[samidelcueva]

ok, i will check later, because i'm outside home and i can't right now, but i will check it in the afternoon, and i will post what happened, and about my first computer, asus windows 8.1, i found something else with rkill:

 

 * HOSTS file entries found: 

 

  127.0.0.1 localhost

  0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly

  0.0.0.0 tracking.opencandy.com.s3.amazonaws.com

  0.0.0.0 media.opencandy.com

  0.0.0.0 cdn.opencandy.com

  0.0.0.0 tracking.opencandy.com

  0.0.0.0 api.opencandy.com

  0.0.0.0 installer.betterinstaller.com

  0.0.0.0 installer.filebulldog.com

  0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net

  0.0.0.0 inno.bisrv.com

  0.0.0.0 nsis.bisrv.com

  0.0.0.0 cdn.file2desktop.com

  0.0.0.0 cdn.goateastcach.us

  0.0.0.0 cdn.guttastatdk.us

  0.0.0.0 cdn.inskinmedia.com

  0.0.0.0 cdn.insta.oibundles2.com

  0.0.0.0 cdn.insta.playbryte.com

  0.0.0.0 cdn.llogetfastcach.us

  0.0.0.0 cdn.montiera.com

 

  20 out of 35 HOSTS entries shown.

  Please review HOSTS file for further entries.

 

and rouge killer found that two, 

 

¤¤¤ Processes : 0 ¤¤¤

 

¤¤¤ Registry : 8 ¤¤¤

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-401314101-946683506-2006832327-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://asus13.msn.com/?pc=ASJB -> Not selected

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-401314101-946683506-2006832327-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://asus13.msn.com/?pc=ASJB -> Not selected

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-401314101-946683506-2006832327-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://asus13.msn.com/?pc=ASJB -> Not selected

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-401314101-946683506-2006832327-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://asus13.msn.com/?pc=ASJB -> Not selected

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 200.94.160.248 ([MEXICO (MX)])  -> Not selected

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 200.94.160.248 ([MEXICO (MX)])  -> Not selected

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{EEF98F8E-5F9D-4000-8E8A-75D19401AA9D} | DhcpNameServer : 200.94.160.248 ([X])  -> Not selected

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{EEF98F8E-5F9D-4000-8E8A-75D19401AA9D} | DhcpNameServer : 200.94.160.248 ([MEXICO (MX)])  -> Not selected

 

¤¤¤ Tasks : 0 ¤¤¤

 

¤¤¤ Files : 0 ¤¤¤

 

¤¤¤ Hosts File : 34 ¤¤¤

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomalyDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com.s3.amazonaws.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 media.opencandy.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.opencandy.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 api.opencandy.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 installer.betterinstaller.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 installer.filebulldog.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.netDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 inno.bisrv.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 nsis.bisrv.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.file2desktop.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.goateastcach.usDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.guttastatdk.usDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.inskinmedia.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.insta.oibundles2.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.insta.playbryte.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.llogetfastcach.usDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.montiera.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.msdwnld.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.mypcbackup.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.ppdownload.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.riceateastcach.usDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.shyapotato.usDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.solimba.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.tuto4pc.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.appround.bizDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bigspeedpro.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bispd.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bisrv.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.cdndp.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.download.sweetpacks.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.dpdownload.comDeleted

[C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.visualbee.netDeleted

 

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MQ01ABF050 +++++

--- User ---

[MBR] 7566e601fc37fb011a6524949b91cc9c

[BSP] eefd9bcaf155d5eba732930c97cdddcb : Empty|VT.Unknown MBR Code

Partition table:

0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB

1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 206848 | Size: 900 MB

2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 2050048 | Size: 128 MB

3 - Basic data partition | Offset (sectors): 2312192 | Size: 455321 MB

4 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 934809600 | Size: 20490 MB

User = LL1 ... OK

User = LL2 ... OK

 

i choose to delete them, but after the restart the host entries are still there 

i run MBAM and found nothing

[Advertisements]

The host entries are set by unchecky to stop adware calling home so need to be there



The others are default entries and again are of no import

[Essexboy]

The host entries are set by unchecky to stop adware calling home so need to be there



The others are default entries and again are of no import

[samidelcueva]

oh okay,thanks, well i finally could make the xboot in the second computer, and  both computers are extremely fast, it is incredible, man, thank you very much, and it was very fast all, i want to donate to you, but i was wondering if there was another option to make the deposit.

And the solution to the xboot was the next one: https://social.msdn....r?forum=wptk_v4

[Essexboy]

Thanks I had not got that far down yet

Any further problems before I tidy up ?

[samidelcueva]

yes, something occurs at last minute, i put avast rootkit as a prevention, and it found something, and after found it, the program crashed, i could not send you a log but i send you the information of the rootkit, that i can see, it says in red words "\Driver\atapi[0xfffffa8002e41d00] -> IRP_MJ_CREATE -> 0fffffa8002cf62c0".

 

And now comes to my memory that, when i put a time ago hitman pro to scan, it pups up a message that atapi.sys, where preventting to make a good analysis, so seems there is a rootkit still in this computer, (The second one), yesterday the computer were incredibly fast, but now today is still fast, but after they totally start, because the start up is again very slow :S 

Edited by samidelcueva, 28 July 2015 - 08:51 AM.

[samidelcueva]

and after i close the program the Screen of Death appears 

[Essexboy]

If ATAPI was infected TDSSKiller would have spotted it .. AswMBR will report anything out of the ordinary

Download the GMER Rootkit Scanner. to your Desktop, it will be a randomly named .exe file .

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click the file you downloaded. The program will begin to run.


**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

[samidelcueva]

it seems that found nothing, or at least any pop up comes up

Attached Files

•  GMERLOG.log   386.14KB   241 downloads

[samidelcueva]

and here is the avast anti rootkit log before it crashes (because i have tried 2 times)

Attached Files

•  aswMBR.txt   10.46KB   206 downloads

[Essexboy]

CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8002cda2c0]<<sptd.sys

Unknown relates to SPTD.sys this is due to its behaviour and is a know anomaly which is of no import.


You say that the start up is slow again is that for both systems

[Essexboy]

CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8002cda2c0]<<sptd.sys

Unknown relates to SPTD.sys this is due to its behaviour and is a know anomaly which is of no import.


You say that the start up is slow again is that for both systems

[samidelcueva]

yes, in my first computer is something slow after enable secure boot, because i had to disable a time ago tu run a rescue disk, so, after i enable is again slow (but faster than before), and the second computer (the second FRST log), after the xboot i can notice that the start up is more faster than before, but stills takes about 2 minutes to start, and its more slow before the users accounts appears

Edited by samidelcueva, 28 July 2015 - 10:13 AM.

[Essexboy]

OK next step would be to run a clean boot to see what service is causing the delay

In the search box type Msconfig and select the programme that appears at the top

1.In the System Configuration Utility dialog box, click Selective Startup on the General tab.

2.Click to clear the Load Startup Items check box.
NoteThe Use Original Boot.ini check box is unavailable.
3.Click the Services tab.
4.Click to select the Hide All Microsoft Services check box.

5.Click Disable All, and then click OK.
6.When you are prompted, click Restart.
7.Is the speed better

[samidelcueva]

in the first computer works, but in the second one i disable all services, and the start up time speed its the same 

[Essexboy]

The second on has Comodo antivirus doesn't it