[Resolved] Trying to remove Malware Defender

This night I got the the Malware Defense installed on my computer. Since then I'm not able to access any of the antivirus removal sites nor updating my Malwarebytes. Anyway, I ran the Malwarebytes and was able to detect a couple of threats and delete them, but I'm still not able to update the program nor accessing the sites to download some sort of antivirus program. Please help me! PS. I attach the Malwarebytes log. NR 1. ——– Malwarebytes' Anti-Malware 1.43 Databasversion: 3458 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 2009-12-31 02:34:08 mbam-log-2009-12-31 (02-34-08).txt Skanningstyp: Snabb skanning Antal skannade objekt: 103640 Förfluten tid: 1 minute(s), 51 second(s) Infekterade minnesprocesser: 0 Infekterade minnesmoduler: 0 Infekterade registernycklar: 2 Infekterade registervärden: 2 Infekterade registerdataposter: 1 Infekterade mappar: 1 Infekterade filer: 4 Infekterade minnesprocesser: (Inga illasinnade poster hittades) Infekterade minnesmoduler: (Inga illasinnade poster hittades) Infekterade registernycklar: HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully. Infekterade registervärden: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\settdebugx.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\malware defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. Infekterade registerdataposter: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. Infekterade mappar: C:\Program\malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. Infekterade filer: C:\Documents and Settings\Sebastian\Lokala inställningar\Temp\settdebugx.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\Sebastian\Lokala inställningar\Temp\Installer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Sebastian\Lokala inställningar\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\krl32mainweq.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully. NR 2. (After reboot) —————————– Malwarebytes' Anti-Malware 1.43 Databasversion: 3458 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 2009-12-31 02:40:53 mbam-log-2009-12-31 (02-40-53).txt Skanningstyp: Snabb skanning Antal skannade objekt: 103644 Förfluten tid: 3 minute(s), 0 second(s) Infekterade minnesprocesser: 0 Infekterade minnesmoduler: 0 Infekterade registernycklar: 1 Infekterade registervärden: 0 Infekterade registerdataposter: 0 Infekterade mappar: 0 Infekterade filer: 6 Infekterade minnesprocesser: (Inga illasinnade poster hittades) Infekterade minnesmoduler: (Inga illasinnade poster hittades) Infekterade registernycklar: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\h8srtd.sys (Rootkit.TDSS) -> Quarantined and deleted successfully. Infekterade registervärden: (Inga illasinnade poster hittades) Infekterade registerdataposter: (Inga illasinnade poster hittades) Infekterade mappar: (Inga illasinnade poster hittades) Infekterade filer: C:\WINDOWS\system32\drivers\H8SRTwostiqlamt.sys (Malware.Packer) -> Quarantined and deleted successfully. C:\WINDOWS\system32\H8SRTbesrumeyxx.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\H8SRTjxvamqhood.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\H8SRTlphwhwdaiq.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\H8SRTrsipxotewx.dat (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\Documents and Settings\Sebastian\Lokala inställningar\Temp\H8SRT74cd.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

Hi Sespazmian, welcome to the forum.

To make cleaning this machine easier

• Please do not uninstall/install any programs unless asked to
  It is more difficult when files/programs are appearing in/disappearing from the logs.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
• Do not attach any logs/reports, etc.. unless specifically requested to do so.
• If you have problems with or do not understand the instructions, Please ask before continuing.
• Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Download OTL to your desktop.

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scans/Fixes box at the bottom, paste in the following text from the code box
• Do Not copy the word CODE
• please note the fix starts with the :

:Commands
[CREATERESTOREPOINT]
[emptytemp]
[resethosts]
[Reboot]

Next

Please read through the instructions to familarize youself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it is even started to download


Please download ComboFix from Link 1
Link 2
to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  -Tools->Options->Main tab
  -Set to "Always ask me where to Save the files".
  
• During the download, before you save it to your desktop, rename Combofix to jgh.exe

• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

———————————————————–

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  ———————————————————–

• Double click on ComboFix.exe (jgh.exe in your case) & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

• combofix log

How is the computer?

Thanks

Hi, thank ytou! I'm now done with the OTL and Combofix. Everything's good, except I can't visit any antivirus-websites (avast, avg, norton etc.). Here is the ComboFix log: 📎ComboFix.txt

Hi Sespazmian,

We will be using Combofix again but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/Trying_remove_Malware_Defender_t109203.html
 
Collect::
c:\windows\system32\izsmej.dll

NetSvc::
jjodsgbj

Driver::
jjodsgbj

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

Next

Open windows explorer (right click the start button and click explore), navigate to this folder C:\Qoobox

• click on it
• in the right hand panel please locate this file Add-Remove programs.txt
• please post it's contents

Please post back with

• combofix log
• Add-Remove programs.txt

How's the computer? Can you now reach antivirus sites?

Thanks

Hi, I Attach the CF log and the Add-Remove programs. Everything seems to work now! What was the problem if I may ask? Thank you so much for your help! Is there any possibilities to make donations?

Hi

You had a variant of this. It can block security tools. Along with this one S2 jjodsgbj;Manager Time; which would appear to be a worm. It was blocking the AV sites.

Is there any possibilities to make donations?

Yes there is. Either click the Donation link in the upper left corner of the page or the link in my signature.

µTorrent
You have µTorrent, a P2P/file sharing program installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it. It's not the programs themselves that are the problem but what can be downloaded with them, usually from an unknown source.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

We need to manualy submit a file.

Please visit this site and follow the instructions for uploading the file.

In the top box please copy and paste the following bold text

http://forums.whatthetech.com/Trying_remove_Malware_Defender_t109203.html&pid=621403#entry621403

Use the browse button to navigate to the following file

C:\Qoobox\Quarantine\[4]-[removed]
The x's represent time and date. Yours' will be similar to Submit_2010-03@00:25.zip

Leave the bottom box blank.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
• Click Check for Updates
• If an update is found, it will download and install the latest version.
• The program will close to update and reopen.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Your java is out of date. Click your start button, open Control panel.

• Locate the Java icon (it looks like a coffee cup)
• double click it to open it
• click the Update tab
• Click update now

After the java is updated, reboot your computer if not prompted to.

Next, clear the java cache

To clear the Java Plug-in cache:

• Click Start > Control Panel.
• Double-click the Java icon in the control panel.
• On the General tab, Click Settings under Temporary Internet Files.
• On the Temporary Files Settings screen, Click Delete Files.
• check all boxes
• Click OK

Next

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.

Please post back with

• MBAM log
• OTL.txt

Thanks

Hi, Here are the mbam and otl logs.

Hi Sespazmian,

One more scan to check for anything that may remain.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions.
• You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
  
  • Spyware, Adware, Dialers, and other potentially dangerous programs
  • Archives
  • Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Change the Files of type to Text file (.txt)
• Set the Save In to Desktop
• click the Save button.
• Please post this log in your next reply.

Thanks

Hi Sespazmian, Still with us?

I'm still here! I attach the log from Kaspersky, it seems to be a quarantined worm.

Hi Sespazmian,


The Kaspersky detection was a file we have quaratined. It will be removed when we clean up the tools.

In order for use to clean up the tools properly it is important that combofix (jgh.exe) be directly on your desktop. It looks like it is in a folder.

c:\documents and settings\Sebastian\Mina dokument\Hämtade filer\jgh.exe

Please move it to your desktop. When you have done so, please post back and we will finish up.

Thanks

It is done! Thank you

Hi Sespazmian,


If no other problems, we can clean up our tools.

From your desktop, please delete, if present

• any notepads/logs that we created

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /uninstall


Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep MBAM updated and use it regularly.


This is very important. I did not see an antivirus program installed on this computer, unless you have installed an antivirus program since the last time you posted a log. Without an antivirus program installed you will get reinfected in a short time. You can get a good free one from one of these vendors. Please chose one and install it.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. You have an antivirus program (hopefully you have one installed by now) and an on demand antispyware program.

For resident antispyware I suggest either

Windows Defender
OR
Winpatrol

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".



Take care

Everything seems to be fine now! I've installed AVG and SpywareBlaster since the last time. I would like to thank you very much for your help! /Sebastian

Hi Sespazmian, You are welcome, glad to be of assistance. Take care