What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] IE redirects turned vicious

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Teacher, Not sure if this makes a difference, but remember this problem happened more than 30 days ago. I noticed than in some of these reports there is just a 30 day look at logs and so forth. Justin
Post #17 last edited
Hi GGGGG,

Not sure if this makes a difference, but remember this problem happened more than 30 days ago. I noticed than in some of these reports there is just a 30 day look at logs and so forth.


That's ok, that is mostly for logging purposes, these tools do look at all files as shown in the "Other Deletions" section of the combofix log.

I must give you this warning about what was removed.

Your system has been infected by one or more Backdoor Trojans.

These trojans may steal critical system information and Download and Execute files.

While we can attempt to clean what we see in your logs, we cannot guarantee that your computer will be completely in the clear since we have no way of knowing that has been done to the computer. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found here.

I strongly suggest you do the following immediately:
  • From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
  • DO NOT change passwords or do any transactions while using the infected computer until given the All Clean speech because the new password may be compromised.

If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities.

To help you make your decision, here are a few related articles that i suggest you read:

  • Danger: Remote Access Trojans.
  • When should I re-format? How should I reinstall?
  • How Do I Handle Possible Identify Theft, Internet Fraud and Credit Card Fraud?

Should you have any questions, please feel free to ask.



If you wish to continue please follow these instructions.

You mentioned that you were planning on installing AVG. Please do so immediately after following these next 2 steps.

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Next

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You must use Internet Explorer for this scan.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.

Please post back with
  • MBAM log
  • ESET log
Thanks
Post #20
Teacher, Apparently good news. The MBAM show no infected files. Interesting. Malwarebytes' Anti-Malware 1.44 Database version: 3910 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 3/24/2010 11:23:43 PM mbam-log-2010-03-24 (23-23-43).txt Scan type: Quick Scan Objects scanned: 116902 Time elapsed: 4 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) No I'll go to ESET as instructed then post the results (log). Justin
Post #21
Teacher, Here is the ESET online scan ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # IEXPLORE.EXE=6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=958b9a487795be4085437455d9adfd0e # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-03-25 07:15:35 # local_time=2010-03-25 12:15:35 (-0800, Pacific Daylight Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 16008325 16008325 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # compatibility_mode=9217 16777214 75 70 86958287 112866975 0 0 # scanned=53032 # found=0 # cleaned=0 # scan_time=2364 Now I will install AVG Justin
Post #22
Teacher, Actually I am not using this computer to do anything except clean it. After we are done I imagine I'll clean up and uninstall some of the programs I've downloaded. Then I'll imediately download AVG Antivirus program. Could you provide a clean link to AVG? Plus all the recomendations to keep computers secure. I'm also interested in learning how to use some of the "Tools" to respond quicker the next time something bad starts to happen to any of my computers. Try to nip them in the bud. Justin
Post #23
Hi GGGGG,

Looks good. :thumbup:

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EventLogger.lnk = C:\Program Files\JM Integrated Remote Station\CMS\EventLogger.exe ()

Is software for viewing my home security cams. I don't use the 'event logger'. I need to remove it from startup.


To stop this from running at startup you can remove EventLogger.lnk from

C:\Documents and Settings\All Users\Start Menu\Programs\Startup. You can delete the link or

Create a temporary directory for your OS called "Disabled StartUp Programs" and move the shortcut there. If a program doesn't work as expected you can always move the relevant shortcut back again.


The use of the specialized tools are taught in the various Malware removal classroom. This LINK will give you a google search for some of them.

Should the need to seek help here arise again you can follow the instructions HERE

You can hang onto the OTLPE disk, it may come in hhandy one day.

If no other problems, we can clean up our tools.

From your desktop, please delete, if present
  • any notepads/logs that we created

Next

Click your start button, click run. Copy and paste the following line into the run box and click OK

Combofix /uninstall



I suggest you keep MBAM. Keep MBAM updated and use it regularly.

Eset online can be removed via add/remove programs if you wish.



Updates and upgrades

You can get AVG from the following link.

AVG
Help and support can be found here AVG Forum

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 7.0.5 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

You could enable Spybot's Teatimer to give you real time antispyware protection.

http://www.malwarehelp.org/how-to-enabledi…t-teatimer.html

OR use Windows Defender


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879


We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".

Take care :adios:
Post #24
Teacher, So far so good. I haven't used the Fujitsu for anything just yet. I will follow the instructions to remove the logs and selected programs, then I'll update the needed items, then I'll try to surf again and see what happens. Thanks for the Goldmine of info! I'll post back around late tomorrow with the results of using the internet. Also, if I download Firefox, do I have a choice to use either Firefox or IE when I surf? If so, where would be a safe place to download Firefox. Thank You Justin
Post #26
Teacher, I am now using the Fujitsu laptop to reply here now. I removed the logs, removed ESET, updated the OS and am keeping the windows updater on, downloaded AVG, and so forth. Everything seems to be fine. I probably won't use this laptop for surfing since I have the mini laptop. This one is used more for media stuff (like photoshopping picyures, slideshows and etc.) I am grateful for your help. I do have some closing questions if you have the extra time: Backing up a computer is easy, I just never restored a computer from a backup. It seems I should backup a computer to an external Hard Drive in case the computer gets inop. But what about just using windows explorer to drag and drop all the files to the external HD? I imagine the backup tool tries to save computer settings as well as files? My older Ipod just starting failing (sounds like the arm on the hard drive) is there a freeware program that can backup (save) all my songs to MP3's so I can burn them to a DVD / CD? (although ITunes has a burn feature but I cannot get the sogs from my Ipod back into my Library. Should I run the MBAM every once in a while? I will go back in the thread later to read the links you provided for me as well. And most importantly, what is one of the better ways to scan external Hard Drives? Can everything bad (Malware, Trojans and etc) get imbedded there as well? (Another words, if I attach a USB stick or external HD, can my computer be immediately infected? or is there a setting that allows my computer to scan the device first? It's been a great experience. Thank you Teacher. Justin
Post #27
Hi GGGGG,

But what about just using windows explorer to drag and drop all the files to the external HD? I imagine the backup tool tries to save computer settings as well as files?

That is fine for personal data such as documents, pictures or music. Backing up an entire computer requires a little more as there are settings and the entire register structure to back up. A 3rd party disk imaging program may be the best option. You can ask about this type of software in our Other Software Forum. That would be also the best place to inquire about software for copying your songs. Windows Media player should be able to do it for you though.

http://www.microsoft.com/windows/windowsme…dvice/0091.mspx

Should I run the MBAM every once in a while? I will go back in the thread later to read the links you provided for me as well.

Yes, update it first and run a scan about once a week.



And most importantly, what is one of the better ways to scan external Hard Drives? Can everything bad (Malware, Trojans and etc) get imbedded there as well? (Another words, if I attach a USB stick or external HD, can my computer be immediately infected? or is there a setting that allows my computer to scan the device first?


It is possible if the usb device is infected with an autorun infection. To help prevent this you can, hold the shift key down while attching the drive. This will prevent it from auto running. Use the small utility posted below to help protect these drives.




Download Flash_Disinfector.exe by sUBs and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.


If you right click the drive's icon you should be presented with the option to scan the drive with your antivirus program. If it's a large drive it will take some time to complete. Much better to include them in your regular scan occasionally if they are just used for backups or storage. If you use MBAM's full scan, you can check the appropriate drive letter.
Post #28
Teacher, I feel as if I might be able to snatch the pebble from your hand… Although, if I did, be sure to know that I would wear hockey thigh pads on my inner arms to move the big searing hot vat… Well I've got lawns to mow, cars to wash, shopping items to check off the list, gardens to start (spring is here!) and life to live. It's been real my friend. Take care and thank you for all your desperately needed help. I salute you- May God richly bless you and yours. Justin

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI