Not sure if infected but something's up.

Fine, as I stated, there were no actual symptoms(That I noticed) that clued me in- just a discussion about a reoccurring problem that seemed omnipresent in a forum I'm part of prompted me to seek out assistance for a thorough investigation. So everything seems standard from what you can interpret from all these logs(Honestly, they're completely lost on me.)

Hi Mad-Hamlet,

Please download DeFogger to your desktop.
Right-click and Run as Administrator DeFogger to run the tool.

• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• If it needs to, DeFogger may ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.
————

Once you get that complete please run aswMBR.exe again and post the newly created log into your next reply.

I'm not sure if there was an error or not.
I've not re-enabled anything though.

Defogger Log



defogger_disable by jpshortstuff (23.02.10.1)
Log created at 06:24 on 23/11/2011 (Mad-Hamlet)

Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers…
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-


aswMBR Log

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-23 06:30:05
—————————–
06:30:05.325 OS Version: Windows x64 6.1.7600
06:30:05.325 Number of processors: 2 586 0xF0B
06:30:05.325 ComputerName: MONOLITH UserName:
06:30:05.621 Initialize success
06:31:10.871 AVAST engine defs: 11112201
06:32:28.614 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
06:32:28.616 Disk 0 Vendor: ST3200822AS 3.01 Size: 190781MB BusType: 3
06:32:28.617 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-1
06:32:28.619 Disk 1 Vendor: SAMSUNG_HD403LJ CT100-12 Size: 381554MB BusType: 3
06:32:30.642 Disk 0 MBR read successfully
06:32:30.644 Disk 0 MBR scan
06:32:30.648 Disk 0 Windows 7 default MBR code
06:32:30.651 Service scanning
06:32:34.883 Modules scanning
06:32:34.885 Disk 0 trace - called modules:
06:32:34.900 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
06:32:34.902 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004615060]
06:32:34.905 3 CLASSPNP.SYS[fffff8800193143f] -> nt!IofCallDriver -> [0xfffffa80040e7580]
06:32:34.908 5 ACPI.sys[fffff88000f17781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80041ca060]
06:32:35.291 AVAST engine scan C:\Windows
06:32:38.362 AVAST engine scan C:\Windows\system32
06:34:28.620 AVAST engine scan C:\Windows\system32\drivers
06:34:42.661 AVAST engine scan C:\Users\Mad-Hamlet
06:38:51.997 AVAST engine scan C:\ProgramData
06:40:30.420 Scan finished successfully
06:41:09.508 Disk 0 MBR has been saved successfully to "C:\Users\Mad-Hamlet\Desktop\MBR.dat"
06:41:09.512 The log file has been saved successfully to "C:\Users\Mad-Hamlet\Desktop\aswMBR2.txt"

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
—————

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
• Click the Re-enable button to re-enable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.
Your Emulation drivers are now re-enabled.
———-

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
———-

Clean up with OTL:

• Right-click and Run as Administrator OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

———-

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

• Open Internet Explorer
• Click on Tools > Internet Options
• Press Security tab
• Select Internet zone then place check next to Enable Protected Mode if not already done
• Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
• Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

I have done as instructed and I thank you for your time. My own security is Comodo and I'm wondering what your opinion of their firewall/anti-virus is. (Interestingly enough I had to reinstall Comodo during our work and after the reinstall the auto-scan CAUGHT the threat, this was before we uninstalled ComboFix. Pity it hadn't done so a week ago, eh?) Regarding all your suggestions for Internet Explorer, I don't use that browser. I use Mozilla Firefox. Anything to suggest there? I appreciate how busy you must be so don't feel any pressure to reply, you can lock the thread at any time. I'm grateful for your assistance.

Hi Mad-Hamlet,

My own security is Comodo and I'm wondering what your opinion of their firewall/anti-virus is.

Well I used the free firewall for a little while, but I do not any longer. I am using a wireless router which is in sorts a hardware firewall so I just have the standard Windows firewall running. If you were thinking of using another firewall I would recommend the two that I placed in my previous post.

As for antivirus software I prefer either Microsoft Security Essentials or Avast. They are both light on resources and are very effective. I have never used Comodo antivirus so I can't speak of it.

Regarding all your suggestions for Internet Explorer, I don't use that browser. I use Mozilla Firefox. Anything to suggest there?

Even if you don't use Internet Explorer, it is important to keep it up to date because that is the browser that Windows uses to perform all updates to your operating system. You don't want to have possible security vulnerabilities in the browser that your operating system is updated through.

If you want to help make Firefox more secure you can use two add-ons that I use myself… NoScript and AdBlock Plus.

I hope that helps.

There is a complication. I tried to use DAEMON Tools (Latest version) after reactivating them with DeFogger (There was no error in Defogger that I detected, it said 'Okay' and rebooted smooth) but trying to start DAEMON resulted in this error message. This program requires at least Windows 2000 with STPD 1.60 or higher. Kernal Debugger must be deactivated. Attempting to re-activate again with Defogger gives an 'unable to open file' message. What went amiss? I completely concur with your add-on recommendations for Firefox. They've served me well, (Theoretically)

Hi, Try to run Defogger again but this time right-click on Defogger and Run as Administrator. ———– If it still does not work you might try to remove and then reinstall DT completely. Let me know if either of those works.

Ah yes, a reinstall. And because we're dealing with so much deep programming stuff that I have little idea of, what basic skills I do have decided to call it a day. It works fine, thanks. I think I, and what's left of my pride, had best shuffle off. Much obliged.

Hi Mad-Hamlet, Glad to hear you are up and running again. I will leave this topic open for a couple of days before I close it out just in case.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.