Possible Powerliks remnant?

[intrepid]

Have been using Roguekiller and numerous other tools to track down gremlins on my Win7/64 laptop, and RK has been essential in nailing Powerliks! While I *think* I am nearly cleaned up, the last PK scan killed two SVCHOST.EXE entries of type [Proc.SvcHost] - and given that I no longer see any powerliks/javascript type entries anymore, including the variant dropper discussed herein, I fear there is still something Powerliks-related possibly at play. On its face, the killed processes are the only things to me that are of concern. Would appreciate any suggestions. I'm a Windows dev that's been playing with these things for over 25 years and normally can kill them myself, but this one's been a real monster. Thanks for the help.

HEre is the most recent PK log result.
---Begin
RogueKiller V9.2.13.0 [Sep 25 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : intrepid [Admin rights]
Mode : Scan -- Date : 09/27/2014  06:48:45

¤¤¤ Bad processes : 2 ¤¤¤
[Proc.Svchost] svchost.exe -- C:\Windows\System32\svchost.exe[7] -> KILLED [TermProc]
[Proc.Svchost] svchost.exe -- C:\Windows\SysWow64\svchost.exe[7] -> KILLED [TermThr]

¤¤¤ Registry Entries : 18 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.10.10.1 68.105.28.13 

-> FOUND
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.10.10.1 68.105.28.13  ->

FOUND
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.10.10.1 68.105.28.13  ->

FOUND
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{47C2D202-1246-4974-B849-

2B1834543C89} | DhcpNameServer : 10.10.10.1 68.105.28.13  -> FOUND
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{47C2D202-1246-4974-B849-

2B1834543C89} | DhcpNameServer : 10.10.10.1 68.105.28.13  -> FOUND
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{47C2D202-1246-4974-B849-

2B1834543C89} | DhcpNameServer : 10.10.10.1 68.105.28.13  -> FOUND
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> FOUND
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> FOUND
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin :

0  -> FOUND
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin :

0  -> FOUND
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2446193299-3602630867-1386250544-1000\Software\Microsoft\Windows\CurrentVersion

\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2446193299-3602630867-1386250544-1000\Software\Microsoft\Windows\CurrentVersion

\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-714684068-786452711-2638261246-21006\Software\Microsoft\Windows\CurrentVersion

\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-714684068-786452711-2638261246-21006\Software\Microsoft\Windows\CurrentVersion

\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel |

{20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel |

{59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel |

{20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel |

{59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: NOT LOADED [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUP][CHROME:Addon] Default : New Tab Redirect [icpgjfneehieebagbmdbhnlpiopdcmna] -> FOUND

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST9750420AS +++++
--- User ---
[MBR] c4d441a27258bc95be2bbf548713c1b2
[BSP] dea9defa67a18cc486b8c709b2ee22f0 : HP MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 101 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 212992 | Size: 20000 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 41172992 | Size: 695299 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_09262014_170749.log - RKreport_DEL_09262014_174907.log - RKreport_DEL_09262014_175541.log -

RKreport_DEL_09262014_213441.log
RKreport_DEL_09272014_062306.log - RKreport_SCN_09262014_165741.log - RKreport_SCN_09262014_170120.log -

RKreport_SCN_09262014_171601.log
RKreport_SCN_09262014_174820.log - RKreport_SCN_09262014_175527.log - RKreport_SCN_09262014_213306.log -

RKreport_SCN_09272014_062237.log
RKreport_SCN_09272014_064032.log - RKreport_DEL_09272014_064605.log
---end pasted log

Thanks.

[Tigzy]

Hello

AFAIR, poweliks lives in a particular svchost process, the one responsible for handling COM object calls.
However, this process would not have been detected as Proc.Svchost by RogueKiller because it's created by service.exe. So I don't think this is related to Poweliks.

But there's maybe some other issue.
Could you try to see what Gmer says? http://www.gmer.net/
And maybe a scan with Malwarebytes?