Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2014 01 Ran by SYSTEM on MININT-996D1S1 on 26-11-2014 10:43:02 Running from H:\ Platform: Windows 7 Home Premium (X64) OS Language: English (United States) Internet Explorer Version 8 Boot Mode: Recovery The current controlset is ControlSet002 [b]ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.[/b] Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-06] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2074408 2010-02-26] (Synaptics Incorporated) HKLM-x32\...\Run: [UpdateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink) HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [UpdatePDRShortCut] => C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-03] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKLM-x32\...\Run: [PDVD8LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKLM-x32\...\Run: [UpdatePPShortCut] => C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-20] (CyberLink Corp.) HKLM-x32\...\Run: [Microsoft Default Manager] => \"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe\" -resume HKLM-x32\...\Run: [mcagent_exe] => C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe [1218008 2010-06-09] (McAfee, Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [UIExec] => C:\Program Files (x86)\Netia\Mobilny Internet\UIExec.exe [138072 2010-03-02] () HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-07-12] (Nullsoft, Inc.) HKLM-x32\...\Run: [x86kernel2] => c:\users\ania\appdata\roaming\49244439\svchost.exe [80686 2014-02-25] (Flash ceza nasabuk me xaz me iolpolko lace vaziknpyni.) HKLM\...\RunOnce: [SRS4] => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\InstallManager.exe [715264 2009-08-18] (SEC) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [58602] => C:\ProgramData\Local Settings\Temp\mszfhxow.scr [69120 2009-07-13] ( (Fusion Workstation)) HKLM\...\Policies\Explorer: [HideSCAHealth] 1 HKU\ania\...\Run: [Tok-Cirrhatus-1794] => \"C:\Users\ania\AppData\Local\smss.exe\" HKU\ania\...\Run: [Tok-Cirrhatus] => \"C:\Users\ania\AppData\Local\smss.exe\" (the data entry has 824 more characters). HKU\ania\...\Run: [Google Update] => \"C:\Users\ania\AppData\Local\Google\Update\GoogleUpdate.exe\" /c HKU\ania\...\Run: [lime pro] => C:\Program Files (x86)\Lime PRO\LimePro.exe [3670528 2011-08-16] (Lime PRO LLC) HKU\ania\...\Run: [Policies] => C:\Users\ania\AppData\Roaming\uwrbiecf\fiwevevr.exe [66560 2009-07-13] (Fusion Workstation) HKU\ania\...\Run: [vmware-unity] => C:\Users\ania\AppData\Roaming\vmware-unity.exe [40960 2014-07-16] () HKU\ania\...\Run: [{3A34F601-E061-53C1-84B5-B94694F01E5B}] => C:\Users\ania\AppData\Roaming\Ywkoam\gite.exe [202752 2012-11-03] (Tridia Corporation) HKU\ania\...\Run: [Osmari] => C:\Users\ania\AppData\Roaming\Atah\osmari.exe [398336 2011-04-30] () HKU\ania\...\Run: [Tech Net Audio] => \"C:\ProgramData\Tech Net Audio\odoaztybt.exe\" HKU\ania\...\Run: [Updater] => C:\Users\ania\AppData\Roaming\Microsoft\Windows\Update\Update.exe [150219 2001-05-23] (gbhnbhgvfc) HKU\ania\...\Run: [aaaaaaaa] => C:\Users\ania\aaaaaaaa.exe [52736 2014-05-23] () HKU\ania\...\Run: [x86kernel2] => c:\users\ania\appdata\roaming\49244439\svchost.exe [80686 2014-02-25] (Flash ceza nasabuk me xaz me iolpolko lace vaziknpyni.) HKU\ania\...\CurrentVersion\Windows: [Load] C:\Users\ania\LOCALS~1\Temp\msfaxypoa.exe <===== ATTENTION HKU\ania\...\Policies\Explorer: [TaskbarNoNotification] 1 HKU\ania\...\Policies\Explorer: [HideSCAHealth] 1 HKU\ania\...\Winlogon: [Shell] C:\Users\ania\AppData\Roaming\Microsoft\Windows\Cache\Cache.exe [150219 2003-08-12] (gbhnbhgvfc) <==== ATTENTION HKU\anuśka\...\CurrentVersion\Windows: [Load] C:\Users\ANUKA~1\LOCALS~1\Temp\msefiq.exe <===== ATTENTION HKU\UpdatusUser\...\Run: [Tech Net Audio] => \"C:\ProgramData\Tech Net Audio\odoaztybt.exe\" AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [95848 2010-05-05] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [90216 2010-05-05] (NVIDIA Corporation) IFEO\mbam.exe: [Debugger] yqjukxels.exe IFEO\mbamgui.exe: [Debugger] zpyemhvct.exe IFEO\rstrui.exe: [Debugger] iuznign.exe Startup: C:\Users\ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download App.lnk ShortcutTarget: Download App.lnk -> (No File) Startup: C:\Users\ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\flashsec.lnk ShortcutTarget: flashsec.lnk -> (No File) Startup: C:\Users\ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\flashupdate.lnk ShortcutTarget: flashupdate.lnk -> (No File) Startup: C:\Users\ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vrrjv28.lnk ShortcutTarget: vrrjv28.lnk -> C:\ProgramData\82vjrrv.cpp\82vjrrv.cpp (Schlumberger Technology Corporation) Startup: C:\Users\ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xhostsys.lnk ShortcutTarget: xhostsys.lnk -> C:\ProgramData\xwatchsys\mshost.exe (Microtek) Startup: C:\Users\anuśka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vrrjv28.lnk ShortcutTarget: vrrjv28.lnk -> c:\ProgramData\82vjrrv.cpp\82vjrrv.cpp (Schlumberger Technology Corporation) AlternateShell: ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () S2 OutpostFirewall; C:\Program Files (x86)\Agnitum\Outpost Firewall\outpost.exe [94720 2007-01-19] (Agnitum Ltd.) S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2014-03-10] () S2 Rezip; C:\Windows\SysWOW64\Rezip.exe [311296 2009-03-05] () S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () S2 syshost32; C:\Windows\Installer\{E960CBA0-2107-3402-9C04-0C667BC65210}\syshost.exe [234496 2014-03-04] () S2 UI Assistant Service; C:\Program Files (x86)\Netia\Mobilny Internet\AssistantServices.exe [247152 2010-03-02] () S2 Winmgmt; C:\ProgramData\82vjrrv.cpp\vrrjv28.dot [332544 2014-05-12] (Microsoft Corporation) S2 McShield; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [X] S3 McSysmon; C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S0 1eda5e59793b3525; C:\Windows\System32\Drivers\1eda5e59793b3525.sys [79288 2014-03-05] () <===== ATTENTION Necurs Rootkit? S3 ADBLOCK.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [33568 2007-01-19] (Agnitum Ltd.) S3 ARP.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\ARP.DLL [17408 2007-01-19] (Agnitum Ltd.) S3 CONTENT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [4896 2007-01-19] (Agnitum Ltd.) S3 DNSCACHE.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [14464 2007-01-19] (Agnitum Ltd.) S3 FTPFILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [9248 2007-01-19] (Agnitum Ltd.) S3 HTMLFILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [11552 2007-01-19] (Agnitum Ltd.) S3 HTTPFILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [13216 2007-01-19] (Agnitum Ltd.) S3 IMAPFILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [7168 2007-01-19] (Agnitum Ltd.) S3 MAILFILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [14880 2007-01-19] (Agnitum Ltd.) S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102472 2010-02-17] (McAfee, Inc.) S1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [308296 2010-02-17] (McAfee, Inc.) S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2010-02-17] (McAfee, Inc.) S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2010-02-17] (McAfee, Inc.) S1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2010-07-15] (McAfee, Inc.) S3 NNTPFILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [6752 2007-01-19] (Agnitum Ltd.) S3 POP3FILT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [10048 2007-01-19] (Agnitum Ltd.) S3 PROTECT.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [15200 2007-01-19] (Agnitum Ltd.) S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2011-04-08] (Windows (R) 2003 DDK 3790 provider) S3 SECRET.DLL; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\SECRET.DLL [12928 2007-01-19] (Agnitum Ltd.) S1 VFILT; C:\Program Files (x86)\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [163328 2007-01-19] (Agnitum Ltd.) S1 SandBox; \??\C:\Program Files (x86)\Agnitum\Outpost Firewall\Sandbox64.SYS [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-26 10:42 - 2014-11-26 10:43 - 00000000 ____D () C:\FRST ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-26 01:14 - 2011-10-31 22:44 - 00327680 _____ () C:\Windows\System32\Ikeext.etl 2014-11-26 01:09 - 2013-11-19 23:20 - 00000000 ____D () C:\Users\ania\AppData\Roaming\Winamp 2014-11-26 00:59 - 2014-03-06 13:11 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-26 00:55 - 2009-07-13 20:45 - 00014144 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-26 00:55 - 2009-07-13 20:45 - 00014144 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-26 00:45 - 2014-03-25 02:26 - 00000150 _____ () C:\Windows\ODBC.INI 2014-11-26 00:45 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-26 00:45 - 2009-07-13 20:51 - 00143095 _____ () C:\Windows\setupact.log 2014-11-03 02:07 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\tracing Files to move or delete: ==================== C:\Users\ania\aaaaaaaa.exe C:\Users\ania\fupygryqukyb.exe C:\Users\ania\mosodcysbear.exe Some content of TEMP: ==================== C:\Users\ania\AppData\Local\Temp\0600.dll C:\Users\ania\AppData\Local\Temp\acodsdwz.exe C:\Users\ania\AppData\Local\Temp\bcxpqlav.exe C:\Users\ania\AppData\Local\Temp\crtigqay.exe C:\Users\ania\AppData\Local\Temp\dkzdfqvz.exe C:\Users\ania\AppData\Local\Temp\egutqget.exe C:\Users\ania\AppData\Local\Temp\gcomgrwc.exe C:\Users\ania\AppData\Local\Temp\lbvstynb.exe C:\Users\ania\AppData\Local\Temp\ljgfoare.exe C:\Users\ania\AppData\Local\Temp\lqjjfkxf.exe C:\Users\ania\AppData\Local\Temp\nlzeazpi.exe C:\Users\ania\AppData\Local\Temp\oldrpnrj.exe C:\Users\ania\AppData\Local\Temp\tvaciljn.exe C:\Users\ania\AppData\Local\Temp\vawdivku.exe C:\Users\anuska\AppData\Local\Temp\GDM15E3.exe C:\Users\anuska\AppData\Local\Temp\GUR54D.exe C:\Users\anuska\AppData\Local\Temp\GURB2DA.exe C:\Users\anuska\AppData\Local\Temp\GURE9D1.exe C:\Users\anuska\AppData\Local\Temp\GUREDB7.exe C:\Users\anuska\AppData\Local\Temp\_isA4F9.exe ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION! ==================== Restore Points ========================= Restore point made on: 2014-05-21 14:00:25 Restore point made on: 2014-05-30 14:06:30 Restore point made on: 2014-06-08 09:08:21 Restore point made on: 2014-06-15 16:01:35 Restore point made on: 2014-06-23 21:34:00 Restore point made on: 2014-07-11 01:23:03 Restore point made on: 2014-07-19 02:12:55 ==================== Memory info =========================== Percentage of memory in use: 19% Total physical RAM: 2868.49 MB Available physical RAM: 2300.48 MB Total Pagefile: 2866.64 MB Available Pagefile: 2288.71 MB Total Virtual: 8192 MB Available Virtual: 8191.88 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:112 GB) (Free:15.8 GB) NTFS Drive d: () (Fixed) (Total:165.99 GB) (Free:123.69 GB) NTFS Drive f: (RECOVERY) (Fixed) (Total:20 GB) (Free:1.39 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive h: (PEN) (Removable) (Total:3.8 GB) (Free:1.09 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298.1 GB) (Disk ID: C18B0C49) Partition 1: (Not Active) - (Size=20 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=112 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=166 GB) - (Type=OF Extended) ======================================================== Disk: 1 (Size: 3.8 GB) (Disk ID: 941DD7C6) Partition 1: (Not Active) - (Size=3.8 GB) - (Type=0B) LastRegBack: 2014-07-17 14:31 ==================== End Of Log ============================