Can't Search Over Google And Yahoo! Need Immediate Help!

Hello Hurricane Andrew and Welcome to TomCoyote,

Please do the following:

HostsXpert

Please download HoxtXpert.

• Unzip HostsXpert.zip
• Double click on HostsXpert.exe
• Then click on "Restore Original Hosts" to restore your Hosts file to its default condidtion..
• Click on Make Hosts Read Only to secure it against further infection.
• Close program when complete.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Kaspersky log showed the following infected file which we need to delete

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\Documents and Settings\Contol\My Documents\Nero-7.8.5.0_eng_trial.exe<=file
Exit Explorer, and reboot as normal afterwards.

No Firewall Onboard

Also I do not see a firewall application installed. Perhaps you have a hardware firewall but a combination of both a software firewall and a hardware firewall is better. Just be sure there are no conflicts. Please do not rely solely on the Windows XP firewall. Using a software firewall other than the XP firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

• ZoneAlarm
• Tiny Personal Firewall
• Comodo Free Firewall

Test your Firewall - Please test your firewall and make sure it is working properly.
Test Firewall

There are some registry entries that should be fixed and I am researching the best way to do it. Otherwise how is your computer running?

My computer seems to be working fine. I have the deleted detected carrying a malware. I have tested the scanners on Hackerwatch and it says I am secured. What concers are those files seens on registry like infrom.exe and ravmone.exe which I believe aren't built-in windows systems files. Can you help me how to remove it?

Please do the following:

Backup the registry:

======
Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: If you should need to restore your registry, go to the folder and start ERDNT.exe

Then, go to start–>run

and type this in:
notepad

Paste this into the box:

REGEDIT4

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e73442e-f51e-11db-9c52-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e734438-f51e-11db-9c52-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e73443d-f51e-11db-9c52-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e734444-f51e-11db-9c52-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e734448-f51e-11db-9c52-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70874951-f8f2-11db-9c53-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70874954-f8f2-11db-9c53-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b490377e-fdba-11db-9c5d-0017317838d5}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d5687622-fc95-11db-9c5c-0009dd50281f}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d5687624-fc95-11db-9c5c-0009dd50281f}]

Then click on the FILE menu and select save as
Save the file as regfix.reg. Save the file to the desktop.
IMPORTANT: make sure to save the file as "all types" and NOT as a text file
**

Now double click on regfix.reg and insert it into the registry.
Please run Deckard’s System Scanner again and post (reply) with the results.

I will have to study this. We got a few of the registry entries but not all.

STEP 1.
======
SDFix

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Also download SDFix.exe
and save it to the Desktop.

====
Start the computer in Safe Mode :
-When the machine first starts again, tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
-Select the option for Safe Mode using the arrow keys.
-Press Enter to boot into Safe Mode.

====
Open the SDFix folder on the Desktop, and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
The process removes any Trojan Services or Registry Entries found, and then prompts you to press any key to Reboot.

Press any key to restart the PC.
When the PC restarts the SDFix will run again and complete the removal process
It then displays Finished
Press any key to end the script and load the Desktop icons.

Once the Desktop icons load, the SDFix report opens on screen and saves itself in the SDFix folder as Report.txt.

STEP 2.
======
I need you to search for a file named autorun.inf
I have a few autorun.inf files myself located in different places, so you may have more than one. But I am very interested in the contents of the files. I am looking for lines like
shellexecute=wscript.exe FS6519.dll.vbs
and maybe the others like Document.exe, etc.

The easiest way is to use the search facility and then with the search results you have the Window with the Name and the Location. If you just left-click (maybe twice) the file name under the Name, it opens with Notepad and you see the contents.
Please copy and paste the contents along with the file location and save that to post and reply so I can view them, and then close the file.

For example – I have a file C:\Intel\wireless_7.1.4.6_generic_125315\autorun.inf

The contents are:

[autorun]
ICON=AUTORUN.EXE
OPEN=AUTORUN.EXE

Please post (reply) with the Report.txt and information about the autorun.inf files.

Here is the SDFix Log


SDFix: Version 1.84

Run by [removed]
Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\Contol\Desktop\SDFix

Safe Mode:
Checking Services:






Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

No Trojan Files Found…




Removing Temp Files…

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.



Final Check:

Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Caffe\\Server.exe"="C:\\Program Files\\Caffe\\Server.exe:*:Enabled:Server"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


Remaining Files:
—————


Checking For Files with Hidden Attributes:

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\Contol\Local Settings\Application Data\Microsoft\Media Player\MTVN\Downloads366F8C0\BIT225.tmp

Finished

AUTORUN.INF at
C:\Program Files\Nero\Nero 7\Core\SecurDisc containing the following
[AutoRun]
open=discinfo.exe

Hi Hurricane Andrew,

Please do the following:

STEP 1.
======
Flash Disinfector by sUBs
Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

• Double-click Flash_Disinfector.exe to run it.
• Follow any prompts that may appear.
• Wait until the program has finished scanning, then please exit the program.
  The tool may ask you to insert your flash drive, or other removable drives. Please do so and allow the tool to clean it up as well.

Please restart your computer

If you still have Deckard’s System Scanner present on your computer, please do the following:

• Close all applications and windows.
• Go to start =>run => copy the following bold text into the box and click OK
  ”%userprofile%\desktop\dss.exe” /config
  A pop-up box will appear, please make sure the Main Log and Hijack This, File Dump, Registry Dump is checked, click the Scan button.
• When the scan is complete, you will see the main.txt <- this one will be maximized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt to your post. in your reply

Because no reply was made. This topic is now closed. If you wish it reopened, please send us an email
(Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.


Also follow the recommendations in Tony Klein's article
So how did I get infected in the first place?