your gonna luv this 1 )) sneaky-- help required [SOLVED]

[scrd01]

Hello, im back after a week trying to sort this 1 out myself FAILED,

Background

 

I was on another forum, (reputable), trying to help some1 else and got snagged, 3 downloads were sent Directly 2 MY DESKTOP, i was playing numerous online poker tables at the time, also all reputable, and have my browser (firefox uptodate) set to allways notify cookies, these 3 files marked as event logs, (since deleted = the wrong thing to do),popped in very quickly, but i opened them , spot the IDIOT, and boy oh boy there good.

 

I have tried system restore NO GOOD

Boot restore D drive factory settings NO GOOD

i

From what i worked out myself they create

multiple SIDs, which is creating memory leakage

input a proxy loop on 127 0 0 1

try to disable windows update and CTFMON, but updates are downloadable

hack the kernal entries on the router,

(this is currently being investigated by my ISP provider)

2 desktop.ini appeared

scans ALL CLEAN

malwarebytes

avast home free, including pre boot scan

IS360 free,

 

I picked this up as i regularly run the hijack log in 360 where an extra button on IE was picked up note i had dissabled IE so i wasnt to worried but i found another on my MS office activation assistant which i do not use, which is where i believe it got in. i also Daily check my event logs where i found special logons created

 

non standard programs installed/active at time of infection

poker- 32red pokerstars Fulltilt Bwin celebrity

belkin n wifi adapter

adobe silverlite acrobat cyberlink Nvidia Realtek AWC pro (birthday upgrade) IS360 Malwarebytes (on demand) blue screen view regeditor, MS Office

 

I have no critical files/programs on my PC so feel free to try anything u like .

 

NB THIS HAS ALSO BEEN tranferred to my partners PC running XP PRO,(Im W7 home premium) hence the request to my ISP her logs are INTACT please request any details hers was infected via MS Exell, NO DOWNLOAD FILES OPENED

 

Thanks in advance for your help,

logs attached,

 

ROY

Attach.txt

[scrd01]

dds split logs

 

File to large by 2

 

split logs down to 3m / 3m

DDS.txt

DDS - Copy.txt

[Superdave]

Hello and welcome to IOBit Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

 

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.

2. The fixes are specific to your problem and should only be used for this issue on this machine.

3. If you don't know or understand something, please don't hesitate to ask.

4. Please DO NOT run any other tools or scans while I am helping you.

5. It is important that you reply to this thread. Do not start a new topic.

6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

7. Absence of symptoms does not mean that everything is clear.

 

SUPERAntiSpyware

 

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

 

Download SuperAntispyware Free Edition (SAS)

* Double-click the icon on your desktop to run the installer.

* When asked to Update the program definitions, click Yes

* If you encounter any problems while downloading the updates, manually download and unzip them from here

* Next click the Preferences button.

 

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts

* Click the Scanning Control tab.

* Under Scanner Options make sure only the following are checked:

 

•Close browsers before scanning

•Scan for tracking cookies

•Terminate memory threats before quarantining

•Please leave the others unchecked

 

•Click the Close button to leave the control center screen.

 

* On the main screen click Scan your computer

* On the left check the box for the drive you are scanning.

* On the right choose Perform Complete Scan

* Click Next to start the scan. Please be patient while it scans your computer.

* After the scan is complete a summary box will appear. Click OK

* Make sure everything in the white box has a check next to it, then click Next

* It will quarantine what it found and if it asks if you want to reboot, click Yes

 

•To retrieve the removal information please do the following:

•After reboot, double-click the SUPERAntiSpyware icon on your desktop.

•Click Preferences. Click the Statistics/Logs tab.

 

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

 

•It will open in your default text editor (preferably Notepad).

•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

 

* Save the log somewhere you can easily find it. (normally the desktop)

* Click close and close again to exit the program.

*Copy and Paste the log in your post.

 

===================================

 

Please download Malwarebytes Anti-Malware from here.

 

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the entire report in your next reply.

Extra Note:

 

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

 

==================================

 

Please download: HiJackThis to your Desktop.

• Double Click the HijackThis icon, located on your Desktop.
  
• By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
  
• Accept the license agreement.
  
• Click the Open the Misc Tools section button.
  
• Place a checkmark beside Calculate MD5 of files if possible. Then, click Back.
  
• Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
  
• Please post the log in your next reply.

[scrd01]

hijack/spyware logs

 

Hello Dave,

 

Roy here

attached are the 3 logs, malwarebytes is a few days old but no infections found i will rerun it if you think its necessary, see comment in 1st post

please note firefox had Adbloc+ enabled during infection and script was allowed because my homepage (BBC) uses it.

 

im off to bed now its 2.30am speak to u later

 

Thanks for your help much appreciated

Sas Log - 06-28-2010 - 01-24-54.txt

mbam-log-2010-06-24 (20-01-38).txt

highjackthis.txt

[Superdave]

Open HijackThis and select Do a system scan only

 

Place a check mark next to the following entries: (if there)

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O9 - Extra button: eBay.co.uk - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/710-72741-17534-1/4 (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: eBay.co.uk - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/710-72741-17534-1/4 (file missing) (HKCU)

 

Important: Close all open windows except for HijackThis and then click Fix checked.

 

Once completed, exit HijackThis.

 

==================================

 

Download Security Check by screen317 from one of the following links and save it to your desktop.

 

Link 1

Link 2

 

* Unzip SecurityCheck.zip and a folder named Security Check should appear.

* Open the Security Check folder and double-click Security Check.bat

* Follow the on-screen instructions inside of the black box.

* A Notepad document should open automatically called checkup.txt

* Post the contents of that document in your next reply.

 

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

 

==================================

 

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
   
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  %SYSTEMDRIVE%\*.exe
  %systemroot%\*. /mp /s
  c:\$recycle.bin\*.* /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  nvstor32.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  explorer.exe
  svchost.exe
  userinit.exe
  qmgr.dll
  ws2_32.dll
  proquota.exe
  imm32.dll
  kernel32.dll
  ndis.sys
  autochk.exe
  spoolsv.exe
  xmlprov.dll
  ntmssvc.dll
  mswsock.dll
  Beep.SYS
  ntfs.sys
  termsrv.dll
  sfcfiles.dll
  st3shark.sys
  ahcix86.sys
  srsvc.dll
  nvrd32.sys
  /md5stop
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
    

[scrd01]

info and logs

 

Hi Dave,

Ran HJT but it came back with an error in regard to Ebay, however FYI this was original bloatware i deleted the file and i suspect when i ran registry fix in AWC it would have been reported, and i would have fixed/checked it.

The 2 other logs are attached. The OTL text file is 148KB would you like me to zip it and send it to you that way

 

cheers

Roy

checkup.txt

Extras.Txt

[Superdave]

I hate file attachments. Is there any way you can copy and paste it even if it means more than on post?

 

Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.

 

link # 1

Link # 2

 

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

 

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

 

Right-click combofix.exe and select Run as Administrator and follow the prompts.

When finished, ComboFix will produce a log for you.

Post the ComboFix log and a new HijackThis log in your next reply.

 

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

 

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

[scrd01]

split logs

 

Hi dave, worst typist secretary in the world here

i have split the logs as follows I hope

 

otltxt PRC/mod/otl

otltxttxt srv

otl2 drv

otl3 ie/ff/hosts/netservices

otl4 safeboot/activeX/drvs32

otl5 created last 90

otl6 modified/no comp name

otl7 lop/purity/custom scan TO BEEP

otlcontrol CNG to end

 

 

 

if you think ive missed something ill rerun it again and check it

 

Combofix reort to follow

OTL.Txt

OTL.Txt1.txt

otl3.txt

otl4.txt

otl5.txt

[scrd01]

more split files

 

Hi dave, five files max hence 2/3 replies also have to split a couple (thought the limit was 29 not 19 aaaaaaaaarg

[scrd01]

more logs

 

ho hum logs

otl2.txt

otl2a.txt

otl6.txt

otl6a.txt

[Superdave]

That's not what I meant. I want to see the logs copied and pasted directly in your reply. Please try it see if it works. When the log is saved in Notepad just put your cursor anywhere in the document, do a CTRL + A to select all, CTRL + C to copy. When you start your reply just do a CTRL+ V to paste it in your reply.

[scrd01]

more logs

 

ho hum more logs

otl7.txt

otlcontrol.txt

controlOTL.2Txt.txt

[scrd01]

still to big by 25K

 

 

[scrd01]

another go

 

 

[scrd01]

shows in box but does not transfer no error message

[Superdave]

Just hang tight. I'll get in touch with Adm. to see what's happening with this.

[enoskype]

Hi guys,

 

I have increased the size of txt file attachment to 50.0KB.

 

Cheers.

[scrd01]

combofix 2 log

 

combofix2 attached,HJT in next post, still will not accept OTL log 50K max

combofix2.txt

[scrd01]

hjt2

 

hjt2 log tally ho

hijackthis2.txt

[scrd01]

OTL log part

 

............

[enoskype]

Hi scrd01,

 

Change the extention of .txt to .lng and then you can attach 146.5 KB.

 

Then, Dave can open it with Notepad.

 

Cheers.

[scrd01]

otl log

 

here we go again

otltop.txt

otltopa.txt

otlmiddle.txt

otlbottom.txt

[Superdave]

Download Security Check by screen317 from one of the following links and save it to your desktop.

 

Link 1

Link 2

 

* Unzip SecurityCheck.zip and a folder named Security Check should appear.

* Open the Security Check folder and double-click Security Check.bat

* Follow the on-screen instructions inside of the black box.

* A Notepad document should open automatically called checkup.txt

* Post the contents of that document in your next reply.

 

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

 

===============================

 

ESET Online Scan

 

Scan your computer with the ESET FREE Online Virus Scan

 

* Click the ESET Online Scanner button.

 

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop

* Double click on the esetsmartinstaller_enu.exe icon on your desktop.

* Place a check mark next to YES, I accept the Terms of Use.

 

* Click the Start button.

* Accept any security warnings from your browser.

* Leave the check mark next to Remove found threats and place a check next to Scan archives.

* Click the Start button.

* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.

* When the scan completes, click List of found threats.

* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.

* Click the Back button then click Finish.

 

In your next reply please include the ESET Online Scan Log

[scrd01]

sc317/eset logs

 

Hi dave,

 

both run, 317 log attached,

Eset scanned 211210 files NO threats found,

 

The Ing file was deemed invalid file by upload manger

checkup2.txt2.txt

[Superdave]

That looks good. If there are no other issues, it's time for some clean-up.

 

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.

* Now type Combofix /uninstall in the runbox

* Make sure there's a space between Combofix and /Uninstall

* Then hit Enter

 

* The above procedure will:

* Delete the following:

* ComboFix and its associated files and folders.

* Reset the clock settings.

* Hide file extensions, if required.

* Hide System/Hidden files, if required.

* Set a new, clean Restore Point.

 

==============================

 

Download OTC by OldTimer and save it to your desktop.

 

1. Double-click OTC to run it.

2. Click the CleanUp! button.

3. Select Yes when the "Begin cleanup Process?" prompt appears.

4. If you are prompted to Reboot during the cleanup, select Yes

5. OTC should delete itself once it finishes, if not delete it yourself.

 

==============================

 

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

 

Double-click TFC.exe to run it.

 

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

 

TFC will close all programs when run, so make sure you have saved all your work before you begin.

 

* Click the Start button to begin the cleaning process.

* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.

* Please let TFC run uninterrupted until it is finished.

 

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

 

=================================

 

Looking over your log it seems you don't have any evidence of a third party firewall.

 

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

 

Remember only install ONE firewall

 

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)

2) Online Armor

3) Agnitum Outpost

4) PC Tools Firewall Plus

 

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

 

================================

 

Use the Secunia Software Inspector to check for out of date software.

 

•Click Start Now

 

•Check the box next to Enable thorough system inspection.

 

•Click Start

 

•Allow the scan to finish and scroll down to see if any updates are needed.

•Update anything listed.

.

----------

 

Go to Microsoft Windows Update and get all critical updates.

 

----------

 

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

 

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.

* Using SpywareBlaster to protect your computer from Spyware and Malware

* If you don't know what ActiveX controls are, see here

 

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

 

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

 

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.

Safe Surfing!