Trojan , Malware

• Malware Logs can sometimes take a lot of time to research and interpret.
  
• Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  
• Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  
• PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

• P2P Programs:
  
  
  
  • P2P programs are a major source of Malware infections.
  • From your log I see you have uTorrent. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
  • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
  • If you wish to keep the program(s), please do not use them until your computer is cleaned.
  • Information regarding the risk of using these programs can be found from here and here.
  • It is strongly recommend that you uninstall any P2P programs you have on your system.
  • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
  • A list of currently installed programs will be displayed.
  • Find the "uTorrent" program, click on it once and then click on the "Remove" button.
  • If you are prompted to re-boot your computer to complete the uninstall please do so.
    
    
    PLEASE NOTE:
  • Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.
  
  
• Please RUN HijackThis
  
  
  
  • Click the "Do a System Scan Only" button to produce a log.
  • Place a check mark beside each one of the following items (if they are present):
  
  
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.imgfarm.com/images/nocache/funwe…tup1.0.0.15.cab
  
  
  
  • Now with all the items selected, and all windows closed except for HJT, delete the selected items by clicking the FIX checked button. Close the HijackThis window.
  
  
• Please perform the following scan
  
  
  
  • Please download DDS from here and save it to your desktop.
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
  • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.
  
  
• Please scan your system with GMER
  
  
  [external image: Posted Image]
  Download GMER Rootkit Scanner from here or here.
  
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and post it in your reply.

unable to download DDS , ie keeps blocking it

disabled firewall , avg

• Download Combofix and RE-NAME it BEFORE saving
  
  
  
• Download Combofix from either of the links below. You must rename it to basswood.com before saving it.
• Save it to your desktop. Change the "save as file type" to "all files".
• Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop.

• If you are using Firefox, make sure that your download settings are as follows:
• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

• NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.

• Double click on the renamed ComboFix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

cannot figure out how to uninstall utorrent

• Please scan the following files
  
  
  
• Please go to VirusTotal

• On the page you'll find a "Browse" button.
• Click on the Browse button.
• In the Choose File to Upload window which opens, copy and paste this into the File Name box.

• Next, click the Open button.
• Then click the "Send File" button just below.
• This will scan the file. Please be patient.
• If you get a message saying File has already been analyzed: click Reanalyze file now.
• Once scanned, copy and paste the link to the results page in your next reply.

not using using norton , lets trash it

• Please work through the following steps
  
  
  
• Hold down the Windows key (has the Windows symbol on it) and press the "R" key. A Run box will open. Type in Notepad then click on "OK").
• NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
• Copy and Paste the text in the quotebox below into the open Notepad window:
  
  

  DirLook::
  c:\documents and settings\Frank\Application Data\knt3ws3cngrjmwuwiyz1kfkdxvlptbr2
  
  File::
  c:\program files\uTorrent\uTorrent.exe
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "uTorrent"=-
  
  DDS::
  TCP: {A176322A-DDB1-4937-BAA7-5889373F7BDD} = ,

• Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
• Close any open browsers.
• Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Refering to the picture below, drag CFScript.txt into ComboFix.exe
  
  [external image: Posted Image]
  
  
• When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

i cut and pasted , hope its ok

• Please search for the following folder
  
  
  
  • Right-click your "Start" button and select "Explore".
  • Navigate to and delete the following folder in bold.
  
  
  c:\documents and settings\Frank\Application Data\knt3ws3cngrjmwuwiyz1kfkdxvlptbr2 <==== Delete this folder.
  
  Once you have deleted the folder please Empty your Recycle Bin
  
  
• Clean out your temporary files
  
  
  
  • Please download ATF Cleaner by Atribune by clicking here and save the file (called ATF-Cleaner.exe) to your desktop.
  • Run the program by double clicking the ATF-Cleaner.exe icon located on your desktop.
  • Check the boxes to the left of the following:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Java Cache
  
  
  • The rest are optional. If you want to remove everything check the "Select All" box.
  • Click on "Empty Selected" to begin cleaning.
  • Once the "Done Cleaning" message appears, click OK.
  • If you use Firefox, Click on the Firefox tab and repeat the above process.
  • When you have finished cleaning, click on the "Exit" button in the main menu.
  
  
• Please perform the following scan:
  
  
  
  • Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
  
  
  • Double click on the mbam-setup.exe icon to install the program.
  • Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
  • Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
  • Click on the "Update" tab and then on "Check for Updates".
  • The program will now install the latest Malware definition files.
  • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
  • Once the program has scanned your computer, a log file will be created in Notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  
  
  
  • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
  • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
  • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
  • Come back here to this thread and Paste the log in your next reply.
  
  Please post the MBAM log in your next reply.

• Please run the following scan
  
  
  
• Note: You will need to use Internet Explorer for this scan.
• Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
• Please disable your real time security programs before performing the scan.

• Scan your system with Eset Online Scanner
• Place a check mark in the box YES, I accept the Terms Of Use.
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
• Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
• Double click on the [external image: Posted Image] icon on your desktop.

• Check [external image: Posted Image]
• Click the [external image: Posted Image] button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option to "Remove Found Threats" is UN checked.
• Push the "Start" button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the [external image: Posted Image] button.
• Push [external image: Posted Image]

BTW , never could locate
c:\documents and settings\Frank\Application Data\knt3ws3cngrjmwuwiyz1kfkdxvlptbr2

• Please download OTM
  
  
  
  • Please download OTM by OldTimer by clicking here.
  • Save the file (called OTM.exe) to your desktop.
  • Double click on the OTM.exe icon to run the program. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  

  :Processes 
  explorer.exe
  
  :Files
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\0\694ddfc0-1f825aff 
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\3f868b65-37241b17 
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\40\5c741ce8-4fb2c4be 
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\45\16eabf6d-343b3944 
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\49\1aaeb971-252807ac 
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\61\5ebe80bd-306ad298 
  C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\62\4bd616be-3ad9e232 
  C:\Documents and Settings\Carly breckenridge\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count1.val-2419ab08-5fd8212d.zip 
  C:\Documents and Settings\Carly breckenridge\Application Data\EDD82512F25CA5934581FB38D5EB6E19\enemies-names.txt 
  C:\Documents and Settings\Carly breckenridge\Application Data\EDD82512F25CA5934581FB38D5EB6E19\local.ini 
  
  :Commands
  [Purity]
  [EmptyTemp]
  [Emptyflash]
  [Start Explorer]
  [Reboot]

  
  
  
  
  
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM.
  • Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File -> Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
  
  
• Please download and run the Norton Removal Tool
  
  
  
  • The Norton removal tool will locate and remove all traces of Norton products from your computer.
  • To download the tool, click here.
  • Read throught the information on the page, and then select the Norton product that you have (this is the one that will be removed).
  • Follow the instructions to obtain the removal tool and to complete the removal process.
  
  
• DDS
  
  
  
  • Please check now to see if DDS will download (Post number 2).
  • If it downloads, allow the tool to run and post the logs created.
  
  Please post the OTM log and the DDS logs in your next reply.