Jump to content

jeffce

Trusted Malware Techs
  • Content Count

    253
  • Joined

  • Last visited

Posts posted by jeffce


  1. Hi yoyocool2,

     

    Did you uninstall one of the antivirus programs? If so which one because they are still showing in the ComboFix log.

    -----------

     

     

    Disable Spybot S-D Tea Timer

     

    TeaTimer needs to be disabled so that its protection does not interfere with fixes.

     

    TeaTimer can be re-enabled once the computer is clean. :)

     

    1. Open Spybot-S&D in Advanced Mode.

    2. If it is not already set to do this go to the "Mode" menu and select "Advanced Mode".

    3. On the left hand side, click on "Tools".

    4. Then click on the Resident Icon in the List.

    5. Uncheck "Resident TeaTimer" and OK any prompts.

    6. Restart your computer.

    ----------

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      DDS::
      uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
      mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
      BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
      BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
      TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
      BHO-X64:		 WormRadar.com IESiteBlocker.NavFilter - No File
      BHO-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
      BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
      TB-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
      
      Registry::
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
      "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"=-
      
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

       

      Posted Image

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

    ----------


  2. Hi,

     

    That was just what I needed. :)

    -----------

     

     

    Please download OTM by OldTimer.

    • Save it to your desktop.
    • Please click OTM and then click >> run.
    • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    :Processes
    explorer.exe
    
    :Files
    c:\windows\system32\aclperf.dll
    c:\windows\system32\bootdlg.dll
    c:\windows\system32\iasmgr10.dll
    
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]
    
    • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTM
    Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

  3. You are not complicating anything. :)

     

     

    Reboot Your System in Safe Mode

    • Restart the computer.
    • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
    • Use the arrow keys to select the Safe mode with Networking menu item
    • Press Enter.
    Once in Safe Mode please try to run ComboFix again. If you still have problems let me know.

  4. Hi,

     

    Let's try a different site. :)

     

     

    I need some information on some unidentified files. We will use VirScan Please submit these files for analysis

     

    To submit a file to VirScan, please click VirScan

     

    Press Browse and locate the following bolded file > once selected press Upload.

     

    c:\windows\system32\aclperf.dll

    c:\windows\system32\bootdlg.dll

    c:\windows\system32\iasmgr10.dll

     

     

    Once the scan is completed scroll to the bottom of the page and press Copy to Clipboard

     

    Post the results created into your next reply. :)

     

    Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.

    ----------


  5. Hi,

     

    I notice that you have both Lavasoft Ad-Watch Live! and AVG antiviruses running at the same time. Having more than one antivirus program running at the same time can seriously degrade the performance of your system. Please uninstall either Lavasoft Ad-Watch Live! or AVG (which ever you prefer) using either the provided uninstall feature that is part of the antivirus program or through Add/Remove Programs (for Vista and Win 7 users to go to Programs and Features in the Control Panel). As a rule of thumb one should run one firewall, one antivirus program in memory, and one antispyware utility in memory. It's fine to have other security tools available on an as-needed or on-demand basis, but when multiple tools simultaneously perform the same function, you're asking for trouble.

    ----------

     

     

    Download Combofix from either of the links below, and save it to your desktop.

    Link 1

    Link 2

     

    **Note: It is important that it is saved directly to your desktop**

     

    --------------------------------------------------------------------

     

    IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

     

    --------------------------------------------------------------------

     

    Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

    • When finished, it will produce a report for you.
    • Please post the C:\ComboFix.txt for further review.
    ----------

     

    In your next reply please post the log created by ComboFix. :)


  6. Hi hadleycat,

     

     

    I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

     

    To submit a file to virustotal, please click VirusTotal

     

    copy and paste the following into the upload a file box (one at a time if more than one file is listed)

     

    c:\windows\system32\aclperf.dll

    c:\windows\system32\bootdlg.dll

    c:\windows\system32\iasmgr10.dll

     

    scroll down a bit and click "send file", wait for the results and post them in your next reply.

     

    Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.

    ----------

     

     

    Please download SystemLook from one of the links below and save it to your Desktop.

    Download Mirror #1

    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:

      :dir
      C:\program files\ZOOM /s
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

    -----------

     

    In your next reply please post the information provided by Virus Total about the files you submitted and post the log created by SystemLook. :)


  7. Please read through these instructions to familarize yourself with what to expect when this tool runs

     

    Download ComboFix from one of these locations:

     

    Link 1

    Link 2

     

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

     

     

    Posted Image

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

     

    Posted Image

     

    Click on Yes, to continue scanning for malware.

     

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

     

    Notes:

     

    1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

    3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    ----------


  8. Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

    • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.

    • Please subscribe to this topic, if you haven't already.

    • The fixes are specific to your problem and should only be used for the issues on this machine.

    • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.

    • It's often worth reading through these instructions and printing them for ease of reference.

    • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.

    • Please reply to this thread. Do not start a new topic.
    IMPORTANT NOTE : Please do not delete anything unless instructed to.

    DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

    Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

     

    Vista and Windows 7 users:

    These tools MUST be run from the executable (.exe) every time you run them

    with Admin Rights (Right click, choose "Run as Administrator")

     

    Stay with this topic until I give you the all clean post.

    ----------

     

     

    Please download DDS from either of these links

     

    LINK 1

    LINK 2

     

    and save it to your desktop.

    • Disable any script blocking protection
    • Right-click and Run as Administrator dds to run the tool.
    • When done, two DDS.txt's will open.
    • Save both reports to your desktop.
    ---------------------------------------------------

    Please include the contents of the following in your next reply:

     

    DDS.txt

     

    Attach.txt

    ----------

     

     

    Please download aswMBR to your desktop.

    • Right click and Run as Administrator the aswMBR icon to run it.
    • Click the Scan button to start scan.
    • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
    Posted Image

    Click the image to enlarge it

    ----------

     

    In your next reply please post both logs created by DDS and the log made by aswMBR.exe. :)


  9. Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

    • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.

    • Please subscribe to this topic, if you haven't already.

    • The fixes are specific to your problem and should only be used for the issues on this machine.

    • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.

    • It's often worth reading through these instructions and printing them for ease of reference.

    • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.

    • Please reply to this thread. Do not start a new topic.
    IMPORTANT NOTE : Please do not delete anything unless instructed to.

    DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

    Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

     

    Vista and Windows 7 users:

    These tools MUST be run from the executable (.exe) every time you run them

    with Admin Rights (Right click, choose "Run as Administrator")

     

    Stay with this topic until I give you the all clean post.

    ----------

     

     

    GMER

     

    Download GMER Rootkit Scanner from here or here.

    • Extract the contents of the zipped file to desktop.
    • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
    • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.

       

      Posted Image

      Click the image to enlarge it

    • In the right panel, you will see several boxes that have been checked. Uncheck the following ...

      • IAT/EAT
      • Drives/Partition other than Systemdrive (typically C:\)
      • Show All (don't miss this one)
    • Then click the Scan button & wait for it to finish.
    • Once done click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
    • Save it where you can easily find it, such as your desktop, and attach it in your reply.
    **Caution**

    Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

    .

    ----------

     

    In your next reply please post the log created by GMER. :)


  10. Hi hadleycat,

     

    You did a fine job getting the ESET long to me. :) It looks like the ComboFix fix did not run correctly. Please do the following:

     

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      File::
      c:\windows\system32\aclperf.dll
      c:\windows\system32\bootdlg.dll
      c:\windows\system32\iasmgr10.dll
      C:\WINDOWS\system32\94081FA880FF6E4AE3F348A4B2317154\conf\templates\3482.zip
      C:\WINDOWS\system32\94081FA880FF6E4AE3F348A4B2317154\conf\templates\3483.zip
      C:\WINDOWS\system32\94081FA880FF6E4AE3F348A4B2317154\conf\templates\3484.zip
      C:\WINDOWS\system32\94081FA880FF6E4AE3F348A4B2317154\conf\templates\3485.rar
      C:\WINDOWS\system32\94081FA880FF6E4AE3F348A4B2317154\conf\templates\3486.rar
      
      DirLook::
      c:\program files\ZOOM
      
      
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

       

      Posted Image

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

    ----------


  11. Hi,

     

    Thank you. I'm sorry I took awhile to reply. I didn't see this this morning. I'm trying to respond as quickly as possible so I don't waste anyone's time.

    You aren't wasting my time at all. :)

    --------

     

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      File::
      
      c:\windows\system32\aclperf.dll
      
      c:\windows\system32\bootdlg.dll
      
      c:\windows\system32\iasmgr10.dll
      
      DirLook::
      
      c:\program files\ZOOM
      
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

       

      Posted Image

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

    ----------

     

     

    I see that you have Malwarebytes on your system. Please open Malwarebytes, update it and then run a Quick Scan. Please save the log that is created for your next reply.

    ----------

     

     

    ESET Online Scanner

    I'd like us to scan your machine with ESET Online Scan

     

    Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.

    Please don't go surfing while your resident protection is disabled!

    Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

     

     

    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.

      ESET OnlineScan

    • Click the Posted Image button.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

      • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the Posted Image icon on your desktop.
    • Check Posted Image
    • Click the Start button.
    • Accept any security warnings from your browser.
    • Check Posted Image
    • Make sure that the option "Remove found threats" is Unchecked
    • Push the Start button.
    • ESET will then download updates for itself, install itself, and begin

      scanning your computer. Please be patient as this can take some time.

    • When the scan completes, push Posted Image
    • Push Posted Image, and save the file to your desktop using a unique name, such as

      ESETScan. Include the contents of this report in your next reply.

    • Push the Back button.
    • Push Finish
    http://www.eset.com/onlinescan/

    ----------

     

    In your next reply please post the logs created by ComboFix, Malwarebytes and ESET online scanner. :)


  12. Hi,

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      DDS::
      uURLSearchHooks: H - No File
      BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
      TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
      TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
      TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
      TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
      {e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
      IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
      AppInit_DLLs: halres.dll
      
      File::
      c:\windows\system32\aaccache20.dll
      c:\windows\system32\aacprov.dll
      c:\windows\system32\acpclient.dll
      c:\windows\system32\atlsvc.dll
      c:\windows\system32\adtspl.dll
      c:\windows\system32\certutil.dll
      c:\windows\system32\cfgdlg.dll
      c:\windows\system32\commspl32.dll
      c:\windows\system32\comprov32.dll
      c:\windows\system32\crtstream.dll
      c:\windows\system32\cryptstream.dll
      c:\windows\system32\ctlrgwiz.dll
      c:\windows\system32\ieprxy.dll
      c:\windows\system32\imapicfg.dll
      c:\windows\system32\inetcache20.dll
      c:\windows\system32\mapidlg.dll
      c:\windows\system32\imapiinfo32.dll
      c:\windows\system32\mapistream.dll
      c:\windows\system32\mmcman.dll
      c:\windows\system32\netcache32.dll
      c:\windows\system32\odbcmon.dll
      c:\windows\system32\odbcsrv10.dll
      c:\windows\system32\prnman.dll
      c:\windows\system32\odbcrgwiz.dll
      c:\windows\system32\prnprf.dll
      c:\windows\system32\rasspl.dll
      c:\windows\system32\rpcpack.dll
      c:\windows\system32\rpcwiz.dll
      c:\windows\system32\srvnet.dll
      c:\windows\system32\w32queue.dll
      c:\windows\system32\syncpack32.dll
      c:\windows\system32\cryptres.dll
      c:\windows\system32\halres.dll
      c:\windows\system32\authres.dll
      c:\windows\system32\bcdapi.dll
      c:\windows\system32\drivers\rtwoadno.sys
      c:\windows\system32\drivers\qqnrwxmj.sys
      c:\windows\system32\drivers\mypyslaw.sys
      c:\windows\system32\drivers\llldxwoj.sys
      c:\windows\system32\drivers\lkdiflmt.sys
      c:\windows\system32\drivers\lhptwgkc.sys
      c:\windows\system32\drivers\ldutfuif.sys
      c:\windows\system32\drivers\kueazaew.sys
      c:\windows\system32\drivers\jhkomrnc.sys
      c:\windows\system32\drivers\iiwrrlvq.sys
      c:\windows\system32\drivers\grlxaazh.sys
      c:\windows\system32\drivers\gqyyceww.sys
      c:\windows\system32\drivers\epbpdrdb.sys
      c:\windows\system32\drivers\eovluipf.sys
      c:\windows\system32\drivers\dyiejrpu.sys
      c:\windows\system32\drivers\dlsobddj.sys
      c:\windows\system32\drivers\djrnsdvk.sys
      c:\windows\system32\drivers\dflmbagz.sys
      c:\windows\system32\drivers\dfdikjza.sys
      c:\windows\system32\drivers\dbhrlpbn.sys
      c:\windows\system32\drivers\czaacyhy.sys
      c:\windows\system32\drivers\cgweoqxu.sys
      c:\windows\system32\drivers\cfeztjyj.sys
      c:\windows\system32\drivers\cerhqgfd.sys
      c:\windows\system32\drivers\bwmubxqs.sys
      c:\windows\system32\drivers\bozhsczl.sys
      c:\windows\system32\drivers\beuiwanw.sys
      c:\windows\system32\drivers\atazazvi.sys
      c:\windows\system32\drivers\wjlusrep.sys
      c:\windows\system32\drivers\wwnmmgue.sys
      c:\windows\system32\drivers\tupbvijw.sys
      c:\windows\system32\drivers\gnamnqbd.sys
      c:\windows\system32\drivers\rjgmntsf.sys
      c:\windows\system32\drivers\tgbtrpnq.sys
      c:\windows\system32\drivers\hlcsgkmm.sys
      c:\windows\system32\drivers\ojolmhjl.sys
      c:\windows\system32\drivers\stirordi.sys
      c:\windows\system32\drivers\wlmmrjaj.sys
      c:\windows\system32\drivers\fgvakngk.sys
      c:\windows\system32\drivers\fqkxtuxf.sys
      c:\windows\system32\drivers\tofhvchu.sys
      c:\windows\system32\drivers\ugmhropw.sys
      c:\windows\system32\drivers\rqiwbvja.sys
      c:\windows\system32\drivers\adicnusb.sys
      
      Folder::
      c:\program files\Ask.com
      c:\documents and settings\owner\local settings\application data\AskToolbar
      
      RegLock::
      [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
      
      Driver::
      rtwoadno
      qqnrwxmj
      mypyslaw
      llldxwoj
      lkdiflmt
      lhptwgkc
      ldutfuif
      kueazaew
      jhkomrnc
      iiwrrlvq
      grlxaazh
      gqyyceww
      epbpdrdb
      eovluipf
      dyiejrpu
      dlsobddj
      djrnsdvk
      dflmbagz
      dfdikjza
      dbhrlpbn
      czaacyhy
      cgweoqxu
      cfeztjyj
      cerhqgfd
      bwmubxqs
      bozhsczl
      beuiwanw
      atazazvi
      
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

       

      Posted Image

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

    ----------


  13. Hi,

     

    Man! I wish I understood this stuff. lol....Thanks again.

    I wish I did too. LOL!! I'm just kidding. :D

    ----------

     

     

    Please read through these instructions to familarize yourself with what to expect when this tool runs

     

    Download ComboFix from one of these locations:

     

    Link 1

    Link 2

     

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

     

     

    Posted Image

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

     

    Posted Image

     

    Click on Yes, to continue scanning for malware.

     

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

     

    Notes:

     

    1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

    3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    ----------


  14. Hi hadleycat,

     

     

    Please download MBRCheck.exe to your desktop.

    • Be sure to disable your security programs
    • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
    • A window will open on your desktop
    • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
    • If nothing unusual is found just press Enter
    • A .txt file named MBRCheck_mm.dd.yy_hh.mm:filtered: should appear on your desktop.
    • Please post the contents of that file.

  15. Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

    • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.

    • Please subscribe to this topic, if you haven't already.

    • The fixes are specific to your problem and should only be used for the issues on this machine.

    • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.

    • It's often worth reading through these instructions and printing them for ease of reference.

    • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.

    • Please reply to this thread. Do not start a new topic.
    IMPORTANT NOTE : Please do not delete anything unless instructed to.

    DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

    Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

     

    Vista and Windows 7 users:

    These tools MUST be run from the executable (.exe) every time you run them

    with Admin Rights (Right click, choose "Run as Administrator")

     

    Stay with this topic until I give you the all clean post.

    ----------

     

     

    Please download DDS from one of the following links and save it to your desktop.

    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click DDS icon to run the tool (may take up to 3 minutes to run)
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    ---------------------------------------------------
    • Post the contents of the DDS.txt report in your next reply
    • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
    ----------

     

    Please download aswMBR to your desktop.

    • Double click the aswMBR icon to run it.

      Vista and Windows 7 users right click the icon and choose "Run as administrator".

    • Click the Scan button to start scan.
    • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
    Posted Image

    Click the image to enlarge it

    ----------

     

    In your next reply please post both of the logs created by DDS and the log created by aswMBR.exe. :)


  16. Hi Joe,

     

    I have looked over your malware logs and I don't see anything that is jumping out at me. I would suggest you post a new topic in the User to User Help forum here or you could also visit What the Tech, register for a free account there and post for help in the Windows forum found here. Whichever you choose be sure to copy/paste a link to this topic so that they can see what we have done.


  17. IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :D SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :D

     

    This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

    --------------

     

     

    The following will implement some cleanup procedures as well as reset System Restore points:

     

    Click Start > Run and copy/paste the following text into the Run box as shown and click OK.

    Combofix /Uninstall

    (Note: There is a space between the ..X and the /U that needs to be there.)

     

    Posted Image

    ----------

     

     

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.
    ----------

     

    Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

     

    Here are some tips to reduce the potential for spyware infection in the future:

     

    1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
    2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
    • Open Internet Explorer
    • Click on Tools > Internet Options
    • Press Security tab
    • Select Internet zone then place check next to Enable Protected Mode if not already done
    • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
    • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.
    3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

     

    4. Firewall

    Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:

    Online Armor Free

    Agnitum Outpost Firewall Free

     

    5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

     

    6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002

    Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

     

    7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

     

    8.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

     

    Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.


  18. Hi,

     

     

    Download TFC to your desktop

    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    Once you get this finished please let me know if the problems continue.
×
×
  • Create New...