Please Assist: trojan.adh2 on Win7 [Closed]

Thats fine, look for you later this evening. Log looks ok

Hi, just wanted to let you know I will be offline until this evening so if I dont get right back to you it doesn't mean I have forgotten about you

Ken, I did everything as requested, in the order requested. ESET did not find the trojan. It did find three other bits of malware that everything else has missed. This is all of the log thgat I found: C:\Users\sadair\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\stubinst_pkg_en-us.cab Win32/OpenCandy application deleted - quarantined C:\Windows\Installer\5b3b5082.msi a variant of Win32/Aedgency.A application deleted - quarantined H:\FreddieL_Cdrive_20130213.zip MSIL/Solimba application deleted What's next? Thank you, Steve

Are you still getting notices from Norton about those threats ? Tell me exactly whats going on, are your searches redirected, if so what browsers ?

Ken, Yes, I am still getting notices from Norton. I am not having any problem with having searches redirected as far as I know. Steve

Lets take another look, did you run the scan with Norton like I posted ?

• Download & SAVE to your Desktop RogueKiller or from here
• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select "Run as Administrator to start"
• For Windows XP, double-click to start.
• Wait until Prescan has finished …
• Then Click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• Click on Report and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
• Exit/Close RogueKiller+

Ken,
Yes, I reran Norton. It did not find anything.
Here is the log from RogueKiller:
RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : sadair [Admin rights]
Mode : Scan – Date : 04/02/2013 12:56:20
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] DAODx.exe – C:\Windows\DAODx.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 8 ¤¤¤
[TASK][SUSP PATH] RunDAOD : C:\Windows\DAODx.exe [-] -> FOUND
[DNS] HKLM\[…]\ControlSet001\Services\Tcpip\Interfaces\{BA643584-2629-4A59-8DFA-B551F4A2F424} : NameServer (8.8.8.8,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.1
54.71.1) -> FOUND
[DNS] HKLM\[…]\ControlSet002\Services\Tcpip\Interfaces\{BA643584-2629-4A59-8DFA-B551F4A2F424} : NameServer (8.8.8.8,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.1
54.71.1) -> FOUND
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[…]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts

ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST31000520AS ATA Device +++++
— User —
[MBR] fe438d83d2811da5ae230e6a7017c7ed
[BSP] a7d4603787404af177ff0766f3d73a74 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 99899 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 204800000 | Size: 853867 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: ST31000520AS ATA Device +++++
— User —
[MBR] 154790d5308d46519d450ded000970e3
[BSP] 87dcc5d0b232f713ee11e5792c76b89f : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive2: ST32000542AS ATA Device +++++
— User —
[MBR] c74c08beb29caef6c7acde9283a94926
[BSP] 2057c1b12f101725cadaf72d461e014d : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive3: MAXTOR S TM3320620A USB Device +++++
— User —
[MBR] 89664bcc2205ddf7d02ac7c2909950c1
[BSP] 8ed85a5153cc0eef8e9a8b2e180c2766 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 16065 | Size: 305235 Mo
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive4: Seagate Desktop USB Device +++++
— User —
[MBR] 12e4637e68fd4156243db048208ac968
[BSP] d156539b1f8f77c3403c934582e6652b : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 1907726 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[1]_S_04022013_02d1256.txt >>
RKreport[1]_S_04022013_02d1256.txt



Steve

When does the warning from Norton show up, when you start your computer or is this all the time ? Do you know how to take a snapshot, next time you get that warning, while its open press Print Screen (PrtScn ) this will take a snapshot of that warning message, then open Paint or a image editor that you use and paste it in, save it to your desktop and attach it to your next reply

Ken, The warning shows up soon after Windows starts. If I close out of the warning, it is back in 10-15 minutes. A screen print of the warning is attached. Steve

Open Malwarebytes and check for updates.

Then boot to safemode with Networking

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
  this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
• Then press the Enter Key on your Keyboard

Then select the Full Scan , post the report if it finds anything

After you run Malwarebytes in Safemode , then do this

You will need the 64 bit version


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64 Bit Version

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:

:filefind
svchost.exe

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Ken, I ran Malwarebytes. Then ran 64 bit SystemLook. Here is the latest: SystemLook 30.07.11 by jpshortstuff Log created at 06:12 on 03/04/2013 by sadair Administrator - Elevation successful ========== filefind ========== Searching for "svchost.exe" C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe ——- 216424 bytes [23:03 24/03/2013] [21:49 14/12/2012] 22101A85B3CA2FE2BE05FE9A61A7A83D C:\Windows\erdnt\cache64\svchost.exe ——- 27136 bytes [17:21 27/03/2013] [01:39 14/07/2009] C78655BC80301D76ED4FEF1C1EA40A7D C:\Windows\erdnt\cache86\svchost.exe ——- 20992 bytes [17:21 27/03/2013] [01:14 14/07/2009] 54A47F6B5E09A77E61649109C6A08866 C:\Windows\System32\svchost.exe ——- 27136 bytes [23:31 13/07/2009] [01:39 14/07/2009] C78655BC80301D76ED4FEF1C1EA40A7D C:\Windows\SysWOW64\svchost.exe ——- 20992 bytes [23:19 13/07/2009] [01:14 14/07/2009] 54A47F6B5E09A77E61649109C6A08866 C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe ——- 27136 bytes [23:31 13/07/2009] [01:39 14/07/2009] C78655BC80301D76ED4FEF1C1EA40A7D C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe ——- 20992 bytes [23:19 13/07/2009] [01:14 14/07/2009] 54A47F6B5E09A77E61649109C6A08866 -= EOF =- Steve

Steve,

That problem is not showing up in any of the logs, let do this, it would be easier for me to post a link instead of typing it all out.

Think about when this problem first started and choose a restore point a few day prior to it

http://windows.microsoft.com/en-us/windows…/system-restore

Ken, The only restore point that I have is February of last year. I think that was when I built this box and installed Windows 7. I have been fighting this Trojan for a couple of months. Are you telling me that the only way to get rid of it is to format the drives and re-install? Is there any way to even know where the malware is? Thank you, Steve

A system restore does not format your drive and re installs windows, it just restores your system to the date you choose. If you want to hang on, let me have someone else look at this to see if there is something I missed BRB Ken