Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Digital Protection, MBAM will not install


  • This topic is locked This topic is locked
2 replies to this topic

#1 Illuminate88

Illuminate88

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:48 PM

Posted 22 April 2010 - 09:34 PM

I had complaints about the "family" computer after some relatives had come and gone. I found the Digital Protection shortcuts and crap on the desktop and I had virtually no power as a user. I couldn't open task manager, system restore, I couldn't uninstall programs or install programs, and I could not get AVG to run. I first rebooted the pc and went into safe mode (no networking). I logged into the administrator account and I was able to open the task manager but not system restore. I then opened AVG and to my surprise it was able to run a command line scan and it removed 52 infections. If requested I can post the log of this. At this time I used an alternate computer and went straight to Bleeping Computer where I found the instructions for removing the rogue anti-spyware program that is Digital Protection. This is where I hit a snag. I could not get MBAM to install in safe mode with or without networking. A window would pop-up asking me what program I wanted to use to open this filetype. This is the same reason I could not get a GMER log. In addition, the infected computer's internet was not functional enough where I could navigate to bleeping computer and download the requested programs, so I used my alternate pc to put all the instructed programs on a usb flash drive to transfer them to the infected pc's desktop.

Before I ran the AVG command line scan I did run Ccleaner to remove temporary files and to clean the registry.

DDS (Ver_10-03-17.01) - NTFSx86
Run by User at 21:11:22.07 on Thu 04/22/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.210 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv2.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.century.edu/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\documents and settings\user\application data\sdra64.exe,c:\windows\system32\sdra64.exe,
BHO: c:\windows\system32\xi3z27.dll: {a2ba40a0-74f1-52bd-f411-00b15a2c8953} - c:\windows\system32\xi3z27.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe"
uRun: [newupdate1142C.exe] c:\documents and settings\user\application data\060a7bc021faa39a101c936669e29bdb\newupdate1142C.exe
uRun: [mcexecwin] rundll32.exe c:\docume~1\user\locals~1\temp\g73cwsjw.dll, RestoreWindows
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194021486500
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
TCP: NameServer = 93.188.165.133,93.188.161.131
TCP: {964DB2D9-F855-465F-BE34-44084A3E71BE} = 93.188.165.133,93.188.161.131
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: c:\windows\system32\xi3z27.dll: {a2ba40a0-74f1-52bd-f411-00b15a2c8953} - c:\windows\system32\xi3z27.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\33ud2zob.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-20 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-10-20 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-20 108552]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-10-20 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-10-20 297752]
S3 sbuschk;sbuschk;c:\windows\system32\sbuschk.sys [2004-8-4 2304]

============== File Associations ===============

.exe=secfile

=============== Created Last 30 ================

2010-04-22 00:44:14 0 d-----w- c:\docume~1\alluse~1\applic~1\avG
2010-04-21 19:33:14 524 ----a-w- c:\docume~1\alluse~1\applic~1\fiosejgfse.dll
2010-04-21 18:55:51 0 d-----w- c:\program files\Digital Protection
2010-04-21 18:46:02 0 d-sh--w- c:\documents and settings\user\PrivacIE
2010-04-21 18:43:00 0 d-sh--w- c:\windows\system32\lowsec
2010-04-21 18:42:48 30000 ----a-w- c:\windows\system32\xi3z27.dll
2010-04-21 18:42:32 0 d-----w- c:\docume~1\user\applic~1\060A7BC021FAA39A101C936669E29BDB
2010-04-12 05:01:35 0 d-----w- c:\docume~1\alluse~1\applic~1\PopCap Games
2010-04-12 05:00:42 24 ----a-w- c:\windows\popcinfot.dat
2010-04-12 05:00:42 0 ----a-w- c:\windows\popcreg.dat
2010-04-12 05:00:41 0 d-----w- c:\program files\PopCap Games

==================== Find3M ====================

2010-02-01 00:28:56 103167 ----a-w- c:\windows\hpoins08.dat
2009-07-27 23:38:30 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009072720090728\index.dat

============= FINISH: 21:12:52.43 ===============

Attached Files


Edited by Illuminate88, 22 April 2010 - 10:20 PM.


BC AdBot (Login to Remove)

 


#2 Illuminate88

Illuminate88
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:48 PM

Posted 25 April 2010 - 10:46 AM

After receiving no help for 2 and half days, I hope that my problem "just fell through the cracks."

This thread, for the most part, can be ignored as I have been forced to reinstall windows on the infected machine; A solution I did not want to execute, because honestly I was looking forward to cleaning the machine with someone's guidance.

#3 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,074 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:09:48 PM

Posted 26 April 2010 - 03:54 PM

Due to the fact we are swamped with logs, the average waiting time is about 4 days. This does not mean your log was overlooked. In fact it was still in line, but since you seem to have resolved the problem, I am closing this topic.

If you need it reopened, please send me a PM.

Everyone else, please start a new topic.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users