[Closed] Yet Another Kurdsoft Issue

Hey guys, I recently recognized an issue with my new laptop that occurs during start up. When I power on and sign in, IE open up immediately and opens two tabs with the following links. The first one is: http://kurdsofts.com/win.htm and it just displays a blank page. In the second tab, http://kurdsofts.com/contact.php opens up with some simple text saying: internal script error. I googled this type of problem and found out that it could potentially be related to a backdoor trojan. I have the capability to perform a factory restore if it is necessary (providing it will be an ultimate fix) and I am open to any suggestions you guys have to offer. Thanks in advance. Included is my most recent log file. The second attachment is a log prior to a system scan performed by McAfee security center.

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Win32up] c:\users\jake orel\appdata\roaming\netconfig.exe

Then close all windows except this one and press Fix checked.

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  c:\users\jake orel\appdata\roaming\netconfig.exe
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
• Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
• Close OTMoveIt

*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

Click "Exit" to close OTMoveIt.

———————————————–

Using Internet Explorer, click on Kaspersky Online Scanner * Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As…' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

I seem to be having a problem with kaspersky online scanner. I spent a while trying to run it by various methods with no luck. I tried running IE as an administrator with no luck and then I installed firefox which didnt work either. My problem occurs when the activex prompt appeares. I accept but every time i do accept, it brings me back to the eulogy and then the process just repeats.

Let's try another. Firefox will not run these. Only IE, but not sure why Kaspersky wouldn't run.

Lets run an F-Secure online scan for Viruses, Spyware and RootKits:

• Go to http://support.f-secure.com/enu/home/ols.shtml
• Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
• Allow the Active X control to be installed on your computer, then click the Accept button
• Click Full System Scan and allow the components to download and the scan to complete.
• If malware is found, check Submit samples to F-Secure then select Automatic cleaning
• When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan

• When the cleaning option is presented, Uncheck Submit samples to F-Secure
• Click Automatic cleaning
• When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Notes:

• This scan will only work with Internet Explorer
• You must have administrator rights to run this scan
• This scan can take several hours, so please be patient

Hey, I configured the security options in IE and performed the karspersky check along with the OTMoveIt, included are the log files.

Do you know what this is? I believe it may be the source of your headaches here.

Folder_Lock_5.7.0_FULL.rar


Run OTMoveIt again and remove these:

C:\Users\Jake Orel\AppData\Roaming\MicrosoftApp32\netcmd.exe
C:\Users\Jake Orel\AppData\Roaming\netconfig.exe
C:\Users\Jake Orel\Downloads\Direct links\Folder_Lock_5.7.0_FULL.rar

Post the new OT log and a fresh HJT log. Let me know how it's running.

Ugh, Folder lock is a cracked program my friend sent me, I never installed it thank god. Should I just delete it?

I never installed it thank god.

You sure about that?

Yes, remove it.

Just for future reference, playing with cracks and keygens will get you nothing but infected. You might get away with it once or twice, but eventually you'll get bit….and I think you were bit here. Backdoors are no joke.

i was looking for an app that locked or enrypted folders but i found a free one and never installed that one… I actually downloaded a couple of ones, maybe I did install it… Anways, should I just go ahead with the OTMoveIT?

Yes

that program moved em, now what?

Post a fresh HJT and let me know how it's running.

How are you making out here? Still need help? Let me know, thanks. Dave

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log