PING.EXE Max CPU Usage/Google Redirect [Solved]

Hi Praveen,

We'll update the java manually then

• Go to Java
• Scroll down to Java Platform, Standard Edition section. The subheading is Java SE 6 Update 30,
• Click the Download JRE button on the right.

If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.

• Check the box beside Accept License Agreement
• Locate Windows x86 Offline and click jre-6u 30-windows-i586.exe
  
• Save the file jre-6u 30-windows-i586.exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.


Open Control Panel > Add/Remove Programs and uninstall


Java™ 6 Update 22

Do not uninstall Java TM 6 Update 30 if found!

Reboot your computer.


Next

• Double-click on the saved file ( jre-6u30-windows-i586.exe) to install the update.
• Decline the offer of the Ask Toolbar
• Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

A couple of small fixes then an online scan to check our work. After you post back we'll clean up the tools.

Next, Right click on OTL.exe and chose Run as Administrator to run it

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:Services

:Files
c:\windows\$NtUninstallKB31434$\1468149064
c:\windows\$NtUninstallKB31434$

:Commands
[createrestorepoint]
[emptytemp]

Then click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.

Next

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

DEQUARANTINE::
C:\Qoobox\Quarantine\c\windows\system32\spool\prtprocs\w32x86\x5pp.dll.vir

Quit::

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

A notepad titled DeQuarantine.txt will be produced. Please post this in your next reply.


One more scan:

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

• Do not use this instance of your browser for anything besides doing this scan
• When the scan is complete and the results saved, close that instance of your browser
• Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
• Click Start
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
• Click Scan.
• Wait for the scan to finish.
• When the scan completes, click List of found threats
• click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
• Include the contents of this report in your next reply
  
  Note - when ESET doesn't find any threats, no report will be created.
  
• Push the back button.
• Push Finish
• Re-enable your Antivirus software.

Please post back with

• OTL log
• dequarantine.txt
• ESET log if one was produced

Hello again oldman……here are the requested files:


OTL Log


All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
c:\windows\$NtUninstallKB31434$\1468149064 folder moved successfully.
c:\windows\$NtUninstallKB31434$ folder moved successfully.
========== COMMANDS ==========


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Praveen
->Temp folder emptied: 332425 bytes
->Temporary Internet Files folder emptied: 34921340 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 10465834 bytes
->Flash cache emptied: 566 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 44249 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 44.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 01112012_222611

Files\Folders moved on Reboot…
C:\Users\Praveen\AppData\Local\Temp\~DF3697833A0E10A0E3.TMP moved successfully.
C:\Users\Praveen\AppData\Local\Temp\~DF907200BC052C3C50.TMP moved successfully.
C:\Users\Praveen\AppData\Local\Temp\~DFAFA93ADD922B5ED8.TMP moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1A0654DC-3D8D-4C38-852C-A97B25F70EA4}.tmp moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4229F94A-E7A0-4CA8-978B-209DBC733E00}.tmp moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9FE08EB1-F2E3-452C-8997-47BFE8BFF463}.tmp moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RIMIEK33\iframe[1].htm moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\628ZOEF0\index[2].htm moved successfully.

Registry entries deleted on Reboot…

I've also uninstalled Java™ 6 Update 22 and installed Update 30.

Here is the Dequarantine.txt produced out of the ComboFix tool:

C:\Qoobox\Quarantine\c\windows\system32\spool\prtprocs\w32x86\x5pp.dll.vir -> c:\windows\system32\spool\prtprocs\w32x86\x5pp.dll ( 32256 bytes )



The ESET scan ran for nearly 45 mins and 4 threats were found. Below is the log:

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C40DPGQP\ksfthwflarioyn[1].pdf JS/Exploit.Pdfka.PGF.Gen trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z3I81FZB\careerfox_co_uk[1].txt HTML/Iframe.B.Gen virus
C:\Windows\System32\drivers\netbt.sys a variant of Win32/Rootkit.Kryptik.HJ trojan
C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.1.7600.16385_none_603b1e855897bcd6\netbt.sys a variant of Win32/Rootkit.Kryptik.HJ trojan



Thank you……..

Hi Praveen,

We do have a detection of concern.

Download farbar service scanner and save it to your desktop.



Right click FSS.exe and click "Run as Administrator"

[external image: Posted Image]

Tick "Internet services" and "Windows Firewall" options.


Press "Scan".
It will create a log (FSS.txt) in the same directory (desktop) the tool is run.



Please copy and paste the log to your reply.




Next

Open OTL if it is not opened.

• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, click the None button near the top (it may looked greyed out)
  
• In the window under Custom Scans/Fixes copy and paste the following
  
  
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\afd /s
  /md5start
  netbt.*
  /md5stop
  
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

Please post back with

• FSS log
• OTL.txt

Thanks

Hello again oldman, I wasn't unfortunately able to run Farbar service scanner as it gave me the following error when I hit the Scan button.

[external image: Posted Image]


And hence I didn't run the OTL scan, let me know if otherwise..

Hi Praveen, Go ahead with the OTL scan.

Hi Praveen,

We'll use combofix again but run it differently. Also get a new copy before we start. Locate combofix.exe on your desktop, right click it and click delete.

Download a new copy from Link 1
Link 2

Safe it to your desktop.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

FCopy::
C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_626c324d55864070\netbt.sys | C:\Windows\System32\drivers\netbt.sys
C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_626c324d55864070\netbt.sys | C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.1.7600.16385_none_603b1e855897bcd6\netbt.sys

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Make sure you click the None Button before you run the next OTL scan. It will make a much shorter log.

Open OTL if it is not opened.

• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, click the None button near the top (it may looked greyed out)
  
• In the window under Custom Scans/Fixes copy and paste the following
  
  
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
  /md5start
  netbt.*
  /md5stop
  
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

Please post back with

• combofix log
• OTL.txt

How's the computer?

Thanks

As before the computer behaves just fine, no Google redirect activity observed and also PING.exe couldn't be seen anywhere…

Hi Praveen,

Looks much better now. Combofix went after that file again. We'll restore it then I'd like you to zip it and attach it to your next reply. After you post back we'll clean up the tools and send you on your way.

Next

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

DEQUARANTINE::
C:\Qoobox\Quarantine\c\windows\system32\spool\prtprocs\w32x86\x5pp.dll.vir

Quit::

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

A notepad titled DeQuarantine.txt will be produced. Please post this in your next reply.

Next

In Windows Explorer please navigate to

• c:\windows\system32\spool\prtprocs\w32x86
• Locate x5pp.dll
• zip it and attach it to your next reply

Please post back with

• dequarantine.txt
• x5pp.dll (zipped and attached)

Hello oldman, that sounds really good.


Here is the DeQuarantine log file:

C:\Qoobox\Quarantine\c\windows\system32\spool\prtprocs\w32x86\x5pp.dll.vir -> c:\windows\system32\spool\prtprocs\w32x86\x5pp.dll ( 32256 bytes )


Also the x5pp.dll file is attached with this post.

Thank you…..

Hi Praveen,

From your desktop, please delete, if present

• any notepads/logs that we created
• farbar service scanner
• MBRCheck.exe
• aswMBR.exe
• DDS.scr

Next

Click the Start button, click Run. [Vista\Win7 users, go Start>"Start search"] Copy and paste the following line into the run box and click OK
Combofix /uninstall



Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep it updated and use it regularly.


Updates and upgrades

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources. If you choose to install Foxit Reader decline the Foxit Toolbar.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 9.4.7 first. Be sure to move any PDF documents to another folder first though.



Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Windows 7 firewall is pretty good so you have the basics.

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System > update tab


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE

Please post back if you have any problems.

Take care

Thank you very much oldman for everything. I owe you a beer…