ZA Reg Rootkit???

[buchu70]

cannot access the internet using any browser, need some help, see capture below:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: N/A, hr = 0x8007043c
Windows Product Key: *****-*****-87RQK-DDGYV-BM8T3
Windows Product Key Hash: 4qqvruHcuJ9MaD5l11/CgVkW74c=
Windows Product ID: 00426-066-9919095-86181
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {64D526A9-0D64-46D2-9ECC-9CE91ABA54B1}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130318-1533
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: E:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{64D526A9-0D64-46D2-9ECC-9CE91ABA54B1}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-BM8T3</PKey><PID>00426-066-9919095-86181</PID><PIDType>5</PIDType><SID>S-1-5-21-1979100600-2380601096-212897003</SID><SYSTEM><Manufacturer>TOSHIBA</Manufacturer><Model>Qosmio X505</Model></SYSTEM><BIOS><Manufacturer>TOSHIBA</Manufacturer><Version>V2.90   </Version><SMBIOSVersion major="2" minor="6"/><Date>20101210000000.000000+000</Date></BIOS><HWID>A8A13D07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Romance Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>TOSQCI</OEMID><OEMTableID>TOSQCI00</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007043C' to display the error text.
Error: 0x8007043C 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 1:25:2013 19:42
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x8007043c
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: MgAAAAEAAQABAAEAAgAAAAAABAABAAEAona6WWzD8EsgERSJkk3omYDh6jcuMxHLdlY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   PTLTD     APIC  
  FACP   INTEL   CALPELLA
  HPET   INTEL   CALPELLA
  BOOT   PTLTD   $SBFTBL$
  MCFG   INTEL   CALPELLA
  SLIC   TOSQCI  TOSQCI00
  DMAR   INTEL   CP_FIELD
  SSDT   PmRef  CpuPm

 

[Kaktussoft]

Did you create the output you posted in safe mode?

In command prompt:

ipconfig

post output

DHCP client service has been started?
DNS client service has been started?

 

[buchu70]

Yes, the output is from safe mode.

DHCP and DNS services are running. I stopped and restarted each with the same results.
I can ping any website from a normal boot, web browsers do not connect to anything.

What show i try and post is necessary?

thanks.

 

[VistaKing]

buchu70

Run RogueKiller

RogueKiller Download

:ar: Click on Download now

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click RogueKiller choose Run as Administrator

:ar: Press: SCAN

Provide the RKreport.txt (Mode: Scan) in your reply.

 

[cottonball]

buchu70,

Let's see if we can get Internet access once again...

Please download Farbar Service Scanner to a computer with Internet access.
Place the downloaded file on a USB pendrive.

Next, go to the infected computer.
Save to the Desktop.
Double-click the program to run it.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press: Scan
• FSS creates a log, FSS.txt, on the Desktop.

Please provide the FSS.txt in your reply. <<--


Is there a reason for posting the MGADiag tool output in your initial post?

 

[Kaktussoft]

Windows updates works?
Some download program works?
Email client works?