Cant run firefox anymore...

VistaKing · 16 Jun 2013

Once you're back inside the desktop . Download the tool below save it to your desktop .

Drag the file from your Downloads folder to your desktop

Download folder location : C:\Users\[User Name ]\Downloads

RogueKiller for 32bit or RogueKiller for 64bit

Click on one of the links above that goes with your Windows 7 bit versions

Close all windows and browsers

Right click on

and choose Run as Administrator

Press: SCAN

provide the RKreport.txt (Mode: Scan) in your reply.

Note

Text file will be on your desktop

heirthos · 16 Jun 2013

RogueKiller V8.6.0 _x64_ [Jun 15 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK
Operating System : Windows 7
Started in : Normal mode
User : Thomas [Admin rights]
Mode : Scan -- Date : 06/16/2013 00:23:59
| ARK || FAK || MBR |
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] svchost.com -- C:\Windows\svchost.com [-] -> KILLED [TermProc]
¤¤¤ Registry Entries : 10 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : RDReminder (C:\Users\Thomas\AppData\Local\Temp\3582-490\REGCLE~1.EXE -rem [x][x]) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-4133703760-1340993549-1165796762-1000\[...]\Run : RDReminder (C:\Users\Thomas\AppData\Local\Temp\3582-490\REGCLE~1.EXE -rem [x][x]) -> FOUND
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[SHELLSPWN] HKLM\[...]\command : (C:\Windows\svchost.com "%1" %*) -> FOUND
[SHELLSPWN] HKCR\[...]\command : (C:\Windows\svchost.com "%1" %*) -> FOUND
¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][SUSP PATH] RDReminder : C:\Users\Thomas\AppData\Local\Temp\3582-490\DLLFixer.exe - -rem [x][x] -> FOUND
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00ZF5A0 +++++
--- User ---
[MBR] 5c199e07e6b396e83256620678780f7f
[BSP] abb478a9c0d9e3fc4899854d06ce45a8 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[0]_S_06162013_002359.txt >>

VistaKing · 16 Jun 2013

Run RogueKiller again and choose Delete button

heirthos · 16 Jun 2013

RogueKiller V8.6.0 _x64_ [Jun 15 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK
Operating System : Windows 7
Started in : Normal mode
User : Thomas [Admin rights]
Mode : Remove -- Date : 06/16/2013 00:30:24
| ARK || FAK || MBR |
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] svchost.com -- C:\Windows\svchost.com [-] -> KILLED [TermProc]
¤¤¤ Registry Entries : 10 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : RDReminder (C:\Users\Thomas\AppData\Local\Temp\3582-490\REGCLE~1.EXE -rem [x][x]) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-4133703760-1340993549-1165796762-1000\[...]\Run : RDReminder (C:\Users\Thomas\AppData\Local\Temp\3582-490\REGCLE~1.EXE -rem [x][x]) -> [0x2] The system cannot find the file specified.
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[SHELLSPWN] HKLM\[...]\command : (C:\Windows\svchost.com "%1" %*) -> REPLACED ("%1" %*)
[SHELLSPWN] HKCR\[...]\command : (C:\Windows\svchost.com "%1" %*) -> REPLACED ("%1" %*)
¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][SUSP PATH] RDReminder : C:\Users\Thomas\AppData\Local\Temp\3582-490\DLLFixer.exe - -rem [x][x] -> DELETED
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00ZF5A0 +++++
--- User ---
[MBR] 5c199e07e6b396e83256620678780f7f
[BSP] abb478a9c0d9e3fc4899854d06ce45a8 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_D_06162013_003024.txt >>
RKreport[0]_S_06162013_002359.txt

VistaKing · 16 Jun 2013

Run tdsskiller

Download

Drag the TDSKILLER from your downloads folder to your desktop
Right-click on TDSSKiller and choose

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System
Click: OK

Press: Start Scan

If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)

When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\

Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt

Please post the TDSSKiller log in your reply.

Note

The log will be long so you will have to upload the log .

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply

heirthos · 16 Jun 2013

Actually no errors were found and I am using the kasperspy tdsskiller. The link you gave me was a 404 issue so I searched for the tdsskiller on the website you gave me and it gave me the kasperspy tdsskiller.

VistaKing · 16 Jun 2013

Ok . Rerun Malwarebytes again to see if it comes up clean

heirthos · 16 Jun 2013

It had a few threats

VistaKing · 16 Jun 2013

Did you click on Remove Selected ? The first one is the tdsskiller app you downloaded .

Restart the PC

When you're back inside the desktop .

Download the app . Drag the app to your desktop

Farbar Recovery Scan Tool

32-bit Version OS

http://download.bleepingcomputer.com/farbar/FRST.exe
Right click on FRST.exe and choose

64-Bit Version OS

http://download.bleepingcomputer.com/farbar/FRST64.exe
Right click on FRST64.exe and choose

When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file
Please copy and paste both logs in your reply.(FRST.txt and Addition.txt)

Note

All text files FRST.txt , Additional.txt will be located inside your flash drive

heirthos · 16 Jun 2013

here it is.