What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google Deutschland

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17 last edited

Do you know what these are?

O8 - Extra context menu item: &Dictionary - http://files.db3nf.com/scripts/ie.htm
O8 - Extra context menu item: &Encyclopedia - http://files.db3nf.com/scripts/ie-e.htm
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\system32\wweb32.dll/lookup.html


Not sure if I understand but I know that the first two are Internet Explorer right click context menu options to highlight a word and then choose to see it in an online dictionary or encylopedia (screenshot 1 & 2). Although the right click options bring up the Free Dictionary by Farlex perhaps the entry refers to db3nf.com which is a Web Application Development website. I don't know anything about db3nf.com.

The third one is also a IE right-click option to view the highlighted word in an application called WordWeb that is a dictionary utility that I have used for years.

I hope I understood your question correctly :unsure:

BTW, thanks for all your help on this!

Attachments:

  • [attachment removed: rightclick1.gif]
  • [attachment removed: rightclick2.gif]
Post #19
I appreciate your help trying to solve this. I'll try the forum you gave a link to. Can I post a link to this topic so others may see what we've tried? Were the two files, 5FB14D7F90.sys and GizC3A7.dll, that were deleted or quarantined by Combo-Fix viruses or malware?
Post #20

Can I post a link to this topic so others may see what we've tried?

Yes.

Were the two files, 5FB14D7F90.sys and GizC3A7.dll, that were deleted or quarantined by Combo-Fix viruses or malware?

They were random files so not sure what they were.
Post #21
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    Here's my usual all clean post

    Log looks good :D


    You need to create a new Clean restore point.

    Note: This will remove all previous Restore Points

    Click Start Menu > Run > copy and paste

    %SystemRoot%\System32\restore\rstrui.exe

    Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

    Double-click My Computer.
    Click the Tools menu, and then click Folder Options.
    Click the View tab.
    Check "Hide file extensions for known file types."
    Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
    Check "Hide protected operating system files."
    Click Apply, and then click OK.
Post #22
LDTate,

Before I do what you have outlined there is a chance that I may have made a mistake when I first ran Combo-Fix. I think I had check marked the Folder Options/View "Hide protected operating system files." before running Combo-Fix and the steps afterward. Would that have had an adverse effect on what Combo-Fix would have found? Do I need to re-run Combo-Fix and the subsequent script you sent with that View option changed?

As regards the 1st Run command I saw from a post on another topic that would remove Combo-Fix and it's logs and files. Is this correct?

You need to create a new Clean restore point.
Note: This will remove all previous Restore Points
Click Start Menu > Run > copy and paste
%SystemRoot%\System32\restore\rstrui.exe
Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

I have no problem removing previous Restore Points but would just like to confirm that is what the 2nd Run command accomplishes.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

May I ask your reason for enabling Hiding known file extensions and disabling Show hidden files and folders? I'm just curious as to why those settings you've listed are preferred.

Thanks again for the assistance.
Post #23

Before I do what you have outlined there is a chance that I may have made a mistake when I first ran Combo-Fix. I think I had check marked the Folder Options/View "Hide protected operating system files." before running Combo-Fix and the steps afterward. Would that have had an adverse effect on what Combo-Fix would have found? Do I need to re-run Combo-Fix and the subsequent script you sent with that View option changed?

I don't think so.

As regards the 1st Run command I saw from a post on another topic that would remove Combo-Fix and it's logs and files. Is this correct?

Yes

You need to create a new Clean restore point.
Note: This will remove all previous Restore Points
Click Start Menu > Run > copy and paste
%SystemRoot%\System32\restore\rstrui.exe
Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

I have no problem removing previous Restore Points but would just like to confirm that is what the 2nd Run command accomplishes.

Yes, that's what it does.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

May I ask your reason for enabling Hiding known file extensions and disabling Show hidden files and folders? I'm just curious as to why those settings you've listed are preferred.

Some malware will hide it's self. If they are hidden I can't see them.
Post #24

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Some malware will hide it's self. If they are hidden I can't see them.


I'm sorry if I don't quite understand. It appears that the settings above would hide file extensions for known file types, hidden files and folders and protected operating system files.Is this correct?
Post #25

I'm sorry if I don't quite understand. It appears that the settings above would hide file extensions for known file types, hidden files and folders and protected operating system files.Is this correct?

Yes. That is windows default settings.
Post #26

I'm sorry if I don't quite understand. It appears that the settings above would hide file extensions for known file types, hidden files and folders and protected operating system files.Is this correct?

Yes. That is windows default settings.

OK, I'll go ahead and delete old restore points, set a new one and change the settings. Thanks again for the help.

BTW, I posted a log from Malwarebytes scan I did late yesterday to the other forum that showed an infection called Trojan.Agent for a file called Smab.dll. I did some research and found that this was installed when I installed a program called Super C, a video converter. I scanned the file with AVS and also submitted it online to various scanners and they returned no threat findings. There are many posts on forums relative to this file and most say that it is a false positive IF I downloaded the program from the developer's website which I did. I would appreciate your input on this.

Malwarebytes' Anti-Malware 1.03
Database version: 345

Scan type: Quick Scan
Objects scanned: 25293
Time elapsed: 3 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\Smab.dll (Trojan.Agent) -> No action taken.

Attachments:

  • [attachment removed: avs1.gif]
Post #27
Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\SYSTEM32\Smab.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html
Post #28 last edited

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\SYSTEM32\Smab.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html

Scan results from Jotti – nothing found.
Scan results from VirusTotal – 4 suspicious found.

Attachments:

  • [attachment removed: jotti1_revised.gif]
  • [attachment removed: virustotal2.gif]
Post #29
That's a new infection. Did you download a Codec?

Description Adware downloader causing false spyware warnings, a member of the Trojan-Downloader.Zlob.Media-Codec aka NewMediaCodec malware family


Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #30

That's a new infection. Did you download a Codec?

I think that Super C, being a video converter, might have downloaded new codecs.

Description Adware downloader causing false spyware warnings, a member of the Trojan-Downloader.Zlob.Media-Codec aka NewMediaCodec malware family


Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.


I'll download a new Combo-Fix and run per your instructions. As regards Tools>Folder Options>View options should I have known file type extensions, hidden files and folders and protected operating system files visible when I run Combo-Fix?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI