Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

infected and need help please!!


  • This topic is locked This topic is locked
15 replies to this topic

#1 sfdmoment

sfdmoment

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 18 November 2009 - 10:31 PM

hi

I get redirected to many other websites when I search yahoo and clicked on the search result link. I try to read and correct the problems myself by downloading malwarebytes, spybot, avast. Each of them told me I am infected with all kinds of secure hijacker and windowprotectionsuite and stuffs like that and deleted them for me. I still got problems. I even deleted the host files and try to edit reg keys, didn't work. I have no clue what I am doing and need help please thanks...!!

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 18 November 2009 - 11:30 PM

Hello and welcome.. I need to see some logs so please run these.
Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Next run ATF and SAS:
Note.. SAS doesn't open the registry hives for other user accounts on the system, so scans should be done from each user account.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 19 November 2009 - 05:15 PM

Thank you boopme

I followed your instruction

This is the Malwarebytes scan log

MBAM scan log
Malwarebytes' Anti-Malware 1.41
Database version: 3198
Windows 5.1.2600 Service Pack 3

11/19/2009 3:46:52 PM
mbam-log-2009-11-19 (15-46-52).txt

Scan type: Quick Scan
Objects scanned: 102871
Time elapsed: 6 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 2
Registry Data Items Infected: 4
Folders Infected: 1
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\__c0060D0F.dat (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0060d0f (Trojan.Vundo) -> Delete on reboot.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{c48635ad-d6b5-3ee4-aaa2-540d5a173658} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{c48635ad-d6b5-3ee4-aaa2-540d5a173658} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f5be27.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Worm.Kolab) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Worm.Kolab) -> Data: system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.



And this is the SuperSpyware scan log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/19/2009 at 04:51 PM

Application Version : 4.30.1004

Core Rules Database Version : 4293
Trace Rules Database Version: 2164

Scan type : Complete Scan
Total Scan Time : 00:39:35

Memory items scanned : 227
Memory threats detected : 0
Registry items scanned : 4910
Registry threats detected : 0
File items scanned : 14040
File threats detected : 43

Trojan.Agent/Gen-Nullo[Short]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000421.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000411.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000412.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000413.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000414.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000415.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000416.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000417.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000418.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000419.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000420.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000439.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000422.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000423.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000424.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000425.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000426.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000427.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000428.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000429.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000430.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000431.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000432.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000433.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000434.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000435.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000436.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000437.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000438.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000440.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000441.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000445.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000448.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000449.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000450.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000451.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000452.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000453.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP3\A0000454.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP4\A0002602.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP4\A0002608.EXE

Adware.Vundo/Variant-[Fixed]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{152FA10E-7AE6-4800-98A2-77D4CC3509F1}\RP4\A0002601.DLL

Adware.Vundo/Variant
C:\WINDOWS\SYSTEM32\LELIZOMO.DLL


And today...I think I just got a new virus also. It appears on my toolbar lower right corner as a red balloon with a white X on it saying my computer is not secured, please click on this balloon to secure my computer or something like that. Its name is window security alert. Is that a new virus I got or is it something legitimate.

Also after all these steps I did, my yahoo search link still directs me to other unwanted websites

Thank you so much for your help!

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 19 November 2009 - 08:09 PM

Hello, what is your installed antivirus?

These are stubborn malware so now run part 1 of S!Ri's SmitfraudFix .
Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 23 November 2009 - 03:08 PM

Thank you boopme


I have Norton antivirus 2009


this is the Smitfraud log

SmitFraudFix v2.424

Scan done at 14:12:44.21, Mon 11/23/2009
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Vpskeys\VPSKEYS.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\system32\cmd.exe

hosts


C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\Documents and Settings\Owner


C:\DOCUME~1\Owner\LOCALS~1\Temp


C:\Documents and Settings\Owner\Application Data


Start Menu


C:\DOCUME~1\Owner\FAVORI~1


Desktop


C:\Program Files


Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001


Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\sdra64.exe,"

RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




DNS

Description: Intel® PRO/100 VE Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 192.168.2.1

Description: Intel® PRO/100 VE Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 209.18.47.61
DNS Server Search Order: 209.18.47.62

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3469EA9F-9DCA-4815-BF91-C6ACDA1A5ACA}: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6220B7A0-445D-4501-832A-12A66FE9E4A0}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3469EA9F-9DCA-4815-BF91-C6ACDA1A5ACA}: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6220B7A0-445D-4501-832A-12A66FE9E4A0}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3469EA9F-9DCA-4815-BF91-C6ACDA1A5ACA}: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6220B7A0-445D-4501-832A-12A66FE9E4A0}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=209.18.47.61 209.18.47.62


Scanning for wininet.dll infection


End



this is the MBAM log

Scan type: Quick Scan
Objects scanned: 102661
Time elapsed: 4 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0060d0f (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



my computer seems to stop directing me to other websites but that red balloon window security alert is still there...I haven't clicked on it yet though it still prompts me to click on it.

Thanks again boopme

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 23 November 2009 - 03:18 PM

Ok, yes still something in the smitFraud log. Run the cleaner ,part 2

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, double-click SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply .
The report can also be found at the root of the system drive, usually at C:\rapport.txt
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 23 November 2009 - 04:39 PM

Thank you boopme


this is the log



Scan done at 16:28:04.60, Mon 11/23/2009
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
...

VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files


IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


RK


DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3469EA9F-9DCA-4815-BF91-C6ACDA1A5ACA}: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6220B7A0-445D-4501-832A-12A66FE9E4A0}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3469EA9F-9DCA-4815-BF91-C6ACDA1A5ACA}: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6220B7A0-445D-4501-832A-12A66FE9E4A0}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3469EA9F-9DCA-4815-BF91-C6ACDA1A5ACA}: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6220B7A0-445D-4501-832A-12A66FE9E4A0}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=209.18.47.61 209.18.47.62
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=209.18.47.61 209.18.47.62


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


RK.2



Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

#8 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 23 November 2009 - 09:24 PM

hi boopme.

I posted the scan log above. I just want you to see it

I am not directed to any other websites anymore. My task manager is back too.

Thanks. I think I am good. But I am not sure. Please tell me what to do next. But I think my computer is much better now.

Thank you so much boopme.

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 23 November 2009 - 09:26 PM

Hi OK please run one more scan. A double check. Let me know if things are still good. We look good here.

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

Edited by boopme, 23 November 2009 - 09:27 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 24 November 2009 - 12:01 AM

Thanks boopme

this is the scan log ESET

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\53\47519035-2a39f248 Java/TrojanDownloader.OpenStream.NAC trojan


Thank you again.

#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 24 November 2009 - 12:18 AM

Hello you have a Java exploit.
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 17.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Rerun ESET...thanks.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#12 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 24 November 2009 - 04:09 PM

Thanks boopme

I am not even sure if I did it right. I did follow instruction though.

This is the MBam scan log

Malwarebytes' Anti-Malware 1.41
Database version: 3224
Windows 5.1.2600 Service Pack 3

11/24/2009 2:53:01 PM
mbam-log-2009-11-24 (14-53-01).txt

Scan type: Quick Scan
Objects scanned: 112798
Time elapsed: 5 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


and this is the ESET scan log

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\53\47519035-2a39f248 Java/TrojanDownloader.OpenStream.NAC trojan

What must I do to get this thing off.

Does it look like I got the other things off my computer though?

Thanks again boopme

Edited by sfdmoment, 24 November 2009 - 04:09 PM.


#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 24 November 2009 - 08:53 PM

Hello after thoroughly reviewing this file we need some special tools to remove this virus. Deleting it manually is dangerous.
You will need to run HJT/DDS. If you can not performa step move to the next.
Please follow this guide. Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log.

Let me know if it went OK.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#14 sfdmoment

sfdmoment
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:05 AM

Posted 24 November 2009 - 08:57 PM

thanks boopme

are you going to be replying in that topic or is it someone else?

#15 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:05 AM

Posted 25 November 2009 - 12:11 AM

No someone we have trained specially with the tools will.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users