Jump to content
IObit Forum
Top Free Driver Updater Tools Best 25 PC Optimization Software Best 22 Antimalware Best 22 Uninstaller Software IObit Coupons & Discount Offers PC Optimizer Mac Boost Advice IObit Coupons A Good Utility Program From IObit IObit Promo Codes IObit Coupon Codes IObit Coupons and Deals FAQs Driver Booster Pro Review

your gonna luv this 1 )) sneaky-- help required [SOLVED]

Recommended Posts

Hello, im back after a week trying to sort this 1 out myself FAILED,



I was on another forum, (reputable), trying to help some1 else and got snagged, 3 downloads were sent Directly 2 MY DESKTOP, i was playing numerous online poker tables at the time, also all reputable, and have my browser (firefox uptodate) set to allways notify cookies, these 3 files marked as event logs, (since deleted = the wrong thing to do),popped in very quickly, but i opened them , spot the IDIOT, and boy oh boy there good.


I have tried system restore NO GOOD

Boot restore D drive factory settings NO GOOD


From what i worked out myself they create

multiple SIDs, which is creating memory leakage

input a proxy loop on 127 0 0 1

try to disable windows update and CTFMON, but updates are downloadable

hack the kernal entries on the router,

(this is currently being investigated by my ISP provider)

2 desktop.ini appeared



avast home free, including pre boot scan

IS360 free,


I picked this up as i regularly run the hijack log in 360 where an extra button on IE was picked up note i had dissabled IE so i wasnt to worried but i found another on my MS office activation assistant which i do not use, which is where i believe it got in. i also Daily check my event logs where i found special logons created


non standard programs installed/active at time of infection

poker- 32red pokerstars Fulltilt Bwin celebrity

belkin n wifi adapter

adobe silverlite acrobat cyberlink Nvidia Realtek AWC pro (birthday upgrade) IS360 Malwarebytes (on demand) blue screen view regeditor, MS Office


I have no critical files/programs on my PC so feel free to try anything u like .


NB THIS HAS ALSO BEEN tranferred to my partners PC running XP PRO,(Im W7 home premium) hence the request to my ISP her logs are INTACT please request any details hers was infected via MS Exell, NO DOWNLOAD FILES OPENED


Thanks in advance for your help,

logs attached,




Link to comment
Share on other sites

Hello and welcome to IOBit Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.


1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.

2. The fixes are specific to your problem and should only be used for this issue on this machine.

3. If you don't know or understand something, please don't hesitate to ask.

4. Please DO NOT run any other tools or scans while I am helping you.

5. It is important that you reply to this thread. Do not start a new topic.

6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

7. Absence of symptoms does not mean that everything is clear.




If you already have SUPERAntiSpyware be sure to check for updates before scanning!


Download SuperAntispyware Free Edition (SAS)

* Double-click the icon on your desktop to run the installer.

* When asked to Update the program definitions, click Yes

* If you encounter any problems while downloading the updates, manually download and unzip them from here

* Next click the Preferences button.


•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts

* Click the Scanning Control tab.

* Under Scanner Options make sure only the following are checked:


•Close browsers before scanning

•Scan for tracking cookies

•Terminate memory threats before quarantining

Please leave the others unchecked


•Click the Close button to leave the control center screen.


* On the main screen click Scan your computer

* On the left check the box for the drive you are scanning.

* On the right choose Perform Complete Scan

* Click Next to start the scan. Please be patient while it scans your computer.

* After the scan is complete a summary box will appear. Click OK

* Make sure everything in the white box has a check next to it, then click Next

* It will quarantine what it found and if it asks if you want to reboot, click Yes


•To retrieve the removal information please do the following:

•After reboot, double-click the SUPERAntiSpyware icon on your desktop.

•Click Preferences. Click the Statistics/Logs tab.


•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.


•It will open in your default text editor (preferably Notepad).

•Save the notepad file to your desktop by clicking (in notepad) File > Save As...


* Save the log somewhere you can easily find it. (normally the desktop)

* Click close and close again to exit the program.

*Copy and Paste the log in your post.




Please download Malwarebytes Anti-Malware from here.


Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

Extra Note:


If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.




Please download: HiJackThis to your Desktop.

  • Double Click the HijackThis icon, located on your Desktop.
  • By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
  • Accept the license agreement.
  • Click the Open the Misc Tools section button.
  • Place a checkmark beside Calculate MD5 of files if possible. Then, click Back.
  • Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
  • Please post the log in your next reply.

Link to comment
Share on other sites

hijack/spyware logs


Hello Dave,


Roy here

attached are the 3 logs, malwarebytes is a few days old but no infections found i will rerun it if you think its necessary, see comment in 1st post

please note firefox had Adbloc+ enabled during infection and script was allowed because my homepage (BBC) uses it.


im off to bed now its 2.30am speak to u later


Thanks for your help much appreciated

Sas Log - 06-28-2010 - 01-24-54.txt

mbam-log-2010-06-24 (20-01-38).txt


Link to comment
Share on other sites

Open HijackThis and select Do a system scan only


Place a check mark next to the following entries: (if there)


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O9 - Extra button: eBay.co.uk - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/710-72741-17534-1/4 (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: eBay.co.uk - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/710-72741-17534-1/4 (file missing) (HKCU)


Important: Close all open windows except for HijackThis and then click Fix checked.


Once completed, exit HijackThis.




Download Security Check by screen317 from one of the following links and save it to your desktop.


Link 1

Link 2


* Unzip SecurityCheck.zip and a folder named Security Check should appear.

* Open the Security Check folder and double-click Security Check.bat

* Follow the on-screen instructions inside of the black box.

* A Notepad document should open automatically called checkup.txt

* Post the contents of that document in your next reply.


Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.




Download OTL to your Desktop

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in
    %systemroot%\*. /mp /s
    c:\$recycle.bin\*.* /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time

Link to comment
Share on other sites

info and logs


Hi Dave,

Ran HJT but it came back with an error in regard to Ebay, however FYI this was original bloatware i deleted the file and i suspect when i ran registry fix in AWC it would have been reported, and i would have fixed/checked it.

The 2 other logs are attached. The OTL text file is 148KB would you like me to zip it and send it to you that way






Link to comment
Share on other sites

I hate file attachments. Is there any way you can copy and paste it even if it means more than on post?


Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.


link # 1

Link # 2


Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.


Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.


Right-click combofix.exe and select Run as Administrator and follow the prompts.

When finished, ComboFix will produce a log for you.

Post the ComboFix log and a new HijackThis log in your next reply.


NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.


Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

Link to comment
Share on other sites

split logs


Hi dave, worst typist secretary in the world here

i have split the logs as follows I hope


otltxt PRC/mod/otl

otltxttxt srv

otl2 drv

otl3 ie/ff/hosts/netservices

otl4 safeboot/activeX/drvs32

otl5 created last 90

otl6 modified/no comp name

otl7 lop/purity/custom scan TO BEEP

otlcontrol CNG to end




if you think ive missed something ill rerun it again and check it


Combofix reort to follow






Link to comment
Share on other sites

That's not what I meant. I want to see the logs copied and pasted directly in your reply. Please try it see if it works. When the log is saved in Notepad just put your cursor anywhere in the document, do a CTRL + A to select all, CTRL + C to copy. When you start your reply just do a CTRL+ V to paste it in your reply.

Link to comment
Share on other sites

Download Security Check by screen317 from one of the following links and save it to your desktop.


Link 1

Link 2


* Unzip SecurityCheck.zip and a folder named Security Check should appear.

* Open the Security Check folder and double-click Security Check.bat

* Follow the on-screen instructions inside of the black box.

* A Notepad document should open automatically called checkup.txt

* Post the contents of that document in your next reply.


Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.




ESET Online Scan


Scan your computer with the ESET FREE Online Virus Scan


* Click the ESET Online Scanner button.


* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop

* Double click on the esetsmartinstaller_enu.exe icon on your desktop.

* Place a check mark next to YES, I accept the Terms of Use.


* Click the Start button.

* Accept any security warnings from your browser.

* Leave the check mark next to Remove found threats and place a check next to Scan archives.

* Click the Start button.

* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.

* When the scan completes, click List of found threats.

* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.

* Click the Back button then click Finish.


In your next reply please include the ESET Online Scan Log

Link to comment
Share on other sites

That looks good. If there are no other issues, it's time for some clean-up.


* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.

* Now type Combofix /uninstall in the runbox

* Make sure there's a space between Combofix and /Uninstall

* Then hit Enter


* The above procedure will:

* Delete the following:

* ComboFix and its associated files and folders.

* Reset the clock settings.

* Hide file extensions, if required.

* Hide System/Hidden files, if required.

* Set a new, clean Restore Point.




Download OTC by OldTimer and save it to your desktop.


1. Double-click OTC to run it.

2. Click the CleanUp! button.

3. Select Yes when the "Begin cleanup Process?" prompt appears.

4. If you are prompted to Reboot during the cleanup, select Yes

5. OTC should delete itself once it finishes, if not delete it yourself.




Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.


Double-click TFC.exe to run it.


Note: If you are running on Vista, right-click on the file and choose Run As Administrator


TFC will close all programs when run, so make sure you have saved all your work before you begin.


* Click the Start button to begin the cleaning process.

* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.

* Please let TFC run uninterrupted until it is finished.


Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.




Looking over your log it seems you don't have any evidence of a third party firewall.


Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.


Remember only install ONE firewall


1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)

2) Online Armor

3) Agnitum Outpost

4) PC Tools Firewall Plus


If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.




Use the Secunia Software Inspector to check for out of date software.


•Click Start Now


•Check the box next to Enable thorough system inspection.


•Click Start


•Allow the scan to finish and scroll down to see if any updates are needed.

•Update anything listed.




Go to Microsoft Windows Update and get all critical updates.




I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.


SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.

* Using SpywareBlaster to protect your computer from Spyware and Malware

* If you don't know what ActiveX controls are, see here


Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ


Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.


Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.

Safe Surfing!

Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...