Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Support
Windows Malware Removal Help & Support
Live Security Platinum Virus Problem
Message
<blockquote data-quote="patpot44" data-source="post: 65521" data-attributes="member: 1993"><p>OK here are my log files</p><p></p><p></p><p>Malware Bytes Log 1</p><p>Malwarebytes Anti-Malware 1.62.0.1300</p><p>www.malwarebytes.org</p><p></p><p>Database version: v2012.08.01.03</p><p></p><p>Windows 7 x64 NTFS</p><p>Internet Explorer 9.0.8112.16421</p><p>User :: USER-PC [administrator]</p><p></p><p>1/8/2012 5:54:26 PM</p><p>mbam-log-2012-08-01 (17-54-26).txt</p><p></p><p>Scan type: Quick scan</p><p>Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM</p><p>Scan options disabled: P2P</p><p>Objects scanned: 198998</p><p>Time elapsed: 3 minute(s), 27 second(s)</p><p></p><p>Memory Processes Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Memory Modules Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Registry Keys Detected: 1</p><p>HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum (Trojan.FakeAV) -> Quarantined and deleted successfully.</p><p></p><p>Registry Values Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Registry Data Items Detected: 3</p><p>HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.</p><p>HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.</p><p>HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.</p><p></p><p>Folders Detected: 1</p><p>C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully.</p><p></p><p>Files Detected: 9</p><p>C:\ProgramData\7531CC920009EDE70303F3074F147CE7\7531CC920009EDE70303F3074F147CE7.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.</p><p>C:\Users\User\AppData\Local\Temp\is-2M98L.tmp\MF.exe (Adware.Agent) -> Quarantined and deleted successfully.</p><p>C:\Users\User\Downloads\Bobby_Day-Rockin'_Robin.mp3(1).exe (PUP.Adware.Agent) -> Quarantined and deleted successfully.</p><p>C:\Users\User\Downloads\Bobby_Day-Rockin'_Robin.mp3.exe (PUP.Adware.Agent) -> Quarantined and deleted successfully.</p><p>C:\Windows\Installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n (Trojan.Sirefef) -> Quarantined and deleted successfully.</p><p>C:\Users\User\Desktop\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully.</p><p>C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully.</p><p>C:\Users\User\Downloads\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.</p><p>C:\Users\User\Downloads\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.</p><p></p><p>(end)</p><p></p><p></p><p>Malware Bytes Log 2</p><p>Malwarebytes Anti-Malware 1.62.0.1300</p><p>www.malwarebytes.org</p><p></p><p>Database version: v2012.08.01.03</p><p></p><p>Windows 7 x64 NTFS</p><p>Internet Explorer 9.0.8112.16421</p><p>User :: USER-PC [administrator]</p><p></p><p>1/8/2012 6:16:04 PM</p><p>mbam-log-2012-08-01 (18-16-04).txt</p><p></p><p>Scan type: Full scan (C:\|D:\|Q:\|)</p><p>Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM</p><p>Scan options disabled: P2P</p><p>Objects scanned: 417926</p><p>Time elapsed: 55 minute(s), 38 second(s)</p><p></p><p>Memory Processes Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Memory Modules Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Registry Keys Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Registry Values Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Registry Data Items Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Folders Detected: 0</p><p>(No malicious items detected)</p><p></p><p>Files Detected: 2</p><p>C:\Users\User\AppData\Local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n (Trojan.Sirefef) -> Delete on reboot.</p><p>D:\Patrick\downloads\freezip.exe (Trojan.Agent) -> Quarantined and deleted successfully.</p><p></p><p>(end)</p><p></p><p></p><p></p><p>Rogue Killer Log 1</p><p>RogueKiller V7.6.4 [07/17/2012] by Tigzy</p><p>mail: tigzyRK<at>gmail<dot>com</p><p>Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/</p><p>Blog: http://tigzyrk.blogspot.com</p><p></p><p>Operating System: Windows 7 (6.1.7600 ) 64 bits version</p><p>Started in : Normal mode</p><p>User: User [Admin rights]</p><p>Mode: Scan -- Date: 08/01/2012 23:31:11</p><p></p><p>¤¤¤ Bad processes: 0 ¤¤¤</p><p></p><p>¤¤¤ Registry Entries: 5 ¤¤¤</p><p>[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND</p><p>[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND</p><p>[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\User\AppData\Local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n.) -> FOUND</p><p>[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND</p><p>[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND</p><p></p><p>¤¤¤ Particular Files / Folders: ¤¤¤</p><p>[ZeroAccess][FILE] @ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> FOUND</p><p>[ZeroAccess][FOLDER] U : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> FOUND</p><p>[ZeroAccess][FOLDER] L : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> FOUND</p><p>[ZeroAccess][FILE] @ : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> FOUND</p><p>[ZeroAccess][FOLDER] U : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> FOUND</p><p>[ZeroAccess][FOLDER] L : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> FOUND</p><p></p><p>¤¤¤ Driver: [NOT LOADED] ¤¤¤</p><p></p><p>¤¤¤ Infection : ZeroAccess ¤¤¤</p><p></p><p>¤¤¤ HOSTS File: ¤¤¤</p><p></p><p></p><p>¤¤¤ MBR Check: ¤¤¤</p><p></p><p>+++++ PhysicalDrive0: TOSHIBA MK5065GSX +++++</p><p>--- User ---</p><p>[MBR] cac5de8eb0890dfb16aa687c2230a719</p><p>[BSP] 2b47f20e85fd4e058e5d7fdd12a939c5 : KIWI Image system MBR Code</p><p>Partition table:</p><p>0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo</p><p>1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo</p><p>2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 183296 Mo</p><p>3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 417540096 | Size: 273062 Mo</p><p>User = LL1 ... OK!</p><p>User = LL2 ... OK!</p><p></p><p>Finished : << RKreport[1].txt >></p><p>RKreport[1].txt</p><p></p><p></p><p>Rogue Killer Log 2</p><p>RogueKiller V7.6.4 [07/17/2012] by Tigzy</p><p>mail: tigzyRK<at>gmail<dot>com</p><p>Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/</p><p>Blog: http://tigzyrk.blogspot.com</p><p></p><p>Operating System: Windows 7 (6.1.7600 ) 64 bits version</p><p>Started in : Normal mode</p><p>User: User [Admin rights]</p><p>Mode: Remove -- Date: 08/01/2012 23:32:41</p><p></p><p>¤¤¤ Bad processes: 0 ¤¤¤</p><p></p><p>¤¤¤ Registry Entries: 5 ¤¤¤</p><p>[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)</p><p>[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)</p><p>[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\User\AppData\Local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n.) -> REPLACED (c:\windows\system32\shell32.dll)</p><p>[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)</p><p>[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)</p><p></p><p>¤¤¤ Particular Files / Folders: ¤¤¤</p><p>[ZeroAccess][FILE] @ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> REMOVED AT REBOOT</p><p>[Del.Parent][FILE] 00000001.@ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U\00000001.@ --> REMOVED</p><p>[Del.Parent][FILE] 80000000.@ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U\80000000.@ --> REMOVED</p><p>[Del.Parent][FILE] 800000cb.@ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U\800000cb.@ --> REMOVED</p><p>[ZeroAccess][FOLDER] U : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> REMOVED</p><p>[ZeroAccess][FOLDER] L : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> REMOVED</p><p>[ZeroAccess][FILE] @ : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> REMOVED</p><p>[ZeroAccess][FOLDER] U : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> REMOVED</p><p>[ZeroAccess][FOLDER] L : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> REMOVED</p><p></p><p>¤¤¤ Driver: [NOT LOADED] ¤¤¤</p><p></p><p>¤¤¤ Infection : ZeroAccess ¤¤¤</p><p></p><p>¤¤¤ HOSTS File: ¤¤¤</p><p></p><p></p><p>¤¤¤ MBR Check: ¤¤¤</p><p></p><p>+++++ PhysicalDrive0: TOSHIBA MK5065GSX +++++</p><p>--- User ---</p><p>[MBR] cac5de8eb0890dfb16aa687c2230a719</p><p>[BSP] 2b47f20e85fd4e058e5d7fdd12a939c5 : KIWI Image system MBR Code</p><p>Partition table:</p><p>0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo</p><p>1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo</p><p>2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 183296 Mo</p><p>3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 417540096 | Size: 273062 Mo</p><p>User = LL1 ... OK!</p><p>User = LL2 ... OK!</p><p></p><p>Finished : << RKreport[2].txt >></p><p>RKreport[1].txt ; RKreport[2].txt</p></blockquote><p></p>
[QUOTE="patpot44, post: 65521, member: 1993"] OK here are my log files Malware Bytes Log 1 Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.01.03 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [administrator] 1/8/2012 5:54:26 PM mbam-log-2012-08-01 (17-54-26).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 198998 Time elapsed: 3 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum (Trojan.FakeAV) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 3 HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. Folders Detected: 1 C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully. Files Detected: 9 C:\ProgramData\7531CC920009EDE70303F3074F147CE7\7531CC920009EDE70303F3074F147CE7.exe (Trojan.FakeAV) -> Quarantined and deleted successfully. C:\Users\User\AppData\Local\Temp\is-2M98L.tmp\MF.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Users\User\Downloads\Bobby_Day-Rockin'_Robin.mp3(1).exe (PUP.Adware.Agent) -> Quarantined and deleted successfully. C:\Users\User\Downloads\Bobby_Day-Rockin'_Robin.mp3.exe (PUP.Adware.Agent) -> Quarantined and deleted successfully. C:\Windows\Installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n (Trojan.Sirefef) -> Quarantined and deleted successfully. C:\Users\User\Desktop\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully. C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully. C:\Users\User\Downloads\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. C:\Users\User\Downloads\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. (end) Malware Bytes Log 2 Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.01.03 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [administrator] 1/8/2012 6:16:04 PM mbam-log-2012-08-01 (18-16-04).txt Scan type: Full scan (C:\|D:\|Q:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 417926 Time elapsed: 55 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Users\User\AppData\Local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n (Trojan.Sirefef) -> Delete on reboot. D:\Patrick\downloads\freezip.exe (Trojan.Agent) -> Quarantined and deleted successfully. (end) Rogue Killer Log 1 RogueKiller V7.6.4 [07/17/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: User [Admin rights] Mode: Scan -- Date: 08/01/2012 23:31:11 ¤¤¤ Bad processes: 0 ¤¤¤ ¤¤¤ Registry Entries: 5 ¤¤¤ [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\User\AppData\Local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n.) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> FOUND [ZeroAccess][FOLDER] U : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> FOUND [ZeroAccess][FOLDER] L : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> FOUND [ZeroAccess][FILE] @ : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> FOUND [ZeroAccess][FOLDER] U : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> FOUND [ZeroAccess][FOLDER] L : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> FOUND ¤¤¤ Driver: [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: TOSHIBA MK5065GSX +++++ --- User --- [MBR] cac5de8eb0890dfb16aa687c2230a719 [BSP] 2b47f20e85fd4e058e5d7fdd12a939c5 : KIWI Image system MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 183296 Mo 3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 417540096 | Size: 273062 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1].txt >> RKreport[1].txt Rogue Killer Log 2 RogueKiller V7.6.4 [07/17/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: User [Admin rights] Mode: Remove -- Date: 08/01/2012 23:32:41 ¤¤¤ Bad processes: 0 ¤¤¤ ¤¤¤ Registry Entries: 5 ¤¤¤ [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2) [HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1) [ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\User\AppData\Local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\n.) -> REPLACED (c:\windows\system32\shell32.dll) [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0) [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0) ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> REMOVED AT REBOOT [Del.Parent][FILE] 00000001.@ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U\00000001.@ --> REMOVED [Del.Parent][FILE] 80000000.@ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U\80000000.@ --> REMOVED [Del.Parent][FILE] 800000cb.@ : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U\800000cb.@ --> REMOVED [ZeroAccess][FOLDER] U : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> REMOVED [ZeroAccess][FOLDER] L : c:\windows\installer\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> REMOVED [ZeroAccess][FILE] @ : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\@ --> REMOVED [ZeroAccess][FOLDER] U : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\U --> REMOVED [ZeroAccess][FOLDER] L : c:\users\user\appdata\local\{6bf8fa7e-ab15-b944-38e4-309bb10a5559}\L --> REMOVED ¤¤¤ Driver: [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: TOSHIBA MK5065GSX +++++ --- User --- [MBR] cac5de8eb0890dfb16aa687c2230a719 [BSP] 2b47f20e85fd4e058e5d7fdd12a939c5 : KIWI Image system MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 183296 Mo 3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 417540096 | Size: 273062 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[2].txt >> RKreport[1].txt ; RKreport[2].txt [/QUOTE]
Insert quotes…
Verification
Post reply
Top