Baseline

• Malware Logs can sometimes take a lot of time to research and interpret.
  
• Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  
• Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  
• PLEASE NOTE: If you do not reply after 5 days your thread will be closed.
  
• I am looking over your log and will reply back shortly with instructions.

• Please RUN HijackThis
  
  
  
  • Click the "Do a System Scan Only" button to produce a log.
  • Place a check mark beside each one of the following items (if they are present):
  
  
  R3 - URLSearchHook: agihelper.AGUtils - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - mscoree.dll (file missing)
  O2 - BHO: agihelper.AGUtils - {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll (file missing)
  O2 - BHO: (no name) - {386A3217-186D-4387-8505-89E7382538ED} - (no file)
  O2 - BHO: Sofos - {44B1C291-CF3E-4B66-8BAB-31040FDC30A9} - (no file)
  O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
  O2 - BHO: (no name) - {8E7B92CB-BF4E-4EC6-8004-2F36D3E2C937} - (no file)
  O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - (no file)
  O16 - DPF: {10000273-8230-4DD4-BE4F-6889D1E74167} - hxxp://download.abetterinternet.com/downlo…B8105/turbo.cab
  O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} - hxxp://apps.deskwizz.com/ax/adwerkz.cab
  O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - hxxp://cdn2.adsdk.com/bannerfarm/48723/Bun…r1303030923.EXE
  O16 - DPF: {F1A51F21-59DF-4486-BA31-5B816DA481EB} - hxxp://www.fastseeker.com/toolbar/download…SeekerSetup.cab
  
  
  
  • Now with all the items selected, and all windows closed except for HJT, delete the selected items by clicking the FIX checked button.
  • Close the HijackThis window.
  
  
• Please perform the following scan
  
  
  
  • Please download DDS from here and save it to your desktop.
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
  • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.
  
  
• Please scan your system with GMER
  
  
  [external image: Posted Image]
  Download GMER Rootkit Scanner from here or here.
  
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    
    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

• Combofix
  
  
  
• Download ComboFix from one of the following locations:
  
  Link 1
  Link 2

• VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

• IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
• Double click on ComboFix.exe & follow the prompts.

• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
• Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.
• When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
• Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
• Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

• Security Check
  
  
  
  • Please download Security Check by screen317 from here or here and save the file (called securitycheck.exe) to your desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document in your next reply.
  
  
• Please make all files and folders VISIBLE:
  
  
  
  • Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
  • Choose to "Show hidden files and folders."
  • Uncheck the "Hide protected operating system files" and the "Hide extensions for know file types" boxes.
  • Close the window with "OK".
  
  
• Please scan the following files
  
  
  
  • Please visit Virus Total by clicking here.
  • Click the Browse button and search for the following file (if present): c:\program files\hotburnpatch-w32-x86-237.exe
  • Click Open.
  • Then click Send File.
  • Please be patient while the file is scanned.
  • If Virus Total tells you that the file has already been scanned, click "reanalyse now".
  • Please provide the results from the scans in your next reply.
  
  Please provide the checkup.txt log and the Virus Total Scan results in your next reply.

If you could tell me how to actually get rid of it - that would be great

• Please work through the following steps
  
  
  
  • Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
  • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
  • Copy and Paste the text in the quotebox below into the open Notepad window:
    
    

    File::
    c:\windows\system32\bhblaffp.tmp
    c:\windows\system32\prutv.tmp

  • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
  • Close any open browsers.
  • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Refering to the picture below, drag CFScript.txt into ComboFix.exe
    
    [external image: Posted Image]
    
  • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
  • Once the log is produced, re-engage your resident anti virus.
  
  
• Clean out your temporary files
  
  
  
  • Please download ATF Cleaner by Atribune by clicking here and save the file (called ATF-Cleaner.exe) to your desktop.
  • Run the program by double clicking the ATF-Cleaner.exe icon located on your desktop.
  • Check the boxes to the left of the following:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Java Cache
  
  
  • The rest are optional. If you want to remove everything check the "Select All" box.
  • Click on "Empty Selected" to begin cleaning.
  • Once the "Done Cleaning" message appears, click OK.
  • If you use Firefox, Click on the Firefox tab and repeat the above process.
  • When you have finished cleaning, click on the "Exit" button in the main menu.
  
  
• Please perform the following scan:
  
  
  
  • Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
  
  
  • Double click on the mbam-setup.exe icon to install the program.
  • Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
  • Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
  • Click on the "Update" tab and then on "Check for Updates".
  • The program will now install the latest Malware definition files.
  • Once complete, click on the "Scanner" tab, select "Perform full scan"and then click on "Scan".
  • Once the program has scanned your computer, a log file will be created in Notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  
  
  
  • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
  • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
  • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
  • Come back here to this thread and Paste the log in your next reply.
  
  Please provide the ComboFix log and the MBAM log in your next reply.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d263b532-c528-49e5-8bb6-80fa67332c9a} (Trojan.FakeAlert) -> No action taken.

• Trusted Zones:
  
  
  
• I can see that you have some "Trusted Zones" in your log. The only advantage to having a domain stored in your Trusted Zones, is that the domain will not prompt you for any permission before installing software or updates from the "trusted" site. This also means however, that if a malware exploit comes out where a site can spoof their domain name to match one stored in your Trusted Zones, then you will never know when (or what) they install on your machine.
• If you remove the zones, these sites will still be able to install software, but only after receiving permission from you to do so, putting you back in control.
• I suggest you remove the following entries:

• Trusted Zone: turbotax.com
• Trusted Zone: musicmatch.com\online

• Although these sites are safe, we do not reccommend placing any sites in the Trusted Zone, as they may become exploitable.

• You can remove sites from your Trusted Zones via:
• IE > Tools > Internet Options > Security tab > Trusted Zone > Sites.
• For more information regarding the addition of sites to your Trusted Zones, click here.

it tells me there is not enough memory to open

I did have the scan remove the malware it found when it found it

• Please update your Java
  
  
  • Click on "Start", then on "Control Panel".
  • Go to "Add or Remove Programs" and uninstall any previous versions of Java that you find.
  • Reboot your computer.
  • Next, download the latest version of Java by clicking here
  • Scroll down the page until you reach "Java Platform Standard Edition".
  • Beneath this and to the right, you will see a red button marked "Download JRE".
  • Click the "Download JRE" button.
  • Select the platform (Windows, in your case), multi language.
  • Accept the license agreement and click on "Continue".
  • You do not have to register if you do not want to (the registration step is optional).
  • Scroll down and click on the file called jre-6u20-windows-i586.exe located under "Windows Offline Installation".
  • Save the file to your desktop.
  • Do not select Run.
  • Double click on the saved file (jre-6u20-windows-i586.exe) to install the update.
  • Delete the downloaded installation file after completing the above procedure and reboot your system if not prompted to do so.
  
  
• Please perform the following scan:
  
  
  
  • This is a very deep scan that can take many hours. In some instances you may need to let it run overnight. Please be patient.
  
  
  
  • It is recommended that you disable your onboard antivirus program and antispyware programs while performing scans to eliminate software conflicts and to speed up scan time.
  • DO NOT surf the net while your resident protection is disabled!
  • Once the scan is finished remember to re-enable your resident antivirus protection along with whatever antispyware applications you use.
  
  
  
  • Please perform a Kaspersky Online Scan of your computer by clicking here or here.
  
  
  
  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run (at times it may appear to stall).
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  
  
  • Once the scan is complete, click on View scan report. To obtain the report:
  • Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select:Text file [*.txt]
  • Then, click: Save
  • Please post the Kaspersky Online Scanner Report in your reply.
  • If you need help performing the above steps, an animated tutorial can be found here.
  
  Please post the Kaspersky Online Scan log in your next reply.

I followed your instructions about my online browsing

the only thing that's kind of a pain is the cookies thing. Is this really an area where people download Malware and stuff to your computer

• Please run the following Command
  
  
  
  • Click on "Start" and then on "Run".
  • Copy and Paste the following command into the Run box:
  
  
  

  cmd /c del /f/a/q "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\WebSys\offline.mmz"

  
  
  
  • Click on "OK".
  
  
• Empty your Symantec AntiVirus Quarantine
  
  
  
  • NOTE: DO NOT double click on ANY executable (.exe) files in the next step!!!
  • Right click your "Start" button and select "Explore".
  • Navigate to the following folder in bold and delete the contents:
  
  
  • C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine <—– Delete the contents of this folder.
  
  
  • Empty your recycle bin.
  
  
• IOBIT Products
  
  
  
  • We note you are using one or more products from IOBit.
  • IOBit has been accused by Malwarebytes of illegally using their intellectual property without permission.
  • Please see this for additional information on these allegations: http://www.malwarebytes.org/forums/index.php?showtopic=29681.
  • Additionally, both WOT and SiteAdvisor have flagged IOBit’s site.
  • A thread in the IOBit’s forum responded to the accusations from MalwareBytes. It is noteworthy that several responses from users raising specific questions about IOBit’s response and finding it unsatisfactory were deleted and the thread was closed. The bottom line from IOBit was: “No hard proof shows that IObit stole the database of Malwarebytes.”
  • From what is said above, at least until the issues of possible database theft and spyware packaging is resolved, I do not recommend the use of IOBit products.
  • You can remove IOBit products by clicking on "Start" and then on "Control Panel" and then on "Add or Remove Programs".
  
  
  Please scan your system with DDS and post the log created.
  
  Also, please describe how your machine is behaving now.