Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

It won't GO AWAY!


  • Please log in to reply
8 replies to this topic

#1 SusanO13

SusanO13

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Chicago, IL
  • Local time:07:49 AM

Posted 14 March 2009 - 07:49 PM

It started on March 10, 2009. Smehow my Google got hijacked by what I came to learn was the 7.7.7.0 redirect virus. I found several solutions for fixing it, all stating the same thing, "delete [C:\WINDOWS\system32\wdmaud.sys] file, run a virus scan and delete the trojan that is associated with it." I have done this.

Google is still being redirected. There is no more wdmaud.sys file to delete in system32. I renamed another one (this was before I knew it was the legit one) found in the [C:\WINDOWS\system32\directory\wdmaud.sys] just in case to check if it was the culprit. I could always change it back if there was no solution, I've done it several times with other files for one reason or other, they've always worked after being changed back. Apparently not the legit wdmaud.sys file. Now I have no sound.

Google is still being redirected. No sound (just the beep, like they had back in the day...god, I miss the screamin'). I ran a few other solves found here and there at reliable sites with good results for those with my 7.7.7.0 problem. I downloaded Malwarebytes, hijackthis (though found quickly that I could make no sense of the log), I use Avast and Advanced System Care already...I ran a MB scan.

Then my little trojan friend, isen.yjb showed up. I removed him. Google is still being redirected. Scanned again...isen.yjb is back. How did that happen? Then I got really desperate. I downloaded OTMoveit3 based on a recommendation from My Antispyware. OTMoveit3 did it's thing, I followed all the instructions, it was all good.

Google is still being redirected. I still have no sound. I've scanned and rebooted in safe mode, in standard windows, rebooted and scanned. Then I found ComboFix and downloaded it. Then I read what ComboFix does. Then I got scared.... Avast keeps warning me about the damn isen.yjb who has brought his two-headed brother isen.yjbx, THEY WON'T GO AWAY!

That's it! I need help. I'm calling in reinforcements. I don't want to cause any irrevocable damage. Such as, oh, I don't know, losing the ability to hear sound from my speakers!!! I'm sorry, I'm a tad frazzled at this point.

Edited by SusanO13, 14 March 2009 - 07:50 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:49 AM

Posted 14 March 2009 - 11:05 PM

Hi can you find a path to those files?

I would also like to see what S!Ri's SmitfraudFix search shows.

Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 SusanO13

SusanO13
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Chicago, IL
  • Local time:07:49 AM

Posted 18 March 2009 - 08:48 PM

Sorry for they delayed response, I've been out of town. Thanks for your help!

Here's the most recent line from my Avast log:

3/18/2009 8:11:34 PM SYSTEM 1696 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\ISEN.YJB" file.

Here's the SmitFraud rapport text:

SmitFraudFix v2.405

Scan done at 20:45:57.67, Wed 03/18/2009
Run from C:\Documents and Settings\Susan Otteman\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Susan Otteman\Local Settings\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Susan Otteman\Desktop\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

hosts


C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\WINDOWS\system32\LogFiles


C:\Documents and Settings\Susan Otteman


C:\DOCUME~1\SUSANO~1\LOCALS~1\Temp


C:\Documents and Settings\Susan Otteman\Application Data


Start Menu


C:\DOCUME~1\SUSANO~1\FAVORI~1


Desktop


C:\Program Files


Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!



Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


RK



DNS

Description: Intel® PRO/1000 PL Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 207.172.3.8
DNS Server Search Order: 207.172.3.9

HKLM\SYSTEM\CCS\Services\Tcpip\..\{68871C3B-8C87-41DC-83B9-4B13E0BECC42}: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7C065AE9-851E-4202-9B7E-EC0755E29F37}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C1B9DD86-8188-4E52-9EDD-FD93D5B7A06E}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS1\Services\Tcpip\..\{68871C3B-8C87-41DC-83B9-4B13E0BECC42}: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7C065AE9-851E-4202-9B7E-EC0755E29F37}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C1B9DD86-8188-4E52-9EDD-FD93D5B7A06E}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS2\Services\Tcpip\..\{68871C3B-8C87-41DC-83B9-4B13E0BECC42}: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7C065AE9-851E-4202-9B7E-EC0755E29F37}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C1B9DD86-8188-4E52-9EDD-FD93D5B7A06E}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=207.172.3.8 207.172.3.9


Scanning for wininet.dll infection


End

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:49 AM

Posted 18 March 2009 - 09:32 PM

That's OK we all have things to do. next ru Past 2 Cleaning.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, double-click SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt


Now Rerun MBAM like this..

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan.
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


How is the PC now?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 SusanO13

SusanO13
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Chicago, IL
  • Local time:07:49 AM

Posted 19 March 2009 - 10:27 AM

EUREKA!!!! I think I solved it last night. I hadn't emptied the recycle bin with the wdmaud.sys file which was the cause of the 7.7.7.0 redirect. Once I did that, I ran a couple of virus scans, deleted the trojan and haven't seen it since. So I was the cause of my problem. D'OH! It was a fluke that I did it so I can't take credit for it.

BUT!!!

Just in case I'm not as silly as I think I am right now, I ran the SmitFraud clean and the MBAM. MBAM turned up nothing, but the log is lost in safemode somewhere, I've saved-as, etc. It just won't be found in standard mode. I can find it in safemode, but can't access the net from there. The SmitFraud is listed below.

AND!!!

Somehow, somewhere the sound issue has been resolved. I am now listening to the happy, happy sounds of "Yellow Submarine" as we speak!

THANK YOU! THANK YOU! THANK YOU!

Susan

SmitFraudFix v2.405

Scan done at 9:24:13.89, Thu 03/19/2009
Run from C:\Documents and Settings\Susan Otteman\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts


127.0.0.1 localhost

VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files


IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


RK


DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{68871C3B-8C87-41DC-83B9-4B13E0BECC42}: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7C065AE9-851E-4202-9B7E-EC0755E29F37}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C1B9DD86-8188-4E52-9EDD-FD93D5B7A06E}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS1\Services\Tcpip\..\{68871C3B-8C87-41DC-83B9-4B13E0BECC42}: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7C065AE9-851E-4202-9B7E-EC0755E29F37}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C1B9DD86-8188-4E52-9EDD-FD93D5B7A06E}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7C065AE9-851E-4202-9B7E-EC0755E29F37}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C1B9DD86-8188-4E52-9EDD-FD93D5B7A06E}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=207.172.3.8 207.172.3.9
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=207.172.3.8 207.172.3.9


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:49 AM

Posted 19 March 2009 - 07:19 PM

Excellent,I'm glad.. so no I'll sing with ya

As we live a life of ease
Every one of us has all we need,(has all we need)
Sky of blue, and sea of green,(sky of blue and sea of green)
Now our PC(our PC is) malware free.(malware free) ( Hahaha! )


Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 SusanO13

SusanO13
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Chicago, IL
  • Local time:07:49 AM

Posted 19 March 2009 - 08:25 PM

:thumbsup: cleaning right now.

tha' was pretty funny, my good tech!

So is there any cause for other concern? Like people still allowed to see into my computer without my knowledge?

Edited by SusanO13, 19 March 2009 - 08:30 PM.


#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:49 AM

Posted 19 March 2009 - 09:28 PM

You're most welcome, it looked like it was a drive by exploit. You're OK. You may now comyinue on the magical mystery tour :thumbsup:
Please take a moment to read quietman7's excellent prevention tips in post 17 here
Click>>Tips to protect yourself against malware and reduce the potential for re-infection:
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 SusanO13

SusanO13
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Chicago, IL
  • Local time:07:49 AM

Posted 19 March 2009 - 10:31 PM

thx...adieu.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users