Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Definitely Infected


  • Please log in to reply
9 replies to this topic

#1 Mead

Mead

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:53 AM

Posted 20 January 2013 - 11:07 AM

Yo,

The computer was redirecting web pages to different advertisements. I unplugged the ethernet cord after updating mbam and ran a scan. It found 5 items:

Spoiler


I later discovered that the MSE real time protection service was unable to be found, because it was removed from the tray and said something about that while I tried running it manually.

The firewall was turned off, and I cannot access the settings for it, it gives an error:
"Due to an unidentified problem, Windows cannot display Windows Firewall settings."

It restarted on its own as I was discovering this. After restarting, MSE found two things: a trojan and a java exploit. I am still experiencing these symptoms.


Please help.

I am using windows xp sp2, 32 bit.

Edited by Mead, 20 January 2013 - 11:09 AM.


BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:53 AM

Posted 20 January 2013 - 11:08 AM

Download

TDSSkiller

Launch it.Click on change parameters-Select TDLFS file system

Click on "Scan".Please post the LOG report(log file should be in your C drive)

Do not change the default options on scan results

Download

aswMBR

Launch it, allow it to download latest Avast! virus definitions
Click the "Scan" button to start scan.After scan finishes,click on Save log

Post the log results here.If you get crashes in normal mode,run it in safemode with networking

Download

ESET online scanner

Install it

Click on START,it should download the virus definitions
When scan gets completed,click on LIST of found threats

Export the list to desktop,copy the contents of the text file in your reply

#3 Mead

Mead
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:53 AM

Posted 20 January 2013 - 05:53 PM

TDSS Killer

Spoiler



AswMBR

Spoiler



ESET online scanner found nothing and there is no list of found threats.

#4 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:53 AM

Posted 20 January 2013 - 07:06 PM

Run TDSSkiller again and select DELETE

09:39:17.0828 4012 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip


Download

Malwarebytes

Install,update and run a full scan

Click on Show results.Right click on the list ,select all and remove them.

Post the generated log here

Download

mini toolbox

Checkmark following boxes:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size
List restore points

Click Go and post the result.

Download

Farbar service scanner

Checkmark all the boxes

Click on "Scan".
Please copy and paste the log to your reply.

Download

adware cleaner

Launch it click on Delete

A log should be generated after scan ,post it here

Download

Junkware removal tool

For vista and windows 7 right click on the tool and select run as administrator

After scan gets completed,post the generated log here.


Download

http://www.bleepingcomputer.com/download/rkill/

Run it and after scan finishes,post the contents of RKILL log located on the desktop here


Download

Autoruns

Extract and launch autoruns.exe

Allow the scan to get finished

Now click on FILE-SAVE

Filename:Autoruns.txt
Save as :Text

Paste the contents of text here

#5 Mead

Mead
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:53 AM

Posted 20 January 2013 - 09:43 PM

TDSSKiller ran again according to the settings in your last post. I changed the action to "REMOVE" and selected "Continue".


I updated MBAM and ran it. Here is the log:
Spoiler


Here is the log for minitoolbox. Note that my computer was disconnected from the internet.

Spoiler


Then I ran farbar service scanner. Here is the log:

Spoiler


Adware cleaner:

Spoiler


Junkware removal tool:
Spoiler


RKill
Spoiler



Autoruns
Spoiler


#6 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:53 AM

Posted 20 January 2013 - 11:29 PM

Please run malwarebytes again and post the new log

Run the services repair tool

http://kb.eset.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe

Run Farbar service scanner again and post the new log

#7 Mead

Mead
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:53 AM

Posted 21 January 2013 - 12:07 PM

Sorry it took a while.

new mbam log:
Spoiler


Then I ran the services repair tool, and rebooted. After restarting, I ran the Farbar service scanner.

Spoiler



While running the FSS, a balloon window showed in the system tray saying the firewall was off, and I was able to turn it back on. Because there is no virus detected by MBAM, and the firewall is on, is the computer safe to use now?

#8 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:53 AM

Posted 21 January 2013 - 12:16 PM

Looks good

Remove temporary and junk files

Download

TFC

Launch it,it will close all running programs

click on START,it should ask for reboot.If TFC locks up the system,run it in safemode


Create a new restore point

Follow this guide to turn off and turn on your restore points

XP- http://support.microsoft.com/kb/310405

Vista & windows 7- http://windows.microsoft.com/en-US/windows7/Turn-System-Restore-on-or-off

Turn off your system restore-It deletes old infected restore points

Turn on system restore and create a new restore point

Update JAVA and Flash player

Uninstall old version of java from control panel-Add or remove programs.Download the latest version from here

http://java.com/en/

Update your flash player

Antivirus recommendations

Update your antivirus frequently.Two free antivirus that i would suggest are

Microsoft security essentials or Avast.You can select either one of them.

If you have a paid one,make sure to update it frequently.Do not use multiple security softwares.

Informative guides that could prevent you from being infected again

How did I get infected?

http://www.bleepingcomputer.com/forums/topic2520.html

Best Practices for Safe Computing - Prevention of Malware Infection

http://www.bleepingcomputer.com/forums/topic407147.html

Simple and easy ways to keep your computer safe and secure on the Internet

http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

Safe surfing :)

#9 Mead

Mead
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:53 AM

Posted 21 January 2013 - 12:45 PM

While running TFC, it did not prompt for a reboot, and restarted on its own. Is this normal?

Firefox seems to be running quite slowly. It's not an internet thing, the window loses and regains focus and the cursor becomes an hourglass. Is there anything I can do to fix this?

Thank you very much for all of your help!

#10 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:53 AM

Posted 21 January 2013 - 11:33 PM

Try this

Export your bookmarks from firefox

http://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer

After exporting it

Uninstall firefox

Makesure to checkmark Remove my personal data option

Reinstall firefox and import your bookmarks

Let me know if that helps.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users