also @ TechSpot: Google, Samsung unveil Chromebook, Chromebox with Chrome OS 19

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Solved] Trojan horse Hider.OOW and AVG is white-listing the file

Discussion in 'Virus and Malware Removal' started by Mister Ed, Dec 22, 2011.

Page 2 of 2

  1. Mister Ed Newcomer, in training

    I should have explained better. The setting stays at Google ... but the message comes up whenever I open a new IE session. I changed the default and changed it back to Google ... same thing.

    Will work on the other items tomorrow evening ... close to bed time now. ;-)
    Mister Ed, Dec 28, 2011
    #21

  2. Mister Ed Newcomer, in training

    Broni -
    OLT will not run. I passte in the code you have (I have it all, double checked) I click on Run Fix and it starts up. The message at the bottom is 'killing all processes' ... but it stays just like that forever (I actually let it sit for over an hour). Also had 'Not Responding" in the title bar at the top of the OLT screen. I haad to power down the computer to get it to reboot.
    Mister Ed, Dec 29, 2011
    #22

  3. Broni Malware Annihilator

    Delete your OTL file, download new one, disable your AV program and try again.
    Broni, Dec 29, 2011
    #23

  4. Mister Ed Newcomer, in training

    Same result.
    Mister Ed, Dec 29, 2011
    #24

  5. Broni Malware Annihilator

    Run the fix from Safe Mode.
    Broni, Dec 29, 2011
    #25

  6. Mister Ed Newcomer, in training

    That worked
    All processes killed
    ========== OTL ==========
    Service PCToolsSSDMonitorSvc stopped successfully!
    Service PCToolsSSDMonitorSvc deleted successfully!
    Starting removal of ActiveX control {7530BFB8-7293-4D34-9923-61A11451AFC5}
    C:\WINDOWS\Downloaded Program Files\OnlineScanner.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\WINDOWS\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    C:\Documents and Settings\All Users\Application Data\iwsoqu7j4mhu4tjc5mlf2b630q1y moved successfully.
    C:\Documents and Settings\All Users\Application Data\304740a6t017u215p041i7jpv2k3 moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Administrator.ED-NXAIBJWWPXN5
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 1955 bytes
    ->Flash cache emptied: 568 bytes

    User: All Users

    User: Default User
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Ed
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 13829554 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 2461 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 119686 bytes
    ->Flash cache emptied: 43417 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 24075371 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 678888 bytes

    Total Files Cleaned = 37.00 mb


    [EMPTYFLASH]

    User: Administrator
    ->Flash cache emptied: 0 bytes

    User: Administrator.ED-NXAIBJWWPXN5
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User

    User: Ed
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 12292011_170035

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
    Will work on the others after dinner.
    Mister Ed, Dec 29, 2011
    #26

  7. Broni Malware Annihilator

    Cool.
    I think it's AVG playing games with you.
    Broni, Dec 29, 2011
    #27

  8. Mister Ed Newcomer, in training

    But AVG was uninstalled the second time.
    Anyway, here is Security check:
    Results of screen317's Security Check version 0.99.24
    Windows XP Service Pack 3 x86
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    AVG 2012
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    CCleaner
    Adobe Reader X (10.1.1)
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Malwarebytes' Anti-Malware mbamservice.exe
    ``````````End of Log````````````

    ESET is running now.
    I am getting a Java error when starting IE:
    'jusched.exe has encountered a problem and needs to close. We are sorry for the inconvenience.'
    Mister Ed, Dec 29, 2011
    #28

  9. Broni Malware Annihilator

    Broni, Dec 29, 2011
    #29

  10. Mister Ed Newcomer, in training

    No log or errors with the Eset scan.:)
    Mister Ed, Dec 29, 2011
    #30

  11. Broni Malware Annihilator

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
    Broni, Dec 29, 2011
    #31

  12. Mister Ed Newcomer, in training

    ll processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Administrator.ED-NXAIBJWWPXN5
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Ed
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 1017210 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 456 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 4583 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 1.00 mb


    [EMPTYFLASH]

    User: Administrator
    ->Flash cache emptied: 0 bytes

    User: Administrator.ED-NXAIBJWWPXN5
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User

    User: Ed
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.31.0 log created on 12292011_201055

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Ed\Local Settings\Temporary Internet Files\Content.IE5\8M4G01TG\adServer[1].htm moved successfully.
    C:\Documents and Settings\Ed\Local Settings\Temporary Internet Files\Content.IE5\02GU09V8\showthread[1].htm moved successfully.
    C:\Documents and Settings\Ed\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

    Registry entries deleted on Reboot...
    Mister Ed, Dec 29, 2011
    #32

  13. Broni Malware Annihilator

    Whenever ready....
    Broni, Dec 29, 2011
    #33

  14. Mister Ed Newcomer, in training

    Appears to be running Ok, maybe a little slow.

    I did have one warning in last nights AVG scan:
    C:\System Volume Information\_restore{F32A3879-B8DD-4E00-ABC9-14C9B2FD324E}\RP9\A0001047.exe;"Corrupted executable file";"Potentially dangerous object"

    Still have some program trying to change my default search provider ... have not figured that out yet.
    Mister Ed, Dec 30, 2011
    #34

  15. Broni Malware Annihilator

    That finding is in one of your restore points.

    Turn system restore off.
    Restart computer.
    Turn system restore on.
    Broni, Dec 30, 2011
    #35

  16. Mister Ed Newcomer, in training

    Got it, thanks for all your help!!!
    Mister Ed, Dec 30, 2011
    #36

  17. Broni Malware Annihilator

    You're very welcome [IMG]

    [IMG]
    Broni, Dec 30, 2011
    #37
Page 2 of 2