Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I Think I Have Adware?


  • Please log in to reply
16 replies to this topic

#1 Victoria

Victoria

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 30 January 2008 - 07:09 PM

I use firefox and I've noticed that my IE launches with ads. No sooner do I remove it then another one pops up. this has become annoying and repetitive. How do I find and then remove this problem?

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:18 PM

Posted 30 January 2008 - 10:55 PM

What do these ads say? Can you describe them further? Different adwares and malwares will produce different kinds of ads. Knowing what the ads say will aid us in helping you get disinfected.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 03 February 2008 - 02:58 PM

Merged from another topic:

I don't remember downloading Advanced Cleaner and it keeps trying to install. Is it a legit program? What does it do? I've been having problems with pop up ad on my IE so I'm wonder if this will help with it.

Edited by usasma, 03 February 2008 - 03:47 PM.
merged topic


#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:18 PM

Posted 03 February 2008 - 11:41 PM

According to my research, Advanced Cleaner is a rogue security program and if installed will barage you with ads and spy on your system. If you didn't download it yourself, it is likely that some other malware on your computer did.

Once again, please describe the ads you get so that we can further identify what has infected your computer.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 04 February 2008 - 06:42 PM

this is an example of what IE is "popping" up with.

h ttp://exclusivegiftcards.com/rd_p?p=12405...2&c=&a= AN AD FOR VICTORIA'S SECRET

h ttps://www.firstpremierbankgold.com/Person...08020417316IY1M A CREDIT CARD AD

h ttp://web.tickle.com/ I DON'T KNOW WHAT THIS ONE'S FOR SUPPOSEDLY A PERSONALITY TEST



And now my browser (firefox) will shrink and the ads are the main item. I hope this info helps. Oh and by the way, each of the above opens with it's own window.

MOD EDIT: Removed links to avoid possibly corrupting other members computers (please try to avoid links that may link to sites that have malware, as it could infect others computers) ~ stevealmighty

Edited by stevealmighty, 04 February 2008 - 06:57 PM.


#6 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:18 PM

Posted 04 February 2008 - 07:16 PM

Thanks for the ad descriptions Victoria.

I suggest at this point to scan with SUPERAntiSpyware in Safe Mode. Of course, you will install it in normal mode.

Download and install SUPERAntiSpyware free found here: http://www.superantispyware.com/superantis...efreevspro.html

Be sure to click on the download button to the left, not on the free trial download on the right.

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
Reboot into safe mode and open SUPERAntiSpyware
On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.
Reboot into Normal mode
To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
Click close and close again to exit the program.

Please post the log in your next reply.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#7 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 04 February 2008 - 07:50 PM

Okay. I will ATTEMPT to do what you told me to. I appreciate your help and you hanging in there with me while I do this. I will post my results when I am done. I must warn you...It will probably take me a while to do this. I'm not very good with computers but I am getting better. :thumbsup:

#8 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 05 February 2008 - 06:59 AM

Here is the log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/04/2008 at 07:52 PM

Application Version : 3.9.1008

Core Rules Database Version : 3394
Trace Rules Database Version: 1386

Scan type : Complete Scan
Total Scan Time : 01:29:21

Memory items scanned : 354
Memory threats detected : 3
Registry items scanned : 4474
Registry threats detected : 15
File items scanned : 39714
File threats detected : 171

Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\FCCCAAA.DLL
C:\WINDOWS\SYSTEM32\FCCCAAA.DLL
C:\WINDOWS\SYSTEM32\DDAYX.DLL
C:\WINDOWS\SYSTEM32\DDAYX.DLL
HKLM\Software\Classes\CLSID\{105F7208-CB70-4DA2-AE84-FB15C1513456}
HKCR\CLSID\{105F7208-CB70-4DA2-AE84-FB15C1513456}
HKCR\CLSID\{105F7208-CB70-4DA2-AE84-FB15C1513456}\InprocServer32
HKCR\CLSID\{105F7208-CB70-4DA2-AE84-FB15C1513456}\InprocServer32#ThreadingModel
HKLM\Software\Classes\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}\InprocServer32
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{105F7208-CB70-4DA2-AE84-FB15C1513456}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\fcccaaa
HKCR\CLSID\{A051B1FF-8D7E-418B-AABE-4FF82F4280A2}
C:\WINDOWS\SYSTEM32\KHFCAXY.DLL
C:\WINDOWS\SYSTEM32\PMNNLLL.DLL

Adware.ClickSpring/Resident
C:\WINDOWS\system32\CROSOF~1\TSKMGR~1.EXE
C:\WINDOWS\system32\CROSOF~1\TSKMGR~1.EXE

Adware.Tracking Cookie
C:\Documents and Settings\user\Cookies\user@statcounter[1].txt
C:\Documents and Settings\user\Cookies\user@adultadworld[2].txt
C:\Documents and Settings\user\Cookies\user@angleinteractive.directtrack[2].txt
C:\Documents and Settings\user\Cookies\user@288_[2].txt
C:\Documents and Settings\user\Cookies\user@ex=1_[2].txt
C:\Documents and Settings\user\Cookies\user@cgi-bin[3].txt
C:\Documents and Settings\user\Cookies\user@secure.advancedcleaner[2].txt
C:\Documents and Settings\user\Cookies\user@indiads[2].txt
C:\Documents and Settings\user\Cookies\user@4.adbrite[2].txt
C:\Documents and Settings\user\Cookies\user@adecn[1].txt
C:\Documents and Settings\user\Cookies\user@a[1].txt
C:\Documents and Settings\user\Cookies\user@webpower[1].txt
C:\Documents and Settings\user\Cookies\user@adbrite[2].txt
C:\Documents and Settings\user\Cookies\user@fastclick[2].txt
C:\Documents and Settings\user\Cookies\user@www.burstbeacon[3].txt
C:\Documents and Settings\user\Cookies\user@ads.crakmedia[1].txt
C:\Documents and Settings\user\Cookies\user@ehg-netquote.hitbox[1].txt
C:\Documents and Settings\user\Cookies\user@trafficmp[1].txt
C:\Documents and Settings\user\Cookies\user@3.adbrite[2].txt
C:\Documents and Settings\user\Cookies\user@counter9.sextracker[1].txt
C:\Documents and Settings\user\Cookies\user@da-tracking[2].txt
C:\Documents and Settings\user\Cookies\user@www.burstnet[2].txt
C:\Documents and Settings\user\Cookies\user@advancedcleaner[2].txt
C:\Documents and Settings\user\Cookies\user@2o7[3].txt
C:\Documents and Settings\user\Cookies\user@hornymatches[2].txt
C:\Documents and Settings\user\Cookies\user@adrevolver[1].txt
C:\Documents and Settings\user\Cookies\user@incentaclick[2].txt
C:\Documents and Settings\user\Cookies\user@37343836[1].txt
C:\Documents and Settings\user\Cookies\user@www.incentaclick[1].txt
C:\Documents and Settings\user\Cookies\user@ads.adbrite[1].txt
C:\Documents and Settings\user\Cookies\user@apmebf[1].txt
C:\Documents and Settings\user\Cookies\user@lynxtrack[1].txt
C:\Documents and Settings\user\Cookies\user@sales.liveperson[1].txt
C:\Documents and Settings\user\Cookies\user@www.findit-quick[2].txt
C:\Documents and Settings\user\Cookies\user@ad.yieldmanager[1].txt
C:\Documents and Settings\user\Cookies\user@eas.apm.emediate[2].txt
C:\Documents and Settings\user\Cookies\user@tribalfusion[2].txt
C:\Documents and Settings\user\Cookies\user@adopt.specificclick[1].txt
C:\Documents and Settings\user\Cookies\user@spamblockerutility[3].txt
C:\Documents and Settings\user\Cookies\user@adultfriendfinder[1].txt
C:\Documents and Settings\user\Cookies\user@burstnet[2].txt
C:\Documents and Settings\user\Cookies\user@questionmarket[2].txt
C:\Documents and Settings\user\Cookies\user@atdmt[2].txt
C:\Documents and Settings\user\Cookies\user@advertisersclearinghouse.aavalue[1].txt
C:\Documents and Settings\user\Cookies\user@sextracker[1].txt
C:\Documents and Settings\user\Cookies\user@adredired[1].txt
C:\Documents and Settings\user\Cookies\user@partner2profit[1].txt
C:\Documents and Settings\user\Cookies\user@spyguardpro[1].txt
C:\Documents and Settings\user\Cookies\user@findwhat[1].txt
C:\Documents and Settings\user\Cookies\user@sex-video[1].txt
C:\Documents and Settings\user\Cookies\user@ad2networks.advertserve[2].txt
C:\Documents and Settings\user\Cookies\user@media.adrevolver[3].txt
C:\Documents and Settings\user\Cookies\user@anad.tacoda[1].txt
C:\Documents and Settings\user\Cookies\user@ads.pointroll[1].txt
C:\Documents and Settings\user\Cookies\user@podshow.112.2o7[1].txt
C:\Documents and Settings\user\Cookies\user@ad.outerinfoads[1].txt
C:\Documents and Settings\user\Cookies\user@ads.monster[2].txt
C:\Documents and Settings\user\Cookies\user@zedo[3].txt
C:\Documents and Settings\user\Cookies\user@doubleclick[1].txt
C:\Documents and Settings\user\Cookies\user@directtrack[1].txt
C:\Documents and Settings\user\Cookies\user@mediaplex[2].txt
C:\Documents and Settings\user\Cookies\user@rotator.adjuggler[3].txt
C:\Documents and Settings\user\Cookies\user@bizadverts[2].txt
C:\Documents and Settings\user\Cookies\user@protect.spyguardpro[2].txt
C:\Documents and Settings\user\Cookies\user@specificclick[3].txt
C:\Documents and Settings\user\Cookies\user@atlas.entrepreneur[2].txt
C:\Documents and Settings\user\Cookies\user@login.revenueloop[2].txt
C:\Documents and Settings\user\Cookies\user@bleeparoo[1].txt
C:\Documents and Settings\user\Cookies\user@eyewonder[1].txt
C:\Documents and Settings\user\Cookies\user@1072588370[2].txt
C:\Documents and Settings\user\Cookies\user@interclick[2].txt
C:\Documents and Settings\user\Cookies\user@hitbox[1].txt
C:\Documents and Settings\user\Cookies\user@adlegend[1].txt
C:\Documents and Settings\user\Cookies\user@advertising[1].txt
C:\Documents and Settings\user\Cookies\user@tacoda[2].txt
C:\Documents and Settings\user\Cookies\user@www.bleeparoo[2].txt
C:\Documents and Settings\user\Cookies\user@www.bleepbot[2].txt
C:\Documents and Settings\user\Cookies\user@www.thedegreefinder[2].txt

Adware.ClickSpring/Outer Info Network
C:\Documents and Settings\user\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\user\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\user\Start Menu\Programs\Outerinfo

Malware.LocusSoftware Inc/SpyGuardPro
C:\Documents and Settings\user\Application Data\SpyGuardPro\Logs\threats.log
C:\Documents and Settings\user\Application Data\SpyGuardPro\Logs
C:\Documents and Settings\user\Application Data\SpyGuardPro

RootKit.TnCore/Trace
C:\WINDOWS\system32\drivers\core.cache.dsk

Rogue.ErrorFighter
HKLM\Software\ugac
HKLM\Software\ugac#DomainName

Adware.ClickSpring-Variant
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\!UPDATE.EXE
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\WNG1OBGB\!UPDATE-4495[1].0000

Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\NI.UGA6P_0001_N122M2210\SETUP.EXE
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\TMP9B.TMP

Trojan.Downloader-Gen/MROFIN
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\TMP98.TMP
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP98\A0016329.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP98\A0016332.EXE
C:\WINDOWS\MROFINU1000106.EXE
C:\WINDOWS\MROFINU572.EXE.TMP

Rogue.NoWayVirus-PTask
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP100\A0019469.EXE

Rogue.LocusSoftware/Component
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP100\A0019478.OLD
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP100\A0019479.OLD

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP112\A0026192.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP115\A0027166.VBS

Adware.Vundo-Variant/Small-A
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP112\A0026194.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP112\A0026198.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP112\A0026199.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP112\A0026200.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP112\A0026202.DLL
C:\WINDOWS\SYSTEM32\KJMJBTSC.DLL
C:\WINDOWS\SYSTEM32\NLIPNQOA.DLL
C:\WINDOWS\SYSTEM32\VBQUVSPM.DLL

Adware.Vundo-Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP115\A0027167.DLL

Rogue.StorageProtector/Trace
C:\SYSTEM VOLUME INFORMATION\_RESTORE{CDB24CF7-420B-4626-BE26-7B7CE0D32075}\RP99\A0017308.EXE

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\IJJLM.INI
C:\WINDOWS\SYSTEM32\XYADD.INI
C:\WINDOWS\SYSTEM32\YCCDD.INI
C:\WINDOWS\SYSTEM32\YCCDD.INI2

Trace.Known Threat Sources
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\errorhandler[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\browserdetect[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\fileslist[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\pbmarker[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\AC_RunActiveContent[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\closebutton[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\index[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\shieldred[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\CALGI1X7.htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\flash_detect[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\bleep2[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\progressbar[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\common[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\secpanel[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\9_swp[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\bleep[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\window[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\buttonbg[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\styles[1].css
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\activex[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\pbbg[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\AC_ActiveX[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\fullresize[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\ajax[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\flash[1].swf
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\disc-cd[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\scan[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\shld[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\stats[1].jpg
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\alert[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\spacer[2].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\common[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\progressbar[2].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\bg[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\fileslist[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\14_swp[1].htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\WNG1OBGB\stats[1].jpg
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\sh[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\RR0NC3UN\shkaladelenie[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\secstat[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\4J4P67KJ\closebutton[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\acx[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0B6DEB4H\CAG1QV85.htm
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\NENP5TF7\styles[1].css
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\NENP5TF7\minilogo[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\LRBDVL3W\ban_1[1].swf
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\EZWVLYZ6\ax[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\IWIPN10C\flash[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\NENP5TF7\header_bg[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\LRBDVL3W\window[1].js
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\NENP5TF7\popup[1].gif
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\EZWVLYZ6\scan[1].htm

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:18 PM

Posted 05 February 2008 - 10:00 AM

Good job Victoria.

You've got a number of infections on your computer, and it will take several steps to get them all taken care of. If you have any questions at any point, please ask. At this point, I'm going to ask someone more knowledgeable than I to take over.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:18 PM

Posted 05 February 2008 - 11:08 AM

Your SAS log found a lot of vundo related malware and RootKit.TnCore/Trace core.cache.dsk. This infection is basically a rootkit and usually protected by a driver which must be identified and removed in order to remove the infection completely. SAS saids it has found/removed the file but often that is not the case as it returns. If the driver is not present, we may be able to get the file. If it is, then more powerful tools then we use in this forum will be required.

Rootkits are very dangerous because they use advanced techniques as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

Although the rootkit has been identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the rootkit has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS. Please read "When should I re-format?" and "Reformatting the computer or troubleshooting; which is best?".

Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. If you wish to proceed, please do the following.

Please follow the the instructions for using Vundofix in BC's self-help tutorial: "How To Remove Vundo/Winfixer Infection".

After running VundoFix, a text file named vundofix.txt will have automatically been saved to the root of the system drive, usually at C:\vundofix.txt. Please copy & paste the contents of that text file into your next reply.

Please download SDFix by AndyManchesta and save it to your desktop.
alternate zipped version
When using this tool, you must use the Administrator's account or an account with "Administrative rights"
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive.
  • Disconnect from the Internet before running SDFix.
  • Double click SDFix.exe and it will extract the files to %systemdrive%
  • (this is the drive that contains the Windows Directory, typically C:\SDFix).
  • DO NOT use it just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load, the SDFix report will open on screen and also save a copy into the SDFix folder as Report.txt.
  • Copy and paste the contents of Report.txt in your next reply.
  • Be sure to re-enable your anti-virus and other security programs before connecting to the Internet.
-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 06 February 2008 - 07:03 PM

I will start the steps given. Thanks for your help both Orange Blossom and Bleepin Janitor

Edited by Victoria, 06 February 2008 - 07:05 PM.


#12 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 07 February 2008 - 08:06 PM

Here is the report from the vundofix. So far so good with no popups. Thanks so much!


SDFix: Version 1.137

Run by Administrator on Thu 02/07/2008 at 05:00 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\Temp\1cb\syscheck.log - Deleted
C:\WINDOWS\MROFINU1000106.EXE - Deleted
C:\WINDOWS\MROFINU572.EXE.TMP - Deleted
C:\WINDOWS\system32\pac.txt - Deleted


Could Not Remove C:\WINDOWS\system32\drivers\core.cache.dsk

Folder C:\Program Files\Dot1XCfg - Removed
Folder C:\Program Files\Temporary - Removed
Folder C:\Temp\1cb - Removed
Folder C:\Temp\tn3 - Removed


Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 16:38:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------
C:\WINDOWS\system32\drivers\core.cache.dsk Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Tue 4 Sep 2007 146,432 ..SHR --- "C:\Program Files\iConcepts Music Express\Setup.exe"
Tue 15 Jan 2008 230,400 A.SHR --- "C:\WINDOWS\system32\??crosoft\TSKMGR~1.EXE"

Finished!

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:18 PM

Posted 11 February 2008 - 01:52 PM

Sorry for the late reply but I had to go out of town for a few days.

This infection is basically a rootkit usually protected by a driver which must be identified and removed by the use of more powerful tools than we use in this forum in order to remove the infection completely. Before that can be done you will need you to create and post a hijackthis log.

Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". In step #9 there are instructions for downloading HijackThis and creating a log. (This is a self-extracting version which will automatically install the current version of HJT in the proper location.) If using Windows Vista, be sure to Run As Administrator.

When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. Please include the top portion of the HijackThis log that lists version information. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the HJT Team.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 Victoria

Victoria
  • Topic Starter

  • Members
  • 126 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:10:18 AM

Posted 17 February 2008 - 08:25 PM

I'm glad to see you replied again because the pop ups started again. You said I need more powerful tools. I'm assuming I will need to purchase something and this will be explained by the HJT tutorial?

#15 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:18 PM

Posted 17 February 2008 - 08:50 PM

Hi Victoria,

No, you do not need to purchase anything. Please be sure to follow quietman7's directions in his latest post.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users