 search-tracker.net |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
  |
 Jul 3 2009, 01:42 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775  |
Thanks Eric |
 |
 
|
|
Jul 3 2009, 11:40 AM
Post
#2
|
|
 BC 1st Responder Group: Global Moderator Posts: 9,844 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Please download SmitfraudFix
Double-click SmitfraudFix.exe Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. http://www.beyondlogic.org/consulting/proc...processutil.htm -------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 3 2009, 01:28 PM
Post
#3
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
SmitFraudFix v2.423
Scan done at 14:18:58.27, Fri 07/03/2009 Run from C:\Documents and Settings\Eric\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exe C:\Program Files\Sony\giga pocket\GPVSvr.exe C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\htpatch.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\System32\ezSP_Px.exe C:\WINDOWS\System32\WScript.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Sierra Wireless Inc\3G Watcher\WaHelper.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Program Files\iPod\bin\iPodService.exe c:\progra~1\Support.com\client\bin\tgcmd.exe C:\Program Files\Sierra Wireless Inc\3G Watcher\Watcher.exe C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe C:\WINDOWS\System32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Eric »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Eric\LOCALS~1\Temp »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Eric\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\Eric\STARTM~1\Programs\HDQuality FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Eric\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\HDQuality\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix !!!Attention, following keys are not inevitably infected!!! Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "LoadAppInit_DLLs"=dword:00000001 »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," »»»»»»»»»»»»»»»»»»»»»»»» RK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» DNS Your computer may be victim of a DNS Hijack: 85.255.x.x detected ! Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport DNS Server Search Order: 85.255.112.97 DNS Server Search Order: 85.255.112.64 Your computer may be victim of a DNS Hijack: 85.255.x.x detected ! Description: Sierra Wireless HSDPA Network Adapter - Packet Scheduler Miniport DNS Server Search Order: 85.255.112.97 DNS Server Search Order: 85.255.112.64 HKLM\SYSTEM\CCS\Services\Tcpip\..\{4E9D781D-1EBA-4446-A74A-1B5DE8E28BD7}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CCS\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: DhcpNameServer=204.117.214.10 199.2.252.10 HKLM\SYSTEM\CCS\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS1\Services\Tcpip\..\{4E9D781D-1EBA-4446-A74A-1B5DE8E28BD7}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS1\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: DhcpNameServer=204.117.214.10 199.2.252.10 HKLM\SYSTEM\CS1\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS3\Services\Tcpip\..\{4E9D781D-1EBA-4446-A74A-1B5DE8E28BD7}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS3\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=204.117.214.10 199.2.252.10 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=204.117.214.10 199.2.252.10 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.97,85.255.112.64 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End |
|
|
|
|
Jul 3 2009, 05:40 PM
Post
#4
|
|
|
BC 1st Responder Group: Global Moderator Posts: 9,844 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Please follow part II below for SmitFraudFix. Thanks
 You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site. Please reboot your computer in Safe Mode by doing the following :
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report. The report can also be found at the root of the system drive, usually at C:\rapport.txt Warning : running option #2 on a non infected computer will remove your Desktop background. This post has been edited by rigel: Jul 3 2009, 05:41 PM
Reason for edit: edited item
-------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 3 2009, 06:17 PM
Post
#5
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
SmitFraudFix v2.423
Scan done at 19:04:35.03, Fri 07/03/2009 Run from C:\Documents and Settings\Eric\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\Eric\STARTM~1\Programs\HDQuality Deleted C:\Program Files\HDQuality\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{4E9D781D-1EBA-4446-A74A-1B5DE8E28BD7}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CCS\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS1\Services\Tcpip\..\{4E9D781D-1EBA-4446-A74A-1B5DE8E28BD7}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS1\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS3\Services\Tcpip\..\{4E9D781D-1EBA-4446-A74A-1B5DE8E28BD7}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS3\Services\Tcpip\..\{78A0423A-4576-4C86-93E7-11E670E1878D}: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.97,85.255.112.64 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.97,85.255.112.64 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK.2 »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End |
|
|
|
|
Jul 3 2009, 08:44 PM
Post
#6
|
|
|
BC 1st Responder Group: Global Moderator Posts: 9,844 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Install RootRepeal
Click here - Official Rootrepeal Site, and download RootRepeal.zip. I recommend downloading to your desktop. Fatdcuk at Malwarebytes posted a comprehensive tutorial - Self Help guide can be found here if needed.: Malwarebytes Removal and Self Help Guides. Click RootRepeal.exe to open the scanner. Click the Report tab, now click on Scan. A Window will open asking what to include in the scan. Check the following items: Drivers Files Processes SSDT Stealth Objects Hidden Services Click OK Scan your C Drive (Or your current system drive) and click OK. The scan will begin. This my take a moment, so please be patient. When the scan completes, click Save Report. Name the log RootRepeal.txt and save it to your Documents folder - (Default folder). Paste the log into your next reply. Please note: If Rootrepeal fails to run, try this step: Click Settings - Options. Set the Disk Access slider to High -------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 3 2009, 09:17 PM
Post
#7
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
ROOTREPEAL © AD, 2007-2009
================================================== Scan Time: 2009/07/03 22:14 Program Version: Version 1.3.0.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF5757000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7B24000 Size: 8192 File Visible: No Signed: - Status: - Name: MSIVXydejmogjikkjyvvnaiyuwlgxvxyathqb.sys Image Path: C:\WINDOWS\system32\drivers\MSIVXydejmogjikkjyvvnaiyuwlgxvxyathqb.sys Address: 0xF5A15000 Size: 184320 File Visible: - Signed: - Status: Hidden from Windows API! Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xF04B8000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\WINDOWS\system32\MSIVXcount Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\MSIVXebdjudycbtkcashmxrhxdlnmulxxxlob.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\MSIVXrkrjbakmpjlyvpymrhdhbodliurprhxm.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\drivers\MSIVXydejmogjikkjyvvnaiyuwlgxvxyathqb.sys Status: Invisible to the Windows API! Path: c:\documents and settings\eric\local settings\temp\etilqs_relk5c7a5btbhvcgedth Status: Allocation size mismatch (API: 32768, Raw: 0) Path: c:\documents and settings\eric\application data\sierra wireless\logs\swiapi.txt Status: Allocation size mismatch (API: 4096, Raw: 0) Stealth Objects ------------------- Object: Hidden Module [Name: MSIVXrkrjbakmpjlyvpymrhdhbodliurprhxm.dll] Process: svchost.exe (PID: 856) Address: 0x10000000 Size: 61440 Object: Hidden Module [Name: MSIVXebdjudycbtkcashmxrhxdlnmulxxxlob.dll] Process: firefox.exe (PID: 2636) Address: 0x10000000 Size: 241664 Hidden Services ------------------- Service Name: MSIVXserv.sys Image Path: C:\WINDOWS\system32\drivers\MSIVXydejmogjikkjyvvnaiyuwlgxvxyathqb.sys ==EOF== |
|
|
|
|
Jul 3 2009, 09:19 PM
Post
#8
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
Also I cant open www.malwarebytes.org
|
|
|
|
|
Jul 3 2009, 09:22 PM
Post
#9
|
|
|
New Member Group: Members Posts: 3 Joined: 3-July 09 Member No.: 348,005 |
Hey man I joined this website so I can help you out cause I had this problem like 2weeks ago. I started having this problem like 1 month ago but I ignored it until my computer starting locking up and etc. First what you must do in go to download.com and download the stupid "Avast virus remover". Restart the computer once it download and remember to have it set so when restarted it does the virus scan before the windows load. Should do it automatically. This scan could take about 1-2 hours so sit back or just randomly do something. Remember to check on your PC every 20 minutes for it might detect something, mine detected 3 random bs, and just delete it; dont delete all or safe it. Delete. Once you got this running go to run, found in your bottom start and type in "msconfig". From here get everything off from startup and then push apply and then it will restart your comp automatically. Then go back to download.com and download malware bytes and it should now be able to start back and detect the rootkit or trojan. Uninstall Avast it slows down your comp and its only good for the deletion of the bs that wont let you start up malwarebytes. After this try to avoid retarded virus links, porn links, and other anoynymous links that will give ya the trojan. They are sneaky and hard to find but trust me the whole process took me like 5 hours. Or last resort reformat your comp. Hope I helped you guys out. And I also got that crappy searchtracker crap before I did these steps.... In addition to my frustration I almost spent 10 hours haseling myself over the comp before figuring a method that would work to wipe out searchtracker. Any ways this will 100% work. If you need a more detailed version of the steps on what to do email me at the spot your lost at Ill be glad to help you. smile.gif
This post has been edited by kashyfla: Jul 3 2009, 09:24 PM |
|
|
|
|
Jul 3 2009, 09:34 PM
Post
#10
|
|
|
BC 1st Responder Group: Global Moderator Posts: 9,844 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
@ kashafla
The point of open forums is just that - to keep everything public so everyone learns. It also allows forum staff to review the validity of the information being given. Expecting Malwarebytes to completely clean a TDSS infection is incorrect. Sevral tools must be used for this clean, and even then, more advanced tools may be required in our HJT forum. Detailed and easy to follow instructions is a must here. rigel BleepingComputer Forums Moderator Our next step Eric... One thing you should know: You have been infected by a nasty rootkit {TDSS Variant}. This rootkit may steal personal information from your computer and can monitor traffic as you surf. If you do on-line banking. shopping, or other financial transactions, you need to contact your bank to monitor your account -and- change all passwords immediately. I also recommend changing the password on your router - if applicable. Do to the nature of rootkits, some members elect to reformat their computer, verses trying to clean it. If you wish to do that, please let me know. We continue: Rerun Rootrepeal. After the scan completes, go to the files tab and find these files:
Next right mouse click on it and select *wipe file* option only then immediately reboot the computer. Rerun Malwarebytes in full mode. - Let me know if you need any help with these steps. -------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 3 2009, 11:00 PM
Post
#11
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
Ran Malwarebytes in full mode here is the log from it.
Malwarebytes' Anti-Malware 1.38 Database version: 2297 Windows 5.1.2600 Service Pack 3 7/3/2009 11:52:19 PM mbam-log-2009-07-03 (23-52-19).txt Scan type: Full Scan (C:\|) Objects scanned: 143197 Time elapsed: 31 minute(s), 43 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 1 Registry Data Items Infected: 9 Folders Infected: 0 Files Infected: 5 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\WinBlueSoft (Rogue.WinBlue) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinBlueSoft (Rogue.WinBlue) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4e9d781d-1eba-4446-a74a-1b5de8e28bd7}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78a0423a-4576-4c86-93e7-11e670e1878d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{4e9d781d-1eba-4446-a74a-1b5de8e28bd7}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{78a0423a-4576-4c86-93e7-11e670e1878d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{4e9d781d-1eba-4446-a74a-1b5de8e28bd7}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{78a0423a-4576-4c86-93e7-11e670e1878d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.97,85.255.112.64 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\MSIVXebdjudycbtkcashmxrhxdlnmulxxxlob.dll (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\MSIVXrkrjbakmpjlyvpymrhdhbodliurprhxm.dll (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\MSIVXydejmogjikkjyvvnaiyuwlgxvxyathqb.sys (Trojan.Agent) -> Quarantined and deleted successfully. |
|
|
|
|
Jul 4 2009, 11:44 AM
Post
#12
|
|
|
BC 1st Responder Group: Global Moderator Posts: 9,844 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Good... we made progress, but still have some cleaning to do.
Please download ATF Cleaner by Atribune & save it to your desktop. alternate download link DO NOT use yet. Please download and install SUPERAntiSpyware Free
Double-click ATF-Cleaner.exe to run the program.
ATF-Cleaner must be "Run as an Administrator". Scan with SUPERAntiSpyware as follows:
-------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 4 2009, 01:47 PM
Post
#13
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
SUPERAntiSpyware Scan Log
http://www.superantispyware.com Generated 07/04/2009 at 02:35 PM Application Version : 4.26.1006 Core Rules Database Version : 3971 Trace Rules Database Version: 1911 Scan type : Complete Scan Total Scan Time : 01:06:10 Memory items scanned : 227 Memory threats detected : 0 Registry items scanned : 5971 Registry threats detected : 2 File items scanned : 50396 File threats detected : 15 Trojan.Unknown Origin HKU\.DEFAULT\Software\ColdWare HKU\S-1-5-18\Software\ColdWare Adware.Tracking Cookie C:\WINDOWS\system32\config\systemprofile\Cookies\system@ad.yieldmanager[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@ad.zanox[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@ads.pointroll[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@ads.us.e-planning[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@adserver.adtechus[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@banners.bannersource[2].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@cache.trafficmp[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@collective-media[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@d3.zedo[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@greenlightbanner[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@imrworldwide[2].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@invitemedia[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@linotraffic[1].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@media6degrees[2].txt C:\WINDOWS\system32\config\systemprofile\Cookies\system@oasn04.247realmedia[1].txt |
|
|
|
|
Jul 4 2009, 03:09 PM
Post
#14
|
|
|
BC 1st Responder Group: Global Moderator Posts: 9,844 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Please rerun SuperAntiSpyware - don't worry about the log. Then run DrWeb
Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet. alternate download link Note: The file will be randomly named (i.e. 5mkuvc4z.exe). Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". Scan with Dr.Web CureIt as follows:
-------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 4 2009, 10:27 PM
Post
#15
|
|
|
New Member Group: Members Posts: 11 Joined: 3-July 09 Member No.: 347,775 |
SmitfraudFix.exe\SmitfraudFix\Process.exe;C:\Documents and Settings\Eric\Desktop\SmitfraudFix.exe;Tool.Prockill;;
SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Documents and Settings\Eric\Desktop\SmitfraudFix.exe;Tool.ShutDown.14;; SmitfraudFix.exe;C:\Documents and Settings\Eric\Desktop;Archive contains infected objects;Moved.; Process.exe;C:\Documents and Settings\Eric\Desktop\SmitfraudFix;Tool.Prockill;Incurable.Moved.; restart.exe;C:\Documents and Settings\Eric\Desktop\SmitfraudFix;Tool.ShutDown.14;Incurable.Moved.; A0017129.exe\SmitfraudFix\Process.exe;C:\System Volume Information\_restore{39B55467-8C7E-46C6-B32A-C58455643C25}\RP65\A0017129.exe;Tool.Prockill;; A0017129.exe\SmitfraudFix\restart.exe;C:\System Volume Information\_restore{39B55467-8C7E-46C6-B32A-C58455643C25}\RP65\A0017129.exe;Tool.ShutDown.14;; A0017129.exe;C:\System Volume Information\_restore{39B55467-8C7E-46C6-B32A-C58455643C25}\RP65;Archive contains infected objects;Moved.; Process.exe;C:\WINDOWS\system32;Tool.Prockill;Incurable.Moved.; |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 8th November 2009 - 06:54 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.