Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Newbie: Am I infected?


  • Please log in to reply
6 replies to this topic

#1 saithekiller2

saithekiller2

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:03 PM

Posted 22 October 2012 - 12:01 PM

Hi! Im new to this site. I want to ask if my computer is infected.

I downloaded a djvu reader file from softonic.com using Google Chrome. After that, I noticed that every time i open Google Chrome, my default browser is softonic.com. Aside from that, I keep getting random pop-ups from enterfactory.com.

My link

My only source of protection is Panda Antivirus but it seems that there were no detection of a virus, whatsoever.

I recently downloaded an anti-malware file, Malwarebytes, but still, the problem persists.

I am not sure what is happening. Anyone can enlighten me?

Thank you (in advance).

BC AdBot (Login to Remove)

 


#2 saithekiller2

saithekiller2
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:03 PM

Posted 22 October 2012 - 12:35 PM

Btw, I have already deleted the softonic program in my computer from the control panel. I also changed the homepage address but still, it does not work.

Here is my scan result last time:

Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.10.20.07

Protection: Enabled

10/22/2012 9:42:24 PM
mbam-log-2012-10-22 (21-42-24).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 295834
Time elapsed: 1 hour(s), 32 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKLM\SOFTWARE\Tuto4pc (PUP.Tuto4PC) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1 (PUP.Tuto4PC) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 5
C:\Users\becbec\AppData\Local\Temp\is-IPM2H.tmp\Tuto4pc\setup_tuto4pc_ph_softonic_agence.exe (Adware.Eorezo) -> Quarantined and deleted successfully.
C:\Windows\Crack\Crack.exe (Worm.VB) -> Quarantined and deleted successfully.
D:\instaler\New Windows 7 Activator [2010]\7Loader Release 5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\instaler\New Windows 7 Activator [2010]\RemoveWAT.exe (HackTool.Wpakill) -> Quarantined and deleted successfully.
D:\games\Games Gaan\astropop.deluxe.1.0.windows.setup.exe (Adware.TryMedia) -> Quarantined and deleted successfully.

(end)

#3 Nett0

Nett0

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 22 October 2012 - 12:49 PM

Scan with HijackThis. You might want to try HitmanPro too.
Malwarebytes is amazing, but I've had experience where HitmanPro finds more browser hijacks/adware than malwarebytes. I believe this is because HitmanPro is a more sensitive program.


I'd also run CCleaner to rid of any leftover reg entries from the malware if you were infected at all.

And scanning with TTDSKiller shouldn't hurt either.

Additional: Panda is a great anti-virus application. We resell it here at my company, but if you were ever interested in something more powerful.. look into G-Data. It is what we recommend to more heavy users.


Mod Edit: Removed recommendation to run HijackThis..Against forum rules
HJT should be run with supervision in the Malware Removal section.
http://www.bleepingcomputer.com/forums/topic182397.html

Edited by boopme, 22 October 2012 - 01:30 PM.


#4 Jean-Guy

Jean-Guy

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:03 AM

Posted 22 October 2012 - 01:09 PM

adwcleaner should do the trick

http://www.bleepingcomputer.com/download/adwcleaner/

#5 saithekiller2

saithekiller2
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:03 PM

Posted 22 October 2012 - 06:02 PM

adwcleaner should do the trick

http://www.bleepingcomputer.com/download/adwcleaner/


File Deleted : C:\user.js
Folder Deleted : C:\Program Files\Application Updater
Folder Deleted : C:\Program Files\BabylonToolbar
Folder Deleted : C:\Program Files\Common Files\spigot
Folder Deleted : C:\Program Files\Tuto4pc
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\Users\becbec\AppData\Local\Babylon
Folder Deleted : C:\Users\becbec\AppData\Local\Temp\BabylonToolbar
Folder Deleted : C:\Users\becbec\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\becbec\AppData\LocalLow\Search Settings
Folder Deleted : C:\Users\becbec\AppData\LocalLow\Softonic
Folder Deleted : C:\Users\becbec\AppData\Roaming\Babylon
Folder Deleted : C:\Users\becbec\AppData\Roaming\Tuto4pc

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKCU\Software\Search Settings
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKLM\Software\Application Updater
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\b
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Key Deleted : HKLM\Software\Search Settings
Key Deleted : HKLM\Software\Tutorials
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Tutorials]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=15&cc= --> hxxp://www.google.com

-\\ Google Chrome v22.0.1229.94

File : C:\Users\becbec\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.12] : urls_to_restore_on_startup = [ "hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=48&cc=" ]
Deleted [l.1443] : urls_to_restore_on_startup = [ "hxxp://search.softonic.com/MON00006/tb_v1?SearchSource=48&cc=" ]

*************************

AdwCleaner[R1].txt - [7898 octets] - [23/10/2012 06:48:21]
AdwCleaner[S1].txt - [7748 octets] - [23/10/2012 06:49:38]

#6 saithekiller2

saithekiller2
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:03 PM

Posted 22 October 2012 - 06:03 PM

Scan with HijackThis. You might want to try HitmanPro too.
Malwarebytes is amazing, but I've had experience where HitmanPro finds more browser hijacks/adware than malwarebytes. I believe this is because HitmanPro is a more sensitive program.


I'd also run CCleaner to rid of any leftover reg entries from the malware if you were infected at all.

And scanning with TTDSKiller shouldn't hurt either.

Additional: Panda is a great anti-virus application. We resell it here at my company, but if you were ever interested in something more powerful.. look into G-Data. It is what we recommend to more heavy users.


Mod Edit: Removed recommendation to run HijackThis..Against forum rules
HJT should be run with supervision in the Malware Removal section.
http://www.bleepingcomputer.com/forums/topic182397.html

I'll try g-data..thanks!

#7 saithekiller2

saithekiller2
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:03 PM

Posted 22 October 2012 - 06:06 PM

So far, there is no sign that softonic.com is my default search engine page. I will also try to monitor whether the enterfactory.com pop-ups still continue. Thank you guys! Such a great community. ^^,




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users