Please Help, Malware?

[popeye000]

Hi,

I have recently discovered some malware on my machine. There was a red dot with an exclamation mark in the system tray. When I open the webpages, occassionally a screen to some site (I can't remember what it is now) would pop up.

I have followed your instructions on what to do, with the software to install etc.

Hopefully, if I have done this correctly, I have attached the logs that are required. Could someone please help me.

Thanks in advance,
Andrew.

Edit: Forgot to mention, AVG Anti-Rootkit reported nothing.

 

[momok]

Hi popeye000 and welcome to techspot. =)

Good job with following the instructions.

However I noticed that your AVG log displays 'No Action Taken' for all the files detected.
I suggest you run AVG again and quarantine the files. Pictorial instructions HERE.

You may wish to copy and paste these instructions on notepad for easier reference later.

Boot into safe mode under your normal user name. See how HERE

Next turn on "Show all files and folders, including hidden and system". See how HERE

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

ShowLOMControl

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = guardian.cmutual.com.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.sbnsw.com.au; *.colonial.com.au; *.cmutual.com.au; localhost;<local>

O4 - HKLM\..\Run: [ShowLOMControl]

O4 - Global Startup: VPN Client.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O16 - DPF: {60046ED9-8E77-11D0-9B21-0080C79EFE90} (VanGrid.VanGridCtrl) - file://D:\DOCUME~1\fzqgb5\LOCALS~1\Temp\vangrid.cab
O16 - DPF: {BAF8BCAE-D9D1-11D0-9B21-0080C79EFE90} (VanTree.VanTreeCtrl) - file://D:\DOCUME~1\fzqgb5\LOCALS~1\Temp\vantree.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = apac.corp.eds.com
O17 - HKLM\Software\..\Telephony: DomainName = apac.corp.eds.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = apac.corp.eds.com

Close HJT.

Navigate in Windows Explorer and delete the following files and folders in bold.

C:\WINDOWS\system32\lcstijbf.exe

Reboot into normal mode and rehide your protected OS files.

Please visit this link http://virusscan.jotti.org/

Click the Browse... button and navigate to the following file:
C:\Program Files\Eds\EmfInv\emfinv.exe
Click Open

Please let me know the results.

Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as attachments into this thread.


Regards,
Your friendly momok =)

This thread is for the use of popeye000 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[popeye000]

Thanks for the quick repsonse Momok.

I have followed the new instructions you have given me, attached are the results for HJT, ComboFix and AVG Anitspyware logs. Also in the text file there is the results for the Virusscan.jotti page.

Also, originally, I think the AVG log I attached, it showed no action was taken because I think I saved the log before I clicked on the Proceed with suggested action button. I have done this again, but took the log after I processed the suggested actions.

The ShowLOMControl was not loaded as a service.

C:\Windows\system32\lcstijbf.exe <- I could not locate this file, I did a search in the Windows folder/subfolders.

Please let me know what is required to be done next.

Edit: Forgot to attach the logs. They are now attached.

 

[momok]

Hi,

Download the attached "Combofix-Do.txt" (from my attachment) and save it to the same folder as Combofix.
Drag the Combofix-Do.txt over on to Combofix.exe and release.

This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job. Attach the resultant log in your reply.


Regards,
Your friendly momok =)

This thread is for the use of popeye000only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[popeye000]

Hi Momok,

I have run the Combo fix with the ComboFix.txt file. Please find attached the resultant log.

Thanks.

 

[momok]

Hi,

Your logs look clean now.

Delete all files in AVG Antispyware Quarantine folder. (located in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Quarantine)

Turn off system restore (XP/ME only). Learn how to do that HERE.
This will remove all the remaining nasties from your old restore points.

After that turn system restore back on.
This would have created a new safe and clean restore point for your system.

Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
May I recommend you to read this article.
This can help to prevent future infections.

Should you have any further problems, please post in this thread.


Regards,
Your friendly momok =)

This thread is for the use of popeye000 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[popeye000]

Momok,

Thankyou for your help with this problem. It was greatly appreciated.

I was thinking of installing Firefox a while back, but I heard it uses a lot more memory (not sure if this is true or not). Now I wish I did and probably will be using it in the future.

Thankyou for your help once again and your advice.

Andrew.