also @ TechSpot: Windows 8 Release Preview leaked, Microsoft may raise OEM prices

TechSpot
Collaborate in the cloud with Office, Exchange, SharePoint, and Lync.
Microsoft Office 365. Pay-as-you-go starting at $8/user/month. Begin your free trial now.

[Solved] Can't get rid of redirect and proxy-changing virus

Discussion in 'Virus and Malware Removal' started by tjhooker2020, Nov 15, 2010.

Thread Status:
Not open for further replies.
Page 2 of 2

  1. tjhooker2020 Newcomer, in training

    Here is the OTL Log... continuing the last scans now.

    All processes killed
    ========== OTL ==========
    Prefs.js: "http://search.search-tab.com/?sid=10101058100&s=" removed from keyword.URL
    C:\Documents and Settings\Branson\Application Data\Mozilla\FireFox\Profiles\tm3l4f5r.default\user.js moved successfully.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\WINDOWS\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp deleted successfully.
    Unable to delete ADS C:\Program Files\Mozilla Firefox\Firefox.exe:SummaryInformation .
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\\DisableMonitoring deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Branson
    ->Temp folder emptied: 9279169 bytes
    ->Temporary Internet Files folder emptied: 248694 bytes
    ->Java cache emptied: 2027 bytes
    ->FireFox cache emptied: 48041187 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 2093 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 65536 bytes
    ->Temporary Internet Files folder emptied: 33222 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->Flash cache emptied: 0 bytes

    User: Sassy
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 439 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 55.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Branson
    ->Flash cache emptied: 0 bytes

    User: Default User

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    User: Sassy
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.3 log created on 11152010_223939

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
    tjhooker2020, Nov 16, 2010
    #21

  2. Broni Malware Annihilator

    OK................
    Broni, Nov 16, 2010
    #22

  3. tjhooker2020 Newcomer, in training

    Here is the Security Check log:

    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 3
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Disabled!
    McAfee SecurityCenter
    Antivirus up to date! (On Access scanning disabled!)
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 22
    Out of date Java installed!
    Adobe Flash Player 10.1.85.3
    Adobe Reader 9.4.0
    Mozilla Firefox (3.6.3) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    McAfee VIRUSS~1 mcshield.exe
    mcafee VIRUSS~1 mcvsshld.exe
    MediaMall MediaMallServer.exe
    MediaMall PlayOn.exe
    ````````````````````````````````
    DNS Vulnerability Check:
    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````
    tjhooker2020, Nov 16, 2010
    #23

  4. Broni Malware Annihilator

    Update Firefox to the current 3.6.12 version.
    Broni, Nov 16, 2010
    #24

  5. tjhooker2020 Newcomer, in training

    Okay,

    Firefox is updated and ESET comes back with:

    C:\Documents and Settings\Branson\My Documents\Downloads\unlocker1.8.7.exe a variant of Win32/Adware.ADON application
    C:\Qoobox\Quarantine\C\WINDOWS\system32\chkdinst.dll.vir a variant of Win32/Kryptik.HWX trojan


    TJ
    tjhooker2020, Nov 16, 2010
    #25

  6. Broni Malware Annihilator

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
    Broni, Nov 16, 2010
    #26

  7. tjhooker2020 Newcomer, in training

    Okay, ran OTL, moving on to the next steps. The OTL log is below. Is there anything I need to worry about from the two entries in the ESET log? Thanks!!

    **********************************

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Branson
    ->Temp folder emptied: 213953 bytes
    ->Temporary Internet Files folder emptied: 200286 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 64263306 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 1315 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 66016 bytes
    ->Temporary Internet Files folder emptied: 33595 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: Sassy
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 34939 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 62.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Branson
    ->Flash cache emptied: 0 bytes

    User: Default User

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    User: Sassy
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.17.3 log created on 11162010_145608

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
    tjhooker2020, Nov 16, 2010
    #27

  8. tjhooker2020 Newcomer, in training

    Well, so far so good!

    The proxy settings were restored to their original status and all the redirect and other problems seem to be gone. No viruses are showing up in scans either.

    Thanks so much for all your help Broni! Hopefully I'll never need it again! ;)

    Let me know if there's anything to worry about from the ESET log...

    Best!

    TJ
    tjhooker2020, Nov 16, 2010
    #28

  9. Broni Malware Annihilator

    Good news :)

    No. The first entry is in Unlocker installation file, the second one is Combofix quarantine folder, which was removed by OTL Cleanup process.

    Good luck and stay safe :)
    Broni, Nov 16, 2010
    #29

  10. tjhooker2020 Newcomer, in training

    thanks again!!

    TJ
    tjhooker2020, Nov 16, 2010
    #30

  11. Broni Malware Annihilator

    Sure thing :)
    Broni, Nov 16, 2010
    #31
Page 2 of 2
Thread Status:
Not open for further replies.