Weird Content.ie5 Folder Issue

Hi,

Should I worry about these?

(from the AVG scan)

C:\WINDOWS\Temp\kdkxv.ren -> Trojan.PolyCrypt.b : No action taken.

(from the panda scan)

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\fixwareout\FindT\nircmd.exe

No, you don't need to worry about them. kdkxv.ren is the culprit file that has been renamed therefore cannot harm you now, and will be cleaned the next time when you run AVG Anti Spyware or Panda. That's why I asked you to run them again. NirCmd is part of the fixwareout tool which I asked you to download. It's not bad and will also be deleted when you delete the fixwareout folder in C:\ directory.

Also, what exactly was it that was boogering my system, any clue?

It was a DNS hijacker that was redirecting you to a server in Ukraine.

Again, thank you so much. I realize you are doing this for nothing, and just being a good person. I really appreciate your efforts and time. I will use your link to make a donation to the forum this week.

You're welcome and thanks for the donation. It'll help to keep the forum running.

I'll be waiting for the AVG AS and the Panda logs to make sure that file is removed and to finish up with the last steps of the process.

OK… one more time! Here is the AVG scan in safemode… ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 6:08:12 PM 5/29/2007 + Scan result: C:\Documents and Settings\Amanda\Cookies\amanda@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. :mozilla.11:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.12:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.13:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.14:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.15:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.16:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.17:C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\Amanda\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : No action taken. C:\Documents and Settings\Chris\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : No action taken. :mozilla.95:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.96:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.97:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.98:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Advertising : No action taken. C:\Documents and Settings\Chris\Cookies\chris@advertising[2].txt -> TrackingCookie.Advertising : No action taken. :mozilla.10:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Chris\Cookies\chris@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\Chris\Cookies\chris@casalemedia[2].txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.9:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\Chris\Cookies\chris@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\Chris\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken. :mozilla.29:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.30:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.31:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.32:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.26:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. :mozilla.27:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Chris\Cookies\chris@realmedia[2].txt -> TrackingCookie.Realmedia : No action taken. :mozilla.14:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken. :mozilla.15:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken. :mozilla.16:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken. :mozilla.17:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken. :mozilla.18:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken. :mozilla.19:C:\Documents and Settings\Amanda\Application Data\Mozilla\Firefox\Profiles\i5dvyspj.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\Amanda\Cookies\[removed]-sys[2].txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@trafficmp[1].txt -> TrackingCookie.Trafficmp : No action taken. C:\Documents and Settings\Chris\Cookies\chris@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken. C:\Documents and Settings\Amanda\Cookies\amanda@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\Chris\Cookies\chris@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\Amanda\Cookies\[removed][2].txt -> TrackingCookie.Webtrendslive : No action taken. C:\Documents and Settings\Amanda\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\Chris\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : No action taken. ::Report end And here is the Panda Active scan… Incident Status Location Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@ct.360i[1].txt Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@did-it[1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@go[2].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@target[1].txt Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Chloe\Cookies\chloe@ct.360i[1].txt Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Chloe\Cookies\chloe@did-it[1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Chloe\Cookies\chloe@go[1].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Chloe\Cookies\chloe@target[2].txt Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[.tickle.com/] Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[.target.com/] Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[.webpower.com/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[.belnk.com/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[.atwola.com/] Spyware:Cookie/Humanclick Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[hc2.humanclick.com/hc/70256686] Spyware:Cookie/Humanclick Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[hc2.humanclick.com/] Spyware:Cookie/Humanclick Not disinfected C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\6i9wvsl0.default\cookies.txt[hc2.humanclick.com/hc/70256686] Spyware:Cookie/Humanclick Not disinfected C:\Documents and Settings\Chris\Cookies\[removed][1].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\fixwareout\FindT\nircmd.exe I await your reply!

Hi,

All looking good except you didn't seem to have deleted this folder yet, which is not really very important:

C:\fixwareout

You can go ahead and delete it now. Using Windows Explorer (right click on start, click on Explore) navigate to Local Disk(C:) and click on it. You should see "fixwareout" folder in the right pane. Empty your recycle bin.

Since AVG Anti Spyware is a trial version, the realtime guard and automatic update will stop functioning after the trial period. That is why we are not installing the guard so it will not interfere with the cleanup or the malware removal process. You can use AVG-AS as an on-demand scanner (recommended) but you will have to manually update the definition file each time you scan.

I am almost sure the redirections stopped, but would like you to confirm that. If all is well, you can go ahead with the next step.

Please re-enable all the realtime scanners I may have asked you to disable.

=============================

Create a new System Restore point to prevent reinfection from old restore points.

Go to Start>Run and type sysdm.cpl. Press Enter

• Select the System Restore Tab
• Place a check in "Turn off System Restore on all drives"
• Click Apply
• next, uncheck the same checkbox.
• Click Apply
• Click OK

You can also find instructions on how to disable and re enable system restore here:
Windows XP System Restore Guide

A colleague of ours has excellent information and tips on the prevention of malware here and more on improving speed/system performance after malware removal here .

Happy Surfing!

OK, I uninstalled everything I was using. I rebooted my machine (I noticed it the PC acted as if my cdrw and dvd rom drives were new) but everything else seems fine. I tested with the "hockey sticks" search and when I clicked on the results it actually took me there. I browsed to the previously unattainable area and the Content.IE5 folder is no longer there. So I think we are golden! I turned off system restore and then turned it back on and created a new restore point. I am very grateful for your help, I actually work in the IT industry (run a help desk) and this was causing me some major woes. Your instructions and explanations were very easy to follow and I had no trouble understanding. I think we can consider this a solved issue. In the event I notice anything again soon should I post in this thread or start a new one? Thanks again! Chris

You're very welcome. Glad we could help. I'll keep the thread open for a few days and if I don't hear from you, I'll close the thread. Hopefully you'll not have any further issues. If you have any problems in future, you'll need to start a new thread. Stay safe!