[Resolved] All kinds of malware... :(

Hi Im still wary of this program. kfrm do you know what it is?

We don't, no. We searched for it on the disc and found a folder with another folder in it. Folders were empty, other than that, and the file was created on the 23rd– the day we started having the most problems. (We posted here the next day.) Side note: We play Battlefield2 somewhat often and since closing the ports yesterday, we haven't been able to get the PC to access log-in servers. I have a list here (from the manual) of UDP and TCP ports utilized by BF2 for internet gameplay. I can post the little table that they give, or possibly link to an online version of the manual to get her PC back to allowing BF2 to play online…

Hi

Are these the ports here
http://www.gameconfig.co.uk/showdetail.asp?id=120

Those arent the ports we closed.

This line is interesting though.
O2 - BHO: 0 - {AA210EEE-EC86-4254-A0A9-E7C5CFDE588D} - C:\Program Files\EA GAMES\saguxip.dll (file missing)

Note the file is missing. When I look that file up, the only hit I get is for this topic and EA games doesnt appear to have a search function.

Delete the krfm folder then post the link to the online file, to see if we can get it up and running again.

Kfrm file got the axe. Those are the majority of the ports listed in the manual, yes, and the others are not within the 5000-5020 range, nor do they include 135. (Unfortunately the only manuals I'm finding online are downloadable versions, not direct links). Here they are listed, though: 80 1500-4999 4711 16567 27900 27901 28910 29900 29901 55123-55125 We're looking into options of re-installing BF2, but if its not that missing file (saguixp.dll) then I don't know what would fix it. We've tried disabling firewall protections to get the connection to go through, but to no avail. We also used netstat to find out what the IP location of the connection was and allow connections to that IP (it was seemingly constant). Other than that, we're stumped.

Hi

Im afraid Ive never played BF2 so not sure how it works, but that line I showed you relates to a Browser Helper Object, like an add-on for Internet Explorer.

Dont rush into reinstalling yet. Im willing to help find out the cause.

First of all, the link you click on download a manual. Right-click it and select Copy link address or Copy shortcut address
or similar according to the browser you use. (I use Opera). In your next reply to the right of the smiley icons above is the icon to add a link. Add that link by pasting it in the dialogue box.

I will also consult one of the Tech Helpers to see if BF2 somehow did use those ports and we will see if they can be restored from Back Up.

Again, thanks for all the help. I understand that this isn't something you usually undertake. =)

The manual linked here is for the Euro Forces expansion, but page 23 is exactly the same page which I was referencing from my own BF2 manual.

Edit: When you say "Browser Help Object," does that mean it could be a link in the chain of files that allows the game to connect to a log-in database? So the game would normally be utilizing an IE connection to contact the Electronic Arts servers, but it can't complete the usual process? Hmmm

Hi

I really couldnt say for sure what the BHO did, but that file has been missing since the first HijackThis log you posted. I cant see what I did has caused this. We are talking about different ports. I think the best solution is to talk to the people in the know so I will provide a link to the BF2 forums.
http://forums.easports.com/mboards/categor…a?categoryID=19

It is possible the infection has done something. I take it the game is on CD? You normally get a repair option when you run the installation cd.

Congratulations, you appear to be malware free.

Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the x and the /u, it needs to be there.
  
  [external image: Posted Image]

Here is a free program I recommend.

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Here is some great information from experts in this field that will help you stay clean and safe online.
http://forum.malwareremoval.com/viewtopic.php?t=14

Follow this list and your potential for being infected again will reduce dramatically.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Very, very much appreciated. You did a great job, Scotty; I apologize for not being able to match your schedule. The PC runs much better now, and after a little spring cleaning, I think we'll be well on our way. =D I have no other questions and the thread is free to be closed. Thanks again, Eredas PS: Upgrading to the expansion filled whatever hole was keeping things from working. BF2 plays just fine now.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.