Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I am infected with CiD Advertising.


  • This topic is locked This topic is locked
4 replies to this topic

#1 Sleep Tight Tiger

Sleep Tight Tiger

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 28 April 2009 - 12:46 PM

Okay, first things first, my previous post:

"Right okay, this problem has been frustrating me for some hours now.

This is a problem that is imminent on a friend's machine, not mine, I'll explain why this would have never happend to me in a moment.

I have a friend who is not very adequate in computer functioning, lol. She, like any other 18 year old girl, likes to be able to customise things to suit her atse, colours fonts etc. She had installed the program Messenger Plus, the add on to compliment Windows Live Messenger, to be able to alter her name and make it coloured etc. Upon installation of this program it asks if you'd like to install the "sponsor" and show some support. Not knowing what this meant she toggled the tick box to install the adware program. I thought, okay, no worries, I'll just uninstall the program (thinking it would uyninstall the sponsor too, N.B. the sponsor didn't seem to be in the uninstall list in control panel). So i uninstalled Messenger Plus. Reinstalled it because she still wanted to keep this program. This time I made sure the sponsor was unchecked. Installed, and thought was fixed. She approaches me a few days later saying the problem still persists.

Now, this sponsor program is run by an organisation called CiD, this is tagged in title of whatever it is opening in IE. This sponsor randomly opens advertisem ents at unequal intervals. For e.g. it has opened 3 since I've been writing this.

Now since I couldn't find the program in the add/remove programs in control panel, and I couldn't find any suspicious processes or services in task manager, I decided to run Lavasoft Ad-Aware to see if that could pick it up. It returned malware, none of which were CiD. I removed the malware it could find, but i was still left with the one I needed to find missing. I tried a program reccomended by a friend. That also failed to find it.

So I try looking for forums with people posting the same problem. Thought I'd found one. So I did what it suggested. I altered in control panel settings to make hidden files visible including all windows and system files etc. I restarted in safe mode, and started a program called hijack this. I scanned (and logged) using this piece of software, and hightlited the particular results mentioned in the forum answer (some of them weren't there but some of them were).

After selecting the results, I clicked repair. Now I'm guessing that after this is done, the program is supposed to give back the results of the action that will be highlighted. I guessed this since in the forum it said select and delete the highlighted files or whatever. There were no such results, just a completely blank result field. So i closes the program and restarts in normal mode. This did nothing for me, which I had expected. So i found another forum, using the same method and same piece of software, except this time, what they told me to look out for and to highlight was different, this time none of the results mentioned in the forum returned in the scan.

And thats about all I have done so far. I would really like to get this problem sorted without having to reformat my friend's machine, and backup everything blah blah blah.

So if anybody could shed some light on the situation that would be great.

P.S. I also tried copying some command codes I found on a site into notepad, and saving it as a .BAT under "All files" format, then right clicking the file and running as administrator. This was supposed to reveal the program into the add/remove prgrams field in control panel but it didn't.

I also tried to use Eset online scanner, but the activex controller I had to install didn't have a publisher signature, and so IE wouldnt let me run it, I tried deactivating the setting for not accepting unknown publishers in Internet Options, however it still failed to start.


I know its a lot to take in, since I've also tried to seek help previous to this, but its really frustrating me...


Any knowledge on this would be greatly appreciated, not just by me but my friend too...


Thanks guys.


Best Regards, Jim. "

A nice person named Rigel helped me and had me to do a Malware Bytes Scan, which I recorded the Log for, he said I had an LOP infection and needed to run a HJT scan and post the log here.

So here's the HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:37:15, on 28/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\WisKeyState.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [WisKeyState] "C:\Program Files\Launch Manager\WisKeyState.exe"
O4 - HKLM\..\Run: [LMgrVolOSD] "C:\Program Files\Launch Manager\OSD.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [HEART DATA] "C:\ProgramData\Grey four four.av28c"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman Resource Provider (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe

--
End of file - 8251 bytes


Any ideas on how I can get rid of this Adware guys?

Help would be greatly appreciated.


Many Thanks Jim (Sleeptighttiger)

BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 PM

Posted 28 April 2009 - 12:58 PM

Please disable your antivirus, antimalware and firewall before proceed with our fix.. Please re-enable them back after performing all steps given..
Please VISIT HERE if you do not know how..

Please download Lop S&D by Eric_71 and save it to your Desktop.

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 Sleep Tight Tiger

Sleep Tight Tiger
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:30 AM

Posted 28 April 2009 - 01:28 PM

Thanks very much for taking the time to sort this for me, its greatly appreciated.

Here's the log for scan:


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Turion™ X2 Ultra Dual-Core Mobile ZM-80 )
BIOS : Ver 1.00PARTTBL
USER : James A. Cushen ( Administrator )
BOOT : Normal boot
Antivirus : Norman Security Suite ver. 7.00 7.00 (Not Activated)
C:\ (Local Disk) - NTFS - Total:94 Go (Free:37 Go)
D:\ (Local Disk) - NTFS - Total:129 Go (Free:65 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 28/04/2009|19:15 )

[ UAC => 1 ]

--------------------\\ Listing folders in Local

[21/02/2009|20:33] C:\Users\JAMESA~1.CUS\AppData\Local\Adobe
[03/01/2009|01:44] C:\Users\JAMESA~1.CUS\AppData\Local\Apple
[03/01/2009|01:49] C:\Users\JAMESA~1.CUS\AppData\Local\Apple Computer
[23/12/2008|23:00] C:\Users\JAMESA~1.CUS\AppData\Local\Application Data
[23/12/2008|23:02] C:\Users\JAMESA~1.CUS\AppData\Local\ATI
[22/04/2009|18:04] C:\Users\JAMESA~1.CUS\AppData\Local\d3d9caps.dat
[24/04/2009|19:19] C:\Users\JAMESA~1.CUS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[25/04/2009|21:06] C:\Users\JAMESA~1.CUS\AppData\Local\GDIPFONTCACHEV1.DAT
[17/03/2009|21:55] C:\Users\JAMESA~1.CUS\AppData\Local\Google
[23/12/2008|23:00] C:\Users\JAMESA~1.CUS\AppData\Local\History
[28/04/2009|11:35] C:\Users\JAMESA~1.CUS\AppData\Local\IconCache.db
[19/01/2009|20:10] C:\Users\JAMESA~1.CUS\AppData\Local\Microsoft
[06/04/2009|23:42] C:\Users\JAMESA~1.CUS\AppData\Local\Microsoft Games
[25/12/2008|15:56] C:\Users\JAMESA~1.CUS\AppData\Local\Mozilla
[20/02/2009|22:33] C:\Users\JAMESA~1.CUS\AppData\Local\PACE Anti-Piracy
[23/12/2008|23:01] C:\Users\JAMESA~1.CUS\AppData\Local\Seven Zip
[28/04/2009|19:13] C:\Users\JAMESA~1.CUS\AppData\Local\Temp
[23/12/2008|23:00] C:\Users\JAMESA~1.CUS\AppData\Local\Temporary Internet Files
[25/12/2008|16:17] C:\Users\JAMESA~1.CUS\AppData\Local\VirtualStore
[25/04/2009|21:52] C:\Users\JAMESA~1.CUS\AppData\Local\Yg5bja6FY

--------------------\\ Scheduled Tasks located in C:\Windows\Tasks

[06/04/2009 21:41][--a------] C:\Windows\tasks\Ad-Aware Update (Weekly).job
[28/04/2009 17:15][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{1E957BE6-DE61-4736-BE41-86BDB6937E3B}.job
[28/04/2009 17:10][--ah-----] C:\Windows\tasks\SA.DAT
[28/04/2009 11:35][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing Folders in C:\ProgramData

[13/03/2009|21:15] C:\ProgramData\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[23/12/2008|23:01] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[10/03/2009|22:44] C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}
[25/04/2009|21:51] C:\ProgramData\Adobe
[03/01/2009|01:43] C:\ProgramData\Apple
[13/03/2009|21:15] C:\ProgramData\Apple Computer
[02/11/2006|14:02] C:\ProgramData\Application Data
[17/06/2008|22:33] C:\ProgramData\ATI
[21/04/2009|23:27] C:\ProgramData\Azureus
[09/03/2009|18:50] C:\ProgramData\beep axis mode free
[02/11/2006|14:02] C:\ProgramData\Desktop
[02/11/2006|14:02] C:\ProgramData\Documents
[20/02/2009|22:10] C:\ProgramData\Electronic Arts
[02/11/2006|14:02] C:\ProgramData\Favorites
[23/12/2008|22:59] C:\ProgramData\fsc-reg
[08/01/2009|21:23] C:\ProgramData\Google
[09/03/2009|18:49] C:\ProgramData\Grey four four.av28c
[09/03/2009|18:49] C:\ProgramData\Grey four four.cb1ikq3
[03/04/2009|19:10] C:\ProgramData\HDBR31
[09/03/2009|18:50] C:\ProgramData\Inter intra
[10/03/2009|22:38] C:\ProgramData\Lavasoft
[04/04/2009|11:33] C:\ProgramData\Malwarebytes
[25/12/2008|15:53] C:\ProgramData\Microsoft
[18/04/2009|16:37] C:\ProgramData\Microsoft Help
[17/06/2008|22:22] C:\ProgramData\Nero
[20/02/2009|22:33] C:\ProgramData\PACE Anti-Piracy
[02/04/2009|14:46] C:\ProgramData\SITEguard
[02/11/2006|14:02] C:\ProgramData\Start Menu
[02/04/2009|22:28] C:\ProgramData\STOPzilla!
[02/11/2006|14:02] C:\ProgramData\Templates
[25/12/2008|16:03] C:\ProgramData\WLInstaller

--------------------\\ Listing Folders in C:\Program Files

[23/12/2008|23:01] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[25/04/2009|21:51] C:\Program Files\Adobe
[17/06/2008|22:16] C:\Program Files\AOLBroadband
[03/01/2009|01:44] C:\Program Files\Apple Software Update
[21/04/2009|23:27] C:\Program Files\AskBarDis
[17/06/2008|22:07] C:\Program Files\ATI
[17/06/2008|22:09] C:\Program Files\ATI Technologies
[17/06/2008|22:16] C:\Program Files\BFG
[10/01/2009|14:12] C:\Program Files\Bonjour
[09/03/2009|18:49] C:\Program Files\Circle Dvelopement
[27/03/2009|18:34] C:\Program Files\Common Files
[20/02/2009|22:31] C:\Program Files\EA GAMES
[20/02/2009|22:09] C:\Program Files\Electronic Arts
[23/12/2008|22:59] C:\Program Files\Fujitsu Siemens Computers
[05/03/2009|23:17] C:\Program Files\Google
[03/04/2009|20:26] C:\Program Files\Hijack This
[23/12/2008|22:56] C:\Program Files\InstallShield Installation Information
[18/04/2009|16:45] C:\Program Files\Internet Explorer
[13/03/2009|21:15] C:\Program Files\iPod
[13/03/2009|21:15] C:\Program Files\iTunes
[12/04/2009|21:06] C:\Program Files\Java
[17/06/2008|22:12] C:\Program Files\Launch Manager
[10/03/2009|22:29] C:\Program Files\Lavasoft
[04/04/2009|11:33] C:\Program Files\Malwarebytes' Anti-Malware
[02/11/2006|13:37] C:\Program Files\Microsoft Games
[17/06/2008|22:28] C:\Program Files\Microsoft Office
[17/06/2008|22:30] C:\Program Files\Microsoft Works
[17/06/2008|22:28] C:\Program Files\Microsoft.NET
[21/01/2008|03:35] C:\Program Files\Movie Maker
[22/04/2009|18:04] C:\Program Files\Mozilla Firefox
[02/11/2006|13:37] C:\Program Files\MSBuild
[25/12/2008|19:55] C:\Program Files\MSXML 4.0
[17/06/2008|22:22] C:\Program Files\Nero
[28/04/2009|17:10] C:\Program Files\Norman
[23/12/2008|22:56] C:\Program Files\Picasa2
[24/04/2009|19:50] C:\Program Files\Power Tab Software
[13/03/2009|21:14] C:\Program Files\QuickTime
[02/11/2006|13:37] C:\Program Files\Reference Assemblies
[17/06/2008|22:12] C:\Program Files\Synaptics
[03/04/2009|20:27] C:\Program Files\Trend Micro
[02/11/2006|14:01] C:\Program Files\Uninstall Information
[21/04/2009|23:27] C:\Program Files\Vuze
[21/01/2008|03:35] C:\Program Files\Windows Calendar
[21/01/2008|03:35] C:\Program Files\Windows Collaboration
[21/01/2008|03:35] C:\Program Files\Windows Defender
[21/01/2008|03:35] C:\Program Files\Windows Journal
[25/12/2008|16:14] C:\Program Files\Windows Live
[18/04/2009|16:45] C:\Program Files\Windows Mail
[13/03/2009|11:11] C:\Program Files\Windows Media Player
[02/11/2006|13:37] C:\Program Files\Windows NT
[21/01/2008|03:35] C:\Program Files\Windows Photo Gallery
[21/01/2008|03:35] C:\Program Files\Windows Sidebar

--------------------\\ Listing Folders in C:\Program Files\Common Files

[25/04/2009|21:51] C:\Program Files\Common Files\Adobe
[13/03/2009|21:15] C:\Program Files\Common Files\Apple
[17/06/2008|22:28] C:\Program Files\Common Files\DESIGNER
[23/12/2008|22:59] C:\Program Files\Common Files\Fujitsu Siemens Computers
[23/12/2008|22:59] C:\Program Files\Common Files\InstallShield
[27/03/2009|18:34] C:\Program Files\Common Files\iS3
[05/03/2009|12:46] C:\Program Files\Common Files\microsoft shared
[17/06/2008|22:23] C:\Program Files\Common Files\Nero
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[21/01/2008|03:35] C:\Program Files\Common Files\System
[25/12/2008|16:11] C:\Program Files\Common Files\WindowsLiveInstaller

--------------------\\ Process

( 73 Processes )

iexplore.exe ~ [PID:3968]
iexplore.exe ~ [PID:3704]

--------------------\\ Searching with S_Lop

C:\ProgramData\Grey four four.av28c
C:\ProgramData\Grey four four.cb1ikq3
C:\Users\JAMESA~1.CUS\AppData\Local\Temp\bisC9A7.exe
C:\Users\JAMESA~1.CUS\AppData\Local\Temp\bisCB1B.exe

--------------------\\ Searching for Lop Files - Folders

C:\ProgramData\beep axis mode free
C:\ProgramData\beep axis mode free\fork 32.dat
C:\ProgramData\beep axis mode free\fork 32.exe
C:\Users\JAMESA~1.CUS\AppData\Local\Temp\nsx46D1.tmp
C:\Users\JAMESA~1.CUS\AppData\Local\Temp\staC541.exe
C:\Users\JAMESA~1.CUS\AppData\Local\Temp\status.txt
C:\Users\JAMESA~1.CUS\AppData\Roaming\MICROS~1\Windows\Cookies\james_a._cushen@advertising[1].txt

--------------------\\ Searching within the Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HEART DATA"="\"C:\\ProgramData\\Grey four four.av28c\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

--------------------\\ Checking the Hosts file

Hosts file CLEAN


--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-28 19:15:16
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections


No other infections found !

[F:811][D:57]-> C:\Users\JAMESA~1.CUS\AppData\Local\Temp
[F:268][D:2]-> C:\Users\JAMESA~1.CUS\AppData\Roaming\MICROS~1\Windows\Cookies
[F:1445][D:4]-> C:\Users\JAMESA~1.CUS\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:786][D:57]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 28/04/2009|19:17 - Option : [1]

--------------------\\ Scan completed at 19:17:04
[ UAC => 1 ]





Did disable all security programs including firewall.


Jim.

#4 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 PM

Posted 28 April 2009 - 01:32 PM

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 3 (Fix - Hosts)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop. <<mirror>>
If you see "random" name, just leave it.. If you see "GMER", please rename GMER into GAMERS
  • Open the renamed program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.
IMPORTANT: Do NOT run any program while you are doing these scans as it may interfere with the output results



Post me these logs in your next reply.. Post each log in separate post..

1. Lop S&D
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#5 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 PM

Posted 03 May 2009 - 05:53 PM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users