Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HijackThis Log: Please help Diagnose


  • This topic is locked This topic is locked
11 replies to this topic

#1 chedz

chedz

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 15 August 2009 - 05:50 AM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:03, on 15/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesWindows DefenderMsMpEng.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
C:WINDOWSSYSTEM32astsrv.exe
C:Program FilesBonjourmDNSResponder.exe
C:WINDOWSsystem32cisvc.exe
C:Program FilesJuniper NetworksCommon FilesdsNcService.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesCommon FilesLightScribeLSSrvc.exe
C:PROGRA~1TRENDM~1INTERN~1PcCtlCom.exe
C:WINDOWSsystem32PnkBstrA.exe
C:WINDOWSsystem32PnkBstrB.exe
C:WINDOWSV0220Mon.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesQuickTimeQTTask.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
C:Program FilesiTunesiTunesHelper.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Documents and SettingsGrahamLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe
C:Documents and SettingsGrahamApplication Datataskeng.exe
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:WINDOWSSystem32svchost.exe
C:PROGRA~1TRENDM~1INTERN~1Tmntsrv.exe
C:PROGRA~1TRENDM~1INTERN~1TmPfw.exe
C:PROGRA~1TRENDM~1INTERN~1tmproxy.exe
C:Program FilesWindows LiveContactswlcomm.exe
C:Program FilesiPodbiniPodService.exe
C:PROGRA~1TRENDM~1INTERN~1PcScnSrv.exe
C:PROGRA~1TRENDM~1INTERN~1PccGuide.exe
C:WINDOWSexplorer.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:PROGRA~1WINZIPwinzip32.exe
C:Documents and SettingsGrahamDesktopHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.bbc.co.uk/iplayer/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Windows Internet Explorer provided by Yahoo! UK & Ireland
F2 - REG:system.ini: UserInit=C:WINDOWSsystem32Userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:Program FilesRealRealPlayerrpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:Program FilesWindows LiveMessengerwlchtc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: (no name) - {99D2714E-C291-4D43-8F11-CF98A23BFEA0} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6binjp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O4 - HKLM..Run: [ATIPTA] "C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe"
O4 - HKLM..Run: [V0220Mon.exe] C:WINDOWSV0220Mon.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe" -osboot
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..Run: [Windows Defender] "C:Program FilesWindows DefenderMSASCui.exe" -hide
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6binjusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [RoxWatchTray] "C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatchTray9.exe"
O4 - HKLM..Run: [StartCCC] "C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe" MSRun
O4 - HKLM..Run: [AppleSyncNotifier] C:Program FilesCommon FilesAppleMobile Device SupportbinAppleSyncNotifier.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [Google Update] "C:Documents and SettingsGrahamLocal SettingsApplication DataGoogleUpdateGoogleUpdate.exe" /c
O4 - HKCU..Run: [MicrosoftUpdate] C:Documents and SettingsGrahamApplication Datataskeng.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUSS-1-5-18..RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'Default user')
O4 - HKUS.DEFAULT..RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O12 - Plugin for .spop: C:PROGRA~1INTERN~1PluginsNPDocBox.dll
O15 - Trusted Zone: play.battlefield-heroes.com
O15 - Trusted Zone: http://www.battlefieldheroes.com
/cab/OCXChecker_6110.cab[/url]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:Program FilesYahoo!Commonyinsthelper.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1199544399531
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2e52972...all/xscan53.cab
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/up...er_4.0.21.0.cab
/cab/DownloadFile_7000.cab[/url]
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15031/CTPID.cab
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B23E0CC} - http://direct.data-line.us/gbn298.exe
O17 - HKLMSystemCCSServicesTcpip..{C646E5C1-C778-4604-8155-C6AFF0C6DA5C}: NameServer = 85.255.112.11,85.255.112.139
O17 - HKLMSystemCCSServicesTcpip..{DCDB9DA1-DEB6-4E5D-8831-80A71B920BC7}: NameServer = 85.255.112.11,85.255.112.139
O17 - HKLMSystemCS1ServicesTcpipParameters: NameServer = 85.255.112.11,85.255.112.139
O17 - HKLMSystemCS2ServicesTcpipParameters: NameServer = 85.255.112.11,85.255.112.139
O17 - HKLMSystemCCSServicesTcpipParameters: NameServer = 85.255.112.11,85.255.112.139
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
O23 - Service: AST Service (astcc) - Advanced Software Technologies - C:WINDOWSSYSTEM32astsrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSSYSTEM32ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:Program FilesJuniper NetworksCommon FilesdsNcService.exe
O23 - Service: DU Meter Service (DUMeterSvc) - Unknown owner - C:Program FilesDU MeterDUMeterSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:Program FilesiPodbiniPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:Program FilesJavajre6binjqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:Program FilesCommon FilesAheadLibNMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:PROGRA~1TRENDM~1INTERN~1PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:PROGRA~1TRENDM~1INTERN~1PcScnSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:WINDOWSsystem32PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:WINDOWSsystem32PnkBstrB.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:Program FilesRoxioDigital Home 9RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:Program FilesRoxioDigital Home 9RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:Program FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:PROGRA~1TRENDM~1INTERN~1Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:PROGRA~1TRENDM~1INTERN~1TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:PROGRA~1TRENDM~1INTERN~1tmproxy.exe

--
End of file - 12257 bytes

Forgot to say, the problem I have is some kind of browser search result hijacker, all my search results seem to go to someone elses search sites, ebay or some other place.
I also seem to suddenly have a lot of popups that previously were not there.

Thanks a lot for any help

chedz

Merged posts. ~ OB

Edited by Orange Blossom, 15 August 2009 - 10:35 PM.


BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:02:13 PM

Posted 16 August 2009 - 10:46 PM

Hello chedz,

Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

Download Security Check by screen317 from here or here.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

**********************

We need to disable your Windows Defender Real-time Protection and Spybot Teatimer as it may interfere with the fixes that we need to make.
  • Open Windows Defender.
  • Click on Tools, General Settings.
  • Scroll down and uncheck Turn on real-time protection (recommended).
  • After you uncheck this, click on the Save button and close Windows Defender.
After all of the fixes are complete it is very important that you enable Real-time Protection again.

To disable Spybot's Teatimer:
Run Spybot-S&D
Go to the Mode menu, and make sure "Advanced Mode" is selected
On the left hand side, choose Tools -> Resident
Uncheck "Resident TeaTimer" and OK any prompts

Note: If you already have Malwarebytes' Anti-Malware, then update, run it, then do a "Perform Full Scan"

Please download Malwarebytes' Anti-Malware from one of these places:
http://download.cnet.com/Malwarebytes-Anti...&tag=button
http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html
http://www.besttechie.net/mbam/mbam-setup.exe

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Full Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire MBAM report (even if it does not find anything) in your next reply along with a fresh HijackThis log.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Edited by SifuMike, 16 August 2009 - 10:48 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 chedz

chedz
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 17 August 2009 - 07:19 AM

Hi (mike?)

many thanks for the help, really appreciate it.

I've downloaded Malwarebytes anti-malware and the install ran fine, however, when I try opening it form the desk top icon...nothing. I get an egg timer for about 2 seconds, then nothing happens, no processes start, no icons appear , no errors and no screens.

I have had a problem with S&D too, when I install it I get this error:

C:\docume.........temp\is-7S0b7.tmp\SPYBOT~1.exe.
The NTVDM CPU has encountered an illegal instruction.
CD:)eb IP:0180 OP:63 6e 74 65 Choose close to terminate the application.

I can ignore it, but then another similar error happens, then if I try and run the new desktop icon, it does the same as Malwarebytes, but that gives no errors during install.

I turned everything I could off, trend PC-cillin, windows defender, uninstalled S&D as it doesn't work and run the security check, results below:

Thanks again
chedz


nResults of screen317's Security Check version 0.98.8
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
Trend Micro PC-cillin Internet Security 2007
Trend Micro PC-cillin Internet Security 2007


Antivirus up to date! (On Access scanning disabled!)
``````````````````````````````
Anti-malware/Other Utilities Check:

Spybot - Search & Destroy
Windows Defender
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Java™ 6 Update 13
Java™ 6 Update 7
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 9
``````````````````````````````
Process Check:
objlist.exe by Laurent

Windows Defender MSMpEng.exe


``````````````````````````````
DNS Vulnerability Check:

GREAT! (Very random)

`````````End of Log```````````

#4 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:02:13 PM

Posted 17 August 2009 - 09:11 AM

Hi chedz,


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Please download Java Version 6 Update 15
  • Click the "Free Java Download" button.
  • Click "Free Java Download" again
  • Save the file jxpiinstall.exe to your desktop
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    Examples of older versions in Add or Remove Programs:
    Java 6 Update 13
    Java 6 Update 7
    J2SE Runtime Environment 5.0 Update 6

  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jxpiinstall.exe to install the newest version.
*****************

I've downloaded Malwarebytes anti-malware and the install ran fine, however, when I try opening it form the desk top icon...nothing. I get an egg timer for about 2 seconds, then nothing happens, no processes start, no icons appear , no errors and no screens.



If MBAM will not run, go to the program directory of MBAM (e.g. C:\Program FIles\Malwarebytes Antimalware\) then rename mbam.exe to newtool.exe3, double click newtool3.exe to proceed in running a Full scan.

* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Full Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire MBAM report (even if it does not find anything) in your next reply

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Edited by SifuMike, 17 August 2009 - 09:18 AM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 chedz

chedz
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 17 August 2009 - 11:57 AM

Thanks,

I've uploaded the new Java and am running the full scan right now.

What I don't understand is why I'm suddenly getting pop-ups where previously I didn't. I don't think I've turned anything off, could whatever is redirecting my search result URL's also be allowing pop-ups? I've really no interest in online casinos so they wasting their time anyway :thumbup2:

Will update shortly when the scan has finished. So far 30,000 items scanned 2 infected and counting....

Chedz

#6 chedz

chedz
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 17 August 2009 - 12:07 PM

More strange things....

This window keeps popping up, it locks the browser and if I close it the browser closes. If I click allow it seems to want to get a file from a rather unofficial looking website. moondelight.com or something like that so I kill it.

I've really no idea what this is, its not form trend, nor does it look official windows security or firefox. Perhaps it is and the same thing that is redirecting my search results is redirecting this link too?

Attached File  secwindow.GIF   20.13KB   2 downloads

I think its time to sell the PC and go live in a tree :thumbup2:

Chedz

Attached Files



#7 chedz

chedz
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 17 August 2009 - 12:58 PM

Well, the plot thickens...

I've run Malware, if found quite a few things:


Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 3

17/08/2009 18:45:58
mbam-log-2009-08-17 (18-45-52).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 220581
Time elapsed: 35 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 12
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{15cd9136-9972-406f-9ba8-da0f542b5ea3} (Dialer) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7327f0ff-165e-46b5-98c2-80d738a3b228} (Dialer) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Backdoor.Bot) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c646e5c1-c778-4604-8155-c6aff0c6da5c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c646e5c1-c778-4604-8155-c6aff0c6da5c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{dcdb9da1-deb6-4e5d-8831-80a71b920bc7}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c646e5c1-c778-4604-8155-c6aff0c6da5c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c646e5c1-c778-4604-8155-c6aff0c6da5c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{dcdb9da1-deb6-4e5d-8831-80a71b920bc7}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{c646e5c1-c778-4604-8155-c6aff0c6da5c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{c646e5c1-c778-4604-8155-c6aff0c6da5c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{dcdb9da1-deb6-4e5d-8831-80a71b920bc7}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.11,85.255.112.139 -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Graham\Local Settings\Temp\04712.exe (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\Graham\Local Settings\Temp\53066.exe (Rootkit.Dropper) -> No action taken.
C:\WINDOWS\didduid.ini (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\TEMP\tempo-4685593.tmp (Trojan.DNSChanger) -> No action taken.
C:\WINDOWS\TEMP\tempo-4684812.tmp (Trojan.DNSChanger) -> No action taken.


However, I clicked "remove all", rebooted as it suggested and its still the same.. In the log is says "no action taken" against them all??????????????????????????????????????? Did I do something wrong?



I do a search in google, click one of the results and it takes me somewhere completely different.

e.g I search for "judo clubs", I get this in the results:



#
Hollesley Judo Club
... judo club. Includes information on club activities and a database of judo ... Judo - a brief guide. Join the club. Competitions - a guide. Grading ...
www.hollesleyjudo.org.uk - Cached




when I click it it takes me to:

http://www.online-casino-bingo.co.uk/uk-bingo.shtml?ref=bv-b

This is the same for all search results.....very annoying indeed.

Any tips what to do next please?

cheers

#8 chedz

chedz
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 17 August 2009 - 02:48 PM

sorted.

I'd failed to update the malwarebyte properly, I did this, ran it again and it found another 16 problems. these are now cleared (I'd taken the log too early before) and now it all seems fine.

I'll certainly be updating and running this software reguarly.

cheers for the help!

chedz

#9 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:02:13 PM

Posted 17 August 2009 - 06:06 PM

Hi chedz,

However, I clicked "remove all", rebooted as it suggested and its still the same.. In the log is says "no action taken" against them all??????????????????????????????????????? Did I do something wrong?



Yes, you forgot to remove the malware it found :thumbup2:


I want to see the MBAM log that actually did all the quarantine and deletions. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire MBAM report in your next reply.

Please tell me how the computer is running now that you have run MBAM.

Edited by SifuMike, 17 August 2009 - 06:07 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#10 chedz

chedz
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:13 PM

Posted 20 August 2009 - 05:24 AM

Hi again,

well I spoke too soon, my search results are still going to funny places, but now not all the time.


Here is the first log:

Malwarebytes' Anti-Malware 1.40
Database version: 2642
Windows 5.1.2600 Service Pack 3

17/08/2009 20:41:26
mbam-log-2009-08-17 (20-41-26).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 221351
Time elapsed: 36 minute(s), 52 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 14

Memory Processes Infected:
C:\Documents and Settings\Graham\Application Data\taskeng.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoftupdate (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Graham\Application Data\taskeng.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Valve\Steam\uninstall_hl2.exe (Trojan.BHO) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-3686383091-7963868164-012612494-9902\rundll32.exe (Trojan.Dropper) -> Delete on reboot.
C:\Documents and Settings\Graham\Local Settings\Temp\705.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\24075.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\735.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\341.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\069.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\934.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\806.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\199.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\686.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\152.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Graham\Local Settings\Temp\494.exe (Trojan.Agent) -> Quarantined and deleted successfully.



Today I've run it again, it found some stuff and cleared it, but it still has the problem. I've also completely deleted the contents of the temp folder mentioned above.

Here is todays log from a full scan. I've cleared all these but I guess they are all pretty minor and not what is causing my problem: (i'm guessing)

Malwarebytes' Anti-Malware 1.40
Database version: 2661
Windows 5.1.2600 Service Pack 3

20/08/2009 10:50:44
mbam-log-2009-08-20 (10-50-44).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 220446
Time elapsed: 30 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 16

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\p_981116.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\wextract.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\netsetup.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\ServicePackFiles\i386\wextract.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\ServicePackFiles\i386\digcore.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\ServicePackFiles\i386\netsetup.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\ServicePackFiles\i386\msncli.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\ServicePackFiles\i386\msnsusii.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\Windows Update Setup Files\ie6setup.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\$NtServicePackUninstall$\wextract.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\$NtServicePackUninstall$\netsetup.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\ie6setup.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Program Files\MSN\MSNCoreFiles\install\msnsusii.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Program Files\MSN\MSNCoreFiles\install\msn9components\msncli.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Program Files\MSN\MSNCoreFiles\install\msn9components\digcore.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\frontpage\MyFiles\Users\rmorrow\fp2k\SYSTEM\IMMC.EXE (Worm.Autorun) -> Quarantined and deleted successfully.




As an example, today in Yahoo I search for :

"Toshiba SD590EKB2 (I'm after a new DIVX dvd player)

This comes back as a search result:



Toshiba SD590EKB Upscaling DVD Player with USB: Amazon.co.uk ...
Toshiba SD590EKB Upscaling DVD Player with USB: Amazon.co.uk: Electronics & Photo ... TOSHIBA SD590EKB DVD PLAYER This slim and stylish DVD player plays prerecorded ...
www.amazon.co.uk/Toshiba-SD590EKB-Upscaling-DVD-Player/dp/B0027FFSTY - 205k - Cached



So I expect to go to amazon, but instead, first Trend warns me of this:
Attached File  xx1.bmp   281.18KB   1 downloads

then I get taken to this site:



A video on how to find cheap van insurance. :S

If I go "back" a few times after a couple of other "dodgey sites" on how to apply makeup and get "extra inches", eventually it will go to the correct place, amazon in this case.


Any ideas most welcome.

cheeers

chedz

#11 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:02:13 PM

Posted 20 August 2009 - 09:40 AM

Hi chedz,

We will run ComboFix.

You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.
Please read Combofix's Disclaimer.
Further, ComboFix logs are not permitted outside the HijackThis forums and then only when requested by a HJT Team member.

You need to disable your Trend Micro PC-cillin Internet Security 2007, Windows Defender and Spybot Teatimer before running ComboFix, as they will prevent it from running.

Disable Trend Micro PC-cillin Internet Security.

To disable Windows Defender:
Open Windows Defender.
Click on Tools, General Settings.
Scroll down and uncheck Turn on real-time protection (recommended).
After you uncheck this, click on the Save button and close Windows Defender.

To disable Spybot's Teatimer:
Run Spybot-S&D
Go to the Mode menu, and make sure "Advanced Mode" is selected
On the left hand side, choose Tools -> Resident
Uncheck "Resident TeaTimer" and OK any prompts


Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

To work properly, you must install ComboFix on the Desktop..
Post the log from ComboFix in your next reply,

A caution - ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
ComboFix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal and increase security. If this is an issue or makes it difficult for you -- please tell me.
Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#12 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:02:13 PM

Posted 27 August 2009 - 09:11 PM

Due to inactivity, this thread will now be closed.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users