[Resolved] Hijacked proxy port 7171 fixed; still pop-ups

Hi eppoclappo,

Any info on that folder I asked about?

C:\!kk

Yes you can use Kaspersky online. It has a good detection rate.

All except 2 detections are files we have all ready quarantined, which will be removed during the lean up process.

uTorrent
You seem to have been using a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it. The program itself is not bad, just what can be downloaded/uploaded with it.

Your infection may have been the result of using this type of program.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

Next, Double click on OTList2.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:OTLI
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)

:Files
F:\Emulator.AIO.Ultimate.Pack\Emulator.AIO.Ultimate.Pack.iso
C:\jdownloads\InvisibleSecrets462-CaeSar.zip

:Commands
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.

Please post back with

• info regarding folder
• OTLISTIT2 log

If there are no further problems we wil clean up the tools after you reply.

Thanks

Oops… it's very early n the morning here. I forgot to mention about the !kk folder. I created that one myself. It holds my press releases. Nothing strange going on in there. Just a couple of my own created docs. I am almost on my way to get to work. When I return home I'll take care of the OTLISTIT2 log. By the way, I mainly use uTorrent to download episodes of tv-series and documentaries that aren't aired in my country. I'll quarantine them from now on in a temp dir and run the online Kaspersky through it before I release the files from a zip or rar.

Hi eppoclappo, Sounds good!

========== OTLISTIT ========== Process Explorer.EXE killed successfully! ========== FILES ========== F:\Emulator.AIO.Ultimate.Pack\Emulator.AIO.Ultimate.Pack.iso moved successfully. C:\jdownloads\InvisibleSecrets462-CaeSar.zip moved successfully. ========== COMMANDS ========== File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\etilqs_wBk8SIoTIMPepnauD6B7 scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\Perflib_Perfdata_374.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF5331.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF872.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_19c.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\ZLT052a6.TMP scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.15.8 log created on 05222009_164402 Files moved on Reboot… File C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\etilqs_wBk8SIoTIMPepnauD6B7 not found! File C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\Perflib_Perfdata_374.dat not found! C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF5331.tmp moved successfully. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF872.tmp moved successfully. File C:\WINDOWS\temp\Perflib_Perfdata_19c.dat not found! C:\WINDOWS\temp\ZLT052a6.TMP moved successfully. Registry entries deleted on Reboot…

Hi eppoclappo,

Any problems? If not we can clean up the tools we used.

From your desktop, please delete

• any notepads/logs that we created
• Rooter.exe

In windows explorer, please delete this folder
c:\Rooter$

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /u



Open OTListIt2 then click the Clean Up button. You may get prompted by your firewall that OTListIt wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep MBAM updated and use it regularly.


Updates and upgrades

* If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the cirtical updates installed (Free) Microsoft Office Update


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. You have those all ready.

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879


We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".

Take care

Thanks a lot for your help. All is working smoothly again. Although I am not a newbie with computers, you certainly showed me dome great tools that I wasn't aware of and definitely use in the near future to keep things running save and sound. By the way, I hardly use Internet Explorer. Only in very rare moments that Firefox can't show what I expected. Thanks again!

Hi eppoclappo, You're welome. There are some places you need IE, so it may as well be as secure as poosible. Take care.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.