Hey everyone. I hope I am doing this correctly…
About four days ago my internet started to run like it was on a dialup connection. The only thing I had done prior was open an executable file for a game I had downloaded… stupid move, I know. Obviously it infected my computer because it seemed to install things deep in to my system, and from that point on my internet was running SO so slow.
I ran AVG, Housecall, Spybot and Super anti spyware more than three times each. Cleaned everything that they all found. I tried to run Adaware, but everytime it ran, I got the blue screen of death.
So, after everything I have thrown at this computer, I am still having a very slow time trying to navigate in my browsers. I don't have any popups or any processes that are running that look weird.
I use Windows XP home edition.
Below is a fresh Hijack this log.
Logfile of Trend Micro HijackThis v2.0.2http://red.clientapps.yahoo.com/customize/…rch/search.html http://housecall60.trendmicro.com/housecall/xscan60.cab http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab http://update.microsoft.com/windowsupdate/…b?1119845467437 http://www.worldwinner.com/games/v43/paint/paint.cab http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab https://signin3.valueactive.com/Register/Br…OCX/flashax.cab https://casinoclassic.microgaming.com/casin…ic/FlashAX2.cab
Any and all help would be loved. Thank you
Hello
pandymonium and welcome to the
What the Tech Forums
My name is
Trevuren and I will be helping you with your problem.
A. We must disable a security program so that it does not interfere with our fix:
SPYBOT TEATIMER Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode " is selected. On the left hand side, click on Tools, then click on the Resident Icon in the list. Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.Click on the "System Startup" icon in the List Uncheck the "TeaTimer" box and "OK" any prompts.If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted. Exit Spybot S&D when done. (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.] B. Please RUN HijackThis Click the SCAN Place a check mark beside each one of the following items: R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html http://www.worldwinner.com/games/v43/paint/paint.cab https://casinoclassic.microgaming.com/casin…ic/FlashAX2.cab Now with all the items selected, and all windows closed except for HJT delete them by clicking the FIX checked button. Close the HijackThis window.
and
IMMEDIATELY
C. Please
download ComboFix by sUBs from
HERE or
HERE directly to your
Desktop.
Note: If you already have ComboFix on your machine, please
DELETE it from your desktop before downloading the newest version.
Go to
[external image: Posted Image] -> Run ->
copy/paste the following single line command in the runbox & click
OK
"%userprofile%\desktop\combofix.exe" /killall
[external image: Posted Image] ComboFix will automatically start. Any monitoring programs will be shut down like your antivirus, antispyware programs for example. ComboFix may restart your computer, this is normal. When finished, it will produce a log, ComboFix.txt . Please post ComboFix.txt in your next reply along with a new HijackThis log . Notes:
1.
Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine.
Wow, that was a fast response, thank you SO much! I have been so frustrated with this problem.
I did what you said, except the Combofix did not produce a log file after it rebooted my system. It said it was producing one, and not to start any programs until it had, but it never did.. should I try it again?
Here is the fresh Hijack this log:
Logfile of Trend Micro HijackThis v2.0.2http://housecall60.trendmicro.com/housecall/xscan60.cab http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab http://update.microsoft.com/windowsupdate/…b?1119845467437 http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab https://signin3.valueactive.com/Register/Br…OCX/flashax.cab
A. The ComboFix.txt does not stay on your screen for a very long time. You should stay by your machine whilst it is running.
Usually , a copy can be found at C:\ComboFix.txt. If after doing a search of your system, you can not locate a file called ComboFix.txt, please run the tool again but only after having done the following.
B. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
Updating Java: Download the latest version of Java Runtime Environment (JRE) 6u4 . Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications ". Click the "Download " button to the right. In the pull down menu next to Platform select Windows Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement " Click Continue Click on the link to download Windows Offline Installation and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.
Now to
Clean out the Java cache :
Go into the Control Panel and double-click the Java Icon.
Under Temporary Internet Files, click the Delete Files button. There are three options in the window to clear the cache - Leave ALL 3 Checked Downloaded Applets Click OK on Delete Temporary Files WindowNote: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Java Control Panel.
Edit: Typos
Thank you again, you are such a wonderful help. I -really- appreciate this!
Alright, I uninstalled the Java, reinstalled the new Java, deleted the temp files and then ran Combofix again. Here is the log…
ComboFix 08-02-20.2 - Sadie 2008-02-20 18:47:48.2 - NTFSx86WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
d——– C:\Documents and Settings\All Users.WINDOWS.0\Application Data\MailFrontier
So far, my internet is running a bit better, however, images are still fairly slow in downloading on websites.
There is also still some lag when trying to load webpages period. It is not taking half as long as it was yesterday, but it is still noticeably sluggish. My computer is usually much faster at these things.
Thank you again for your help, I don't know what I would have done without you!
Do you want me to post a fresh HijackThis log too?
You are missing the entire half of the ComboFix.txtwith a fresh HijackThis log .
That was all that was inside the file titled "Combofix.txt"… I have ran it twice, and that seems to be all that is saved in the text file. Am I doing something wrong?
I was not aware of the keylogger… It doesn't seem to be coming up in any programs I scan my computer with.
Getting Hijack this file now…
Logfile of Trend Micro HijackThis v2.0.2http://housecall60.trendmicro.com/housecall/xscan60.cab http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab http://update.microsoft.com/windowsupdate/…b?1119845467437 http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab https://signin3.valueactive.com/Register/Br…OCX/flashax.cab
We will have to try and get the results that I need another way.
Keylogger files:
C:\Program Files\akl
If this computer was used for any financial transactions I would seriously consider contacting any Bank/Financial institution that I may have dealt with online and changing all passwords. In addition, I would assume that all my online passwords have been compromised in addition to any "private" email that I may have sent.
Now for the info that I need:
Please download Deckard's System Scanner (DSS) to your desktop.
Close all applications and windows.Double-click on dss.exe to run it, and follow the prompts.When the scan is complete, a text file will open - Main.txt Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum . An additional text file, Extra.txt ,will also be available (by default) in the following FOLDER, C:\Deckard\System Scanner . Please go to that FOLDER and also copy the contents of Extra.txt to your post as well. Note: some firewalls may warn that
sigcheck.exe is trying to access the internet - please ensure that you allow
sigcheck.exe permission to do so.
What DSS will do:
Create a new System Restore point in Windows XP and Vista . Clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives. Check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed.
Post Logs: DSS Scan Results: contents of 1) Main.txt and 2) Extra.txt
Alright, here are the results:
Main.txt
Deckard's System Scanner v20071014.68Total Physical Memory: 352 MiB (512 MiB recommended). http://housecall60.trendmicro.com/housecall/xscan60.cab http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab http://update.microsoft.com/windowsupdate/…b?1119845467437 http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab https://signin3.valueactive.com/Register/Br…OCX/flashax.cab http://red.clientapps.yahoo.com/customize/…rch/search.html http://www.worldwinner.com/games/v43/paint/paint.cab https://casinoclassic.microgaming.com/casin…ic/FlashAX2.cab .bat - batfile - DefaultIcon - C:\WINDOWS.0\System32\shell32.dll,-153 .hlp - hlpfile - DefaultIcon - C:\WINDOWS.0\hh.exe,0 .inf - inffile - DefaultIcon - C:\WINDOWS.0\System32\shell32.dll,-151 .ini - inifile - DefaultIcon - C:\WINDOWS.0\System32\shell32.dll,-151 .js - JSFile - DefaultIcon - unable to read value .js - JSFile - shell\open\command - unable to read value .reg - regfile - DefaultIcon - C:\WINDOWS.0\regedit.exe,1 .txt - txtfile - DefaultIcon - C:\WINDOWS.0\system32\shell32.dll,-152
Extra.txt
Deckard's System Scanner v20071014.68(admin) (admin)
As you have probably already guessed, your system is pretty messed up. There is no guarantee that we will be able to make it perfect again. First off, we must fix all your file associations:
A. To repair the faulty file associations, please do the following: Make sure that DSS.exe is located on your Desktop . Click on your START button, then choose Run . A little box will appear. Now copy and paste all the following in bold (including the "" OK ."%userprofile%\desktop\dss.exe" /daft This will start DSS in a different way. A small window will appear. Click on the Scan button. If it finds faulty file associations, they will appear in red beside a checkbox. If this occurs, just place a tick in the boxes in question. Click the Fix button. Re-scan and save a logfile. By default, it will save as daft.txt . .
B. 1. Please
open Notepad Click Start , then Run Type notepad .exe in the Run Box.
2. Now
copy/paste the entire content of the codebox below into the Notepad window:
KillAll::
File::
c:\windows.0\system32\drivers\dkbfltr.sys
C:\1409328528
C:\WINDOWS.0\system32\jkghje.dll
C:\WINDOWS.0\pss\.protectedCommon Startup
C:\WINDOWS.0\pss\.protectedStartup
C:\WINDOWS.0\system32\drvlig.dl
c:\windows.0\system32\ebsbexfpsc.exe
C:\Program Files\ahsbgrcr\olkjapmz.dll
c:\windows.0\system32\laejwbinca.exe
C:\Windows\xpupdate.exe
C:\Program Files\Ultimate Fixer\UltimateFixer.exe
C:\Documents and Settings\All Users.WINDOWS.0\Application Data\yxoferov.dll
Dir::
C:\Program Files\ahsbgrcr
C:\Program Files\wtititql
Driver::
EagleNT
DKbFltr
gkmixern
npkcrypt
PID_0920
TSP
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^.protected]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Palo Alto Software Update Manager 8.0.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^WiziWYG XP Startup.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sadie^Start Menu^Programs^Startup^.protected]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sadie^Start Menu^Programs^Startup^Webshots.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ebsbexfpsc]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmbkfyzk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\laejwbinca]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Fixer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wirehog]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wtititql]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\yxoferov]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3.
Save the above as
CFScript.txt
4. Now
drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
5. All your monitoring programs (Antivirus/Antispyware, Guards and Shields) will be stopped.
[external image: Posted Image]
Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.
6. ComboFix will
automatically REBOOT your machine when the
KillAll:: switch is used..
7.
Post the following logs/Reports:
ComboFix.txt Fresh HijackThis log run after all the other tools have performed their cleanup. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine.
Haha, yeah I know, my computer is a bit of a mess. I have not been able to reformat it in about two years due to not having my recovery CD anymore. My cousin 'borrowed' it and never returned it. I am always scared it will need reformatting one of these days.
Alright, so I did what you suggested, here are the log files…
Hijack this:
Logfile of Trend Micro HijackThis v2.0.2http://housecall60.trendmicro.com/housecall/xscan60.cab http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab http://update.microsoft.com/windowsupdate/…b?1119845467437 http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab https://signin3.valueactive.com/Register/Br…OCX/flashax.cab
Combofix.txt
ComboFix 08-02-20.2 - Sadie 2008-02-20 21:39:36.3 - NTFSx86WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
daft.txt
DAFT Log saved on 2008-02-20 21:36:52
Please run DSS again and post the log.
Trevuren
Using Internet Explorer , please do a
Kaspersky Online Scan . This scan takes about 60 minutes to complete.
Answer
Yes , when prompted to install an ActiveX component.
The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure as follows: Scan using the following Anti-Virus database: Scan Options:Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will provide a report if your system is infected . It does not provide an option to clean/disinfect. We only require a report from it. [external image: Posted Image] Click the Save as Text button to save the file to your desktop and post it in your next reply along with a fresh HijackThis log * Turn off the real time scanner of any existing antivirus program while performing the online scan
Also please tell me how your system is now running.
That is perfect because I have to go away from my computer for about that long soon, so I will run it while I am absent =)
My computer is actually running better than it has in a LONG time, especially noticed when I open 'My Computer' and it does not do a search to find the files. It just opens and there everything is. Bravo!
My internet is also running amazing it seems. I have not done much browsing on it tonight, but everytime I open this forum, or my homepage, it loads almost instantly.
You are awesome!
I will have that log and post it tonight.
One good thing about having spyware issues is it leads to a VERY clean computer… at least, as clean as it has been in ages.
