so somehow my wife downloaded the dreaded "google redirect" virus, and after running malwarebytes anti-malware I removed 7 files and rebooted.. unfortunately IE will not work now.. I know the wireless is working because I'm on another laptop now, and outlook will still download my emails on the infected computer.. not sure what to do next… please help & thanks
Hi, and Welcome to
WhatTheTech
My name is
jpshortstuff . I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic.
Please post the log from MalwareBytes' AntiMalware. It should be here:
C:\Program Files\Malwarebytes' Anti-Malware\Logs\
log-date .txt
Let's try something to restore your Internet access.
Open HijackThis. Hit
Do A System Scan Only . Place a check next to the following items (if present):
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
Close
all browsers and windows
except for HijackThis and click
Fix Checked .
Please download
ATF Cleaner by
Atribune .
Download - ATF Cleaner»
Double-click
ATF-Cleaner.exe to run the program.
Under
Main choose:
Select All
Click the
Empty Selected button.
(If you use
FireFox or the
Opera browser
To keep saved passwords, click
No at the prompt.)
It's normal after running
ATF cleaner that the PC will be slower to boot the first time or two.
Please download
DDS and save it to your desktop.
Disable any script blocking protection Double click dds.scr to run the tool. When done, DDS.txt will open. Click Yes at the next prompt for Optional Scan . Save both reports to your desktop. —————————————————
Post DDS.txt report in your next replyAttach Attach.txt Attachments area and then clicking Browse . Browse to where you saved the file, and click Open and the click UPLOAD .Thanks.
When I removed the two files from HJT my internet started working….. thank you sooooo much!!! I still don't have a clue what I removed or why it worked, but right now i'm all smiles (after hours and hours of doing all the simple fixes I know to do)
Here is my mbam-log
Malwarebytes' Anti-Malware 1.30
Database version: 1423
Windows 5.1.2600 Service Pack 3
11/25/2008 9:12:27 PM
mbam-log-2008-11-25 (21-12-27).txt
Scan type: Quick Scan
Objects scanned: 62905
Time elapsed: 33 minute(s), 16 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\z444.z444mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\z444.z444mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a48fe9ac-dd02-4ff7-9211-b7ba9a2c8bf2} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a48fe9ac-dd02-4ff7-9211-b7ba9a2c8bf2} (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\TinyProxy (Trojan.Proxy) -> Delete on reboot.
C:\WINDOWS\system32\890166 (Trojan.BHO) -> Quarantined and deleted successfully.
Files Infected:
C:\Program Files\TinyProxy\trz564.tmp (Trojan.Proxy) -> Delete on reboot.
C:\WINDOWS\tmark2.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\fmark2.dat (Malware.Trace) -> Quarantined and deleted successfully.
Ran ATF and deleted 880mb of files
DDS (Version 1.0) - NTFSx86
Run by [removed] at 11:13:02.15 on Wed 11/26/2008
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.479 [GMT -6:00]
Here is DDS
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeff Davidson\Desktop\dds.scr
============== Psuedo HJT Report ===============
uStart Page = about:blank
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=3061204
uInternet Connection Wizard,ShellNext = iexplore
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
BHO: {02478D38-C3F9-4EFB-9B51-7695ECA05670} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\progra~1\yahoo!\companion\installs\cpn1\yt.dll
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [EasyLinkAdvisor] "c:\program files\linksys easylink advisor\LinksysAgent.exe" /startup
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [CTSVolFE.exe] "c:\program files\creative\mixer\CTSVolFE.exe" /r
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 5.0\apdproxy.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\docume~1\jeffda~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-12 110160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-11-12 20560]
=============== Created Last 30 ================
2008-11-25 22:34 –d—– c:\program files\Trend Micro
2008-11-25 20:01 –d—– c:\docume~1\jeffda~1\applic~1\Malwarebytes
2008-11-25 20:01 15,504 a——- c:\windows\system32\drivers\mbam.sys
2008-11-25 20:01 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-25 20:01 –d—– c:\program files\Malwarebytes' Anti-Malware
2008-11-25 20:01 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-11-16 20:48 0 —-h— c:\windows\f49f4d98.dat
2008-11-11 20:20 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 20:20 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll
2008-11-07 11:47 1 —-h— c:\windows\f49f4daa.dat
==================== Find3M ====================
2008-11-25 22:13 –d—– c:\program files\common files\Symantec Shared
2008-11-25 22:09 –d—– c:\docume~1\alluse~1\applic~1\Symantec
2008-10-16 00:35 –d—– c:\program files\Messenger
2008-10-16 00:30 88,183 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-10-16 00:10 –d—– c:\program files\Windows NT
2008-10-15 23:15 –d—– c:\docume~1\jeffda~1\applic~1\Symantec
2008-10-15 23:09 –d—– c:\program files\Norton 360
2008-10-15 10:34 337,408 ——– c:\windows\system32\dllcache\netapi32.dll
2008-10-03 11:41 6,066,176 ——– c:\windows\system32\dllcache\ieframe.dll
2008-09-30 16:43 1,286,152 a——- c:\windows\system32\msxml4.dll
2008-09-15 22:43 –d—– c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-15 06:12 1,846,400 a——- c:\windows\system32\win32k.sys
2008-09-15 06:12 1,846,400 ——– c:\windows\system32\dllcache\win32k.sys
2008-09-09 19:14 1,307,648 a——- c:\windows\system32\msxml6.dll
2008-09-09 19:14 1,307,648 ——– c:\windows\system32\dllcache\msxml6.dll
2008-09-08 04:41 333,824 ——– c:\windows\system32\dllcache\srv.sys
2008-09-04 11:15 1,106,944 a——- c:\windows\system32\msxml3.dll
2008-08-29 09:18 87,336 a——- c:\windows\system32\dns-sd.exe
2008-08-29 08:53 61,440 a——- c:\windows\system32\dnssd.dll
2007-10-20 15:30 –d—– c:\docume~1\alluse~1\applic~1\espionServerData
2007-03-10 10:18 –d—– c:\docume~1\jeffda~1\applic~1\Viewpoint
2007-03-10 10:18 –d—– c:\docume~1\alluse~1\applic~1\Viewpoint
2007-01-02 03:19 –d—– c:\docume~1\jeffda~1\applic~1\vlc
2007-01-01 23:14 –d—– c:\docume~1\jeffda~1\applic~1\AOL
2006-12-26 23:17 –d—– c:\docume~1\jeffda~1\applic~1\Research In Motion
2006-12-26 23:16 –d—– c:\docume~1\jeffda~1\applic~1\Blackberry Desktop
2006-12-04 08:02 –d—– c:\docume~1\alluse~1\applic~1\Corel
2006-12-25 15:25 88 —shr– c:\windows\system32\674948BAE4.sys
2006-12-25 15:25 2,828 a–sh— c:\windows\system32\KGyGaAvL.sys
============= FINISH: 11:13:25.79 ===============
Let me know if I look all clear, thanks again
Hi
Glad to hear that worked.
LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.
References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm
See Clean/Infected P2P Programs here
I would recommend that you uninstall
LimeWire , however that choice is up to you. If you choose to remove these programs, you can do so via
Control Panel >> Add or Remove Programs .
If you wish to keep it, please do not use it until your computer is cleaned.
We need to make sure all hidden files are showing so please:
Click Start . Open My Computer . Select the Tools menu and click Folder Options . Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders . Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK .
Please
Right Click your Start button, and click
Explore .
Next, locate and delete the following files and folders (if present):
Files:
c:\windows\
f49f4d98.dat < f49f4daa.dat < Your Java Runtime Environment is out of date. Please follow these steps to remove older version Java components and update. Updating Java: Download the latest version of Java Runtime Environment (JRE) 6 Update 10 . Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 10 , The Java SE Runtime Environment (JRE) allows end-users to run Java applications" . Click the "Download" button to the right. Check the box that says: "Accept License Agreement" . The page will refresh. Click on the link to download Windows Offline Installation, Multi-language and save it to your desktop. Close any programs you may have running - especially any web browsers. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java . Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u10-windowsi586.exe to install the newest version. Kaspersky website Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run . When the downloads have finished, click on Settings . Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Click on My Computer under Scan . Once the scan is complete, it will display the results. Click on View Scan Report . You will see a list of infected items there. Click on Save Report As… . Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply, along with a fresh HijackThis log .
I will remove Limewire and do everything instructed ASAP.. I'm away from my computer over thanksgiving, but will work on it Sunday when I return..
thanks again & Happy thanksgiving
Jeff
Hi, hope you had a good thanksgiving.
Still after help here?
yes, got back in town and finally able to finish working on the computer..
I uninstalled Limewire, and tried to delete those 2 files, but couldnt find them..
I update Java…
now I'm working on the scans and will post those tomorrow after they are complete…
thanks for checking in on me
No problem, thanks for letting me know
Just checking - did you show all hidden files before looking for those files? (I have to ask).
Ok… that online virus scan took almost 4 hours… sorry for the delay… looks like everything is ok.. (yes I had all hidden files shown)
Hi
flamethewolf
Log looks good
You can now delete any other tools I had you download and use, unless you wish to keep them.
Set correct settings for files that should be hidden in Windows XP Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab. Under "Hidden files and folders" if necessary select Do not show hidden files and folders . If unchecked please checkHide protected operating system files (Recommended) If necessary check "Display content of system folders" If necessary Uncheck Hide file extensions for known file types . Click OK
Now that your system appears to be clean, theres just a few steps I'd like you to take to prevent any future infections.
System restore: Go to Start > All Programs > Accessories > System Tools > System Restore Select Create a restore point , and Ok it. Next, go to Start > Run and type in cleanmgr Select the More options tab Choose the option to clean up system restore and OK it. Make sure you do this now, as your System Restore currently has infected files in it. Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis. Make sure you update Some more programs that it would be useful to have [OPTIONAL but RECOMMENDED] Spybot Search and Destroy 1.5 here Check for Updates/ Immunize and run a Full System Scan on a regular basis.SpywareBlaster Download SpywareBlaster Download and install the free version of WinPatrol . This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.
Also, please read this great article by Tony Klein:
So How Did I Get Infected In First Place
Glad we could be of assistance.
Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.
Stay Clean!
jpshortstuff
got everything taken care of.. cosider the issue resolved..
thanks again
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
