Rkill 2.5.3 by Lawrence Abrams (Grinler) http://www.bleepingcomputer.com/ Copyright 2008-2014 BleepingComputer.com More Information about Rkill can be found at this link: http://www.bleepingcomputer.com/forums/topic308364.html Program started at: 05/22/2014 07:41:08 PM in x64 mode. Windows Version: Windows 7 Professional Service Pack 1 Checking for Windows services to stop: * No malware services found to stop. Checking for processes to terminate: * No malware processes found to kill. Checking Registry for malware related settings: * No issues found in the Registry. Resetting .EXE, .COM, & .BAT associations in the Windows Registry. Performing miscellaneous checks: * ALERT: ZEROACCESS rootkit symptoms found! * HKEY_CLASSES_ROOT\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32 [ZA Reg Hijack] * C:\$Recycle.Bin\S-1-5-18\$2db284a2f89d67dd20c0700dd0549922\ [ZA Dir] * C:\$Recycle.Bin\S-1-5-18\$2db284a2f89d67dd20c0700dd0549922\@ [ZA File] * C:\$Recycle.Bin\S-1-5-18\$2db284a2f89d67dd20c0700dd0549922\L\ [ZA Dir] * C:\$Recycle.Bin\S-1-5-18\$2db284a2f89d67dd20c0700dd0549922\U\ [ZA Dir] * ALERT: ZEROACCESS Reparse Point/Junction found! * C:\Program Files\Windows Defender\en-US => c:\windows\system32\config\ [Dir] * C:\Program Files\Windows Defender\MpAsDesc.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpClient.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpCmdRun.exe => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpCommu.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpEvMsg.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpOAV.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpRTP.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MpSvc.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MSASCui.exe => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MsMpCom.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MsMpLics.dll => c:\windows\system32\config [File] * C:\Program Files\Windows Defender\MsMpRes.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpAsDesc.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpClient.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCmdRun.exe => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCommu.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpOAV.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpRTP.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpSvc.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MSASCui.exe => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpLics.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpRes.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpAsDesc.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpClient.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCommu.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpOAV.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpRTP.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpSvc.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpCom.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpLics.dll => c:\windows\system32\config [File] * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpRes.dll => c:\windows\system32\config [File] Checking Windows Service Integrity: * Base Filtering Engine (BFE) is not Running. Startup Type set to: Automatic * DHCP Client (Dhcp) is not Running. Startup Type set to: Automatic * DNS Client (Dnscache) is not Running. Startup Type set to: Automatic * COM+ Event System (EventSystem) is not Running. Startup Type set to: Automatic * Windows Firewall (MpsSvc) is not Running. Startup Type set to: Automatic * Network Connections (Netman) is not Running. Startup Type set to: Manual * Network Store Interface Service (nsi) is not Running. Startup Type set to: Automatic * Security Center (wscsvc) is not Running. Startup Type set to: Automatic (Delayed Start) * Windows Update (wuauserv) is not Running. Startup Type set to: Automatic (Delayed Start) * Ancillary Function Driver for Winsock (AFD) is not Running. Startup Type set to: System * Windows Firewall Authorization Driver (mpsdrv) is not Running. Startup Type set to: Manual * NetBT (NetBT) is not Running. Startup Type set to: System * NSI proxy service driver. (nsiproxy) is not Running. Startup Type set to: System * NetIO Legacy TDI Support Driver (tdx) is not Running. Startup Type set to: System * iphlpsvc [Missing Service] * WinDefend [Missing Service] * SharedAccess [Missing ImagePath] Searching for Missing Digital Signatures: * C:\Windows\System32\rpcss.dll [NoSig] +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll : 509,440 : 07/13/2009 08:41 PM : 7266972e86890e2b30c0c322e906b027 [Pos Repl] +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d\rpcss.dll : 512,000 : 11/20/2010 08:27 AM : 5c627d1b1138676c0a7ab2c2c190d123 [Pos Repl] Checking HOSTS File: * Cannot edit the HOSTS file. * Permissions Fixed. Administrators can now edit the HOSTS file. * HOSTS file entries found: 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 20 out of 15452 HOSTS entries shown. Please review HOSTS file for further entries. Program finished at: 05/22/2014 07:44:15 PM Execution time: 0 hours(s), 3 minute(s), and 6 seconds(s)