[Resolved] Advanced Browser Hijack

Hi there,

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done two logs should open:
  
• DDS.txt
• Attach.txt

• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  [external image: Posted Image]
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and re-enable all active protection when done.

Hi jpshortstuff thanks for replying and sorry for taking so long to reply but I had problems with last gmer tool. Basically it would scan for 4 hours and each time I clicked save the PC would freeze and I could not save the file. I do however have the 2 files attach.txt and dds.txt S (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 22:26:09.39 on 17/02/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2039.1450 [GMT 0:00] AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\LogMeIn\x86\RaMaint.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\oodag.exe C:\WINDOWS\sYSteM32\SvchOst.eXE -k okogrp C:\Program Files\WinPcap\rpcapd.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\LogMeIn\x86\LogMeInSystray.exe C:\WINDOWS\system32\igfxpers.exe C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Ace Explorer\Aexplore.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Java\jre6\bin\java.exe C:\DOCUME~1\Pani\LOCALS~1\Temp\NV_Support_Participant_EN.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Pani\Desktop\Demosa Tools\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.ladbrokes.com/ BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: Internet Explorer Form-Fill Plug-In: {5425b4b8-87f9-4e9c-8b51-8aaba82eba64} - c:\program files\neteller app\plugins\ie\Neteller.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; GTB6.3; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.candystand.com/play/mixing-factory-pinball" mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui dRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe IE: {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - c:\microgaming\poker\ladbrokesmpp\MPPoker.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Notify: igfxcui - igfxdev.dll Notify: LMIinit - LMIinit.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-2-15 64288] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-8-24 162512] R1 oko6;oko6;c:\windows\system32\drivers\oko6.sys [2010-2-15 32768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-24 19024] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-21 40384] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1228208] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-8-24 47640] R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-29 32512] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-22 135664] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-21 40384] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-21 40384] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-12-14 9728] S4 LMIRfsClientNP;LMIRfsClientNP; [x] =============== Created Last 30 ================ 2010-02-16 18:59:43 0 d—–w- c:\program files\Trend Micro 2010-02-16 18:12:21 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-16 18:12:20 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-02-16 18:12:19 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-02-16 17:50:02 0 d—–w- c:\program files\Ace Explorer 2010-02-15 14:07:00 15880 —-a-w- c:\windows\system32\lsdelete.exe 2010-02-15 13:54:47 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys 2010-02-15 13:49:43 0 dc-h–w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-02-15 13:49:22 0 d—–w- c:\program files\Lavasoft 2010-02-15 10:18:53 32768 —-a-w- c:\windows\system32\drivers\oko6.sys 2010-02-15 10:18:53 102400 —-a-w- c:\windows\system32\oko6.dll 2010-01-28 19:36:26 0 d—–w- c:\docume~1\pani\applic~1\NETELLER app 2010-01-28 19:36:25 0 d—–w- c:\program files\NETELLER app 2010-01-22 21:22:13 0 d—–w- c:\program files\Spybot - Search & Destroy 2010-01-22 21:22:13 0 d—–w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2010-01-21 17:45:45 0 d—–w- c:\docume~1\alluse~1\applic~1\Alwil Software ==================== Find3M ==================== 2010-02-16 18:51:54 1868 —-a-w- c:\windows\system32\tmp.reg 2009-12-31 16:50:03 353792 —-a-w- c:\windows\system32\drivers\srv.sys 2009-12-21 19:14:05 916480 —-a-w- c:\windows\system32\wininet.dll 2009-12-17 17:14:00 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-12-16 18:43:27 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:08:23 33280 —-a-w- c:\windows\system32\csrsrv.dll 2009-12-08 19:26:15 2145280 —-a-w- c:\windows\system32\ntoskrnl.exe 2009-12-08 18:43:51 2023936 —-a-w- c:\windows\system32\ntkrnlpa.exe 2009-11-27 17:11:44 17920 —-a-w- c:\windows\system32\msyuv.dll 2009-11-27 17:11:44 1291776 ——w- c:\windows\system32\quartz.dll 2009-11-27 16:07:35 8704 —-a-w- c:\windows\system32\tsbyuv.dll 2009-11-27 16:07:35 28672 —-a-w- c:\windows\system32\msvidc32.dll 2009-11-27 16:07:34 84992 —-a-w- c:\windows\system32\avifil32.dll 2009-11-27 16:07:34 48128 —-a-w- c:\windows\system32\iyuv_32.dll 2009-11-27 16:07:34 11264 —-a-w- c:\windows\system32\msrle32.dll 2009-09-10 19:11:53 16384 –sha-w- c:\windows\temp\cookies\index.dat 2009-09-10 19:11:53 32768 –sha-w- c:\windows\temp\history\history.ie5\index.dat 2009-09-10 19:11:53 32768 –sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat ============= FINISH: 22:26:43.64 ===============

Hi,

Its quite important that we get an AntiRootkit scan, otherwise we don't know what we're up against. Please try running GMER once more, but this time un-check the Files box, as this can sometimes cause issues. If that doesn't work, please also try running it in Safe Mode (restart computer and tap F8 just before Windows loads).

As an aside, I notice you have Limewire installed. This is a great way to get yourself infected, so I would strongly recommend you remove this and any other P2P programs you may be using.

Hi again, This is a friends computer not mine I built the PC for him and I am just helping him out. Anyway I managed to get the log done. I had to zip it and attach it as it was too long to post and also it would not allow me to attach it either as it 700k in size. I zipped it and attached it for you. Thanks in advance. Demos.

OK, on with the cleaning.

Please download ComboFix to your desktop from one of these locations. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on Combo-Fix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

You are a genius!! His Avast and his malwarebytes is now updateing 100% and his system looks normal. I can also use logmein again to remote to his PC rather than netviewer. I attached the combofix.txt log file for you to inspect. Thanks so much it is greatly appreciated. Demos.

Hi there,

Do you know if Betfair is something the computer owner has installed uses?

1. Please open Notepad

• Click Start , then Run
• Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

REGEDIT4

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
okogrp=-

3. Save the above as "fix.reg" (be sure to save with the quotes)

4. Double-click fix.reg, it should ask you to merge with the registry - click Yes.


Eset online scannner

You can use either Internet Explorer or Mozilla FireFox for this scan.

• Please go here then click on: [external image: Posted Image]
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on: [external image: Posted Image]
• The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on: [external image: Posted Image]
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Let me know if you are experiencing any more problems.

Hi again, Sorry for the delay in coming back to you. I have not had the chance to call the user to complete these last instructions. I will call tonight and see if I can go through these intructions with him.

No worries, thanks for letting me know

Hi Again, saved reg file and added to the registry as you instructed and I done a scan with Eset online scan. I noticed that the he did not check the correct options to leave the viruses and only create a log. Hope this is still okay? C:\Documents and Settings\Pani\Desktop\Demosa Tools\MGA_crack.exe probably a variant of Win32/Agent trojan cleaned by deleting - quarantined C:\Documents and Settings\Pani\Desktop\downloads\RealPlayer_SP_Plus_Fully_Activated.rar a variant of Win32/PSW.Fignotok.B trojan deleted - quarantined C:\Documents and Settings\Pani\Desktop\downloads\Setup_LadbrokesCasino.exe a variant of Win32/PrimeCasino application cleaned by deleting - quarantined C:\Documents and Settings\Pani\My Documents\MGA_crack.exe probably a variant of Win32/Agent trojan cleaned by deleting - quarantined C:\Microgaming\Casino\Ladbrokes\install.exe a variant of Win32/PrimeCasino application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\Process.exe.vir Win32/PrcView application cleaned by deleting - quarantined C:\WINDOWS\system32\cmdow.exe Win32/CMDOW.143 application cleaned by deleting - quarantined

Doesn't matter too much in this case.

Can I ask you what this file is for?
MGA_crack.exe

How is the computer running?

My friend is not using a genuine version of window. We have a genuine licence now but we can't seem to put it into his windows as it will not allow us change the serial number. The computer seems to be running fine now. I would like to thank you for your time and hard work Demos.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.