Proxy virus that constantly reverts back as well as random frame lag [

Ever since two months ago, Google Chrome constantly diverts all my Google searches via a proxy 127.0.0.1 and does not allow any usage of other search engines. I am also unable to use other browsers such as Internet Explorer as the web pages would just indicate an error. Random frame lags also consistently occur when I'm gaming or watching videos. Please help!

Hi pricksprocks,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

[external image: bullseye_zpse9eaf36e.gif] P2P - (Peer to Peer)

I see you have/had P2P software uTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall this now.

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• uTorrent

If you choose to not remove this programs please refrain from using it until we have finished cleaning your computer.

=========================

Please move FRST to the Desktop, before proceeding.

=========================

[external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Software Version Updater

=========================

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

Start
CloseProcesses:
Software Version Updater (HKU\S-1-5-21-492589852-2837601702-648067263-1001\…\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version: 1.1.4.2 - ) <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <======= ATTENTION (Policy Restriction on ProxySettings)
ProxyEnable: [HKLM] => ProxyEnable is set.
ProxyEnable: [HKLM-x32] => ProxyEnable is set.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-492589852-2837601702-648067263-1001 -> DefaultScope {7A30B466-9CE2-4CD4-AAFB-7AD6074E3C5E} URL = 
SearchScopes: HKU\S-1-5-21-492589852-2837601702-648067263-1001 -> {7A30B466-9CE2-4CD4-AAFB-7AD6074E3C5E} URL = 
EmptyTemp:
Hosts:
CMD: ipconfig /flushdns
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Show Hidden Files & Folders in Windows 7

• To show hidden files, just click on the Organize button in any folder, and then select “Folder and Search Options” from the menu.
• Click the View tab, and then you should select “Show hidden files and folders” in the list.
• Then click OK.

=========================

[external image: bullseye_zpse9eaf36e.gif] VirusTotal

Please go to: VirusTotal

[external image: virustotal2-SWI.png]

• Click the Browse button and search for the following file: C:\Windows\SysWOW64\twinglossscrod.exe
• Click Open
• Then click Send File
• Please be patient while the file is scanned.
• Once the scan results appear, please provide them in your next reply.

If it says already scanned – click "reanalyze now"

=========================

In your next post please provide the following:

• Fixlog.txt
• VirusTotal results

Hi pricksprocks,

It's important that you follow through with the remainder of the steps I will outline. Absence of symptoms doesn't necessarily translate into malware free. We are making progress so please stay with me until I give you the "all clean" sign.
 

I have been using a temporary solution which I searched up on the internet. I simply went to regedit.exe and edited the value of ProxySettingsPerUser from 0 to 1 to simply prevent the proxy server from kicking in.

It's important that you don't make any changes to your computer on your own. The steps are outlined in a particular order for a reason. Making changes out of order may render your computer unusable.

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt
 

Start
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Policy Restriction on ProxySettings)
ProxyEnable: [HKLM] => ProxyEnable is set.
ProxyEnable: [HKLM-x32] => ProxyEnable is set.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Updater.exe 
C:\Program Files (x86)\KMS Updater\Updater.exe
TangsFightDunk
C:\Windows\SysWOW64\twinglossscrod.exe
VeriFaceSrv
C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe
C:\Users\YUXUAN\AppData\Local\Temp\Quarantine.exe
C:\Users\YUXUAN\AppData\Local\Temp\sqlite3.dll
EmptyTemp:
Hosts:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

• Fixlog.txt
• fresh FRST.txt

Hi pricksprocks,

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt
 

Start
S2 TangsFightDunk; "C:\Windows\SysWOW64\twinglossscrod.exe" [X]
S2 Updater.exe; "C:\Program Files (x86)\KMS Updater\Updater.exe" [X] <==== ATTENTION
S2 VeriFaceSrv; "C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe" [X]
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Malwarebytes' Anti-Malware

Download Malwarebytes' Anti-Malware (save it to your desktop).

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Select Scan tab.
  [external image: MBAMDashboard_zpsddef9b5f.gif]
• Select type of scan to perform:
  [external image: MBAMScanTab_zps2c5e74bd.gif]
  • Threat Scan < — Select this type of scan
  • Custom Scan
  • Hyper Scan
• Next click the Scan button.
• When the scan is complete, if no malicious items are found you can close the program.
• If malicious items are found be sure that everything is checked, and click Quarantine .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

=========================

In your next post please provide the following:

• Fixlog.txt
• MBAM.txt
• How is the computer running at the moment?

Hi pricksprocks,

Your MBAM log is incomplete. Did the scan run to completion? If not, please run it again.

[external image: bullseye_zpse9eaf36e.gif] ESET Online Scanner

*Note:

• It is recommended to disable on-board antivirus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
• Please don't go surfing while your resident protection is disabled!
• Once the scan is finished remember to re-enable your antivirus along with your anti-spyware programs.

** You need to run your browser with Administrator Rights, to do so right click your browsers short cut and select "Run as Administrator".

= = = = = = = = = = = = = = = = = = = =

Go here to run ESET Online Scanner

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your Antivirus software. You can usually do this with its Notification Tray icon near the clock
• Click Start
• Make sure that the option "Remove found threats" is Checked, and the option "Scan unwanted applications" is Checked.
• Click Scan.
• Wait for the scan to finish.
• When the scan completes, click List of found threats
• click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
• Include the contents of this report in your next reply
  
  Note - when ESET doesn't find any threats, no report will be created.
• Push the back button.
• Push Finish
• Re-enable your Antivirus software.

=========================

In your next post please provide the following:

• Answer about MBAM log.
• ESET log

Hi pricksprocks,

Thanks for the full MBAM log. I think the way you did the ESET scan should be fine.

[external image: bullseye_zpse9eaf36e.gif] Re- run AdwCleaner

It should be on your desktop

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished…
• This time, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a log file report (AdwCleaner[S1].txt) will open automatically.
• Copy and paste the contents of that log file in your next reply.
• A copy of that log file will also be saved in the C:\AdwCleaner folder.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

• AdwCleaner[S1].txt
• FRST.txt

Hi pricksprocks,

How is the computer running?

If there are no issues currently, test the machine for a day or two and see if the the problem returns.

If you are still having issues now, outline what they are so we can try and remedy them.

So far the computer seems to be running fine and I'll be monitoring the situation for the time being. Thanks for the help rendered!