th June 2012, 7:47 pmRe: Root Kit....Zero Access29th June 2012, 7:51 pmRe: Root Kit....Zero Access29th June 2012, 8:14 pmRe: Root Kit....Zero Access29th June 2012, 8:17 pmRe: Root Kit....Zero Access29th June 2012, 11:09 pmRe: Root Kit....Zero Access30th June 2012, 6:56 amRe: Root Kit....Zero Access30th June 2012, 10:24 am:otl
SRV - File not found [On_Demand | Stopped] -- -- (MpsSvc)
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe -- (MozillaMaintenance)
SRV - File not found [On_Demand | Stopped] -- -- (BFE)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\sysprep\UP_date\PEDrv.sys -- (SVRPEDRV)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\SYSPREP\Drivers\ioport.sys -- (IO_Memory)
IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{BC37B0C6-1699-454D-815B-74DB6873EE31}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage};
IE - HKCU\..\SearchScopes,DefaultScope = {21475A23-BD73-3152-6CAC-741072CD9B98}
IE - HKCU\..\SearchScopes\{105E99FF-8B9A-4492-B155-06194B9056D2}: "URL" = http://www.bing.com/search?FORM=BABTDF&PC=BBLN&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&systemid=406&q={searchTerms}
IE - HKCU\..\SearchScopes\{BC37B0C6-1699-454D-815B-74DB6873EE31}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7TSHB
FF - user.js - File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - Startup: C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = File not found
O4 - Startup: C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
:files
C:\WINDOWS\SYSTEM32\SYSPREP
C:\Users\JonEJet\Documents\1aan0j2r.default-1340996399269
C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_.lnk
C:\Users\JonEJet\AppData\Local\Temp28.html
C:\Users\JonEJet\AppData\Local\Temp1.html
C:\Users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\okcrvxtn.default\extensions\abb@amazon.com.xpi
C:\Users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\okcrvxtn.default\extensions\cooijlurcq@cooijlurcq.org.xpi
C:\Users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\6llx2x2q.default\extensions\cooijlurcq@cooijlurcq.org.xpi
:commands
[emptytemp]
[reboot]
Re: Root Kit....Zero Access30th June 2012, 5:30 pm
hahahahahaRe: Root Kit....Zero Access30th June 2012, 7:35 pmRe: Root Kit....Zero Access30th June 2012, 7:44 pm
Re: Root Kit....Zero Access30th June 2012, 8:02 pmRe: Root Kit....Zero Access30th June 2012, 9:10 pmRe: Root Kit....Zero Access1st July 2012, 5:21 pm
Re: Root Kit....Zero Access2nd July 2012, 2:53 amRe: Root Kit....Zero Access2nd July 2012, 5:49 amRe: Root Kit....Zero Access|
|
|