Jump to content

ultronator

Members
  • Posts

    9
  • Joined

  • Last visited

Posts posted by ultronator

  1. <p> </p>

    <div>Hi, here's what the Eset scan found:</div>

    <div> </div>

    <div>C:\ProgramData\Microsoft\Windows\DRM\526E.tmp.dat<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Kryptik.AGNZ trojan</div>

    <div>C:\ProgramData\Microsoft\Windows\DRM\6906.tmp.dat<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Kryptik.AGNZ trojan</div>

    <div>C:\ProgramData\Microsoft\Windows\DRM\9DA8.tmp.dat<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Kryptik.AHTD trojan</div>

    <div>C:\Users\All Users\Microsoft\Windows\DRM\526E.tmp.dat<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Kryptik.AGNZ trojan</div>

    <div>C:\Users\All Users\Microsoft\Windows\DRM\6906.tmp.dat<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Kryptik.AGNZ trojan</div>

    <div>C:\Users\All Users\Microsoft\Windows\DRM\9DA8.tmp.dat<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Kryptik.AHTD trojan</div>

    <div> </div>

  2. Revo did not find anything except Java 6 Update 37, so I used Add/Remove programs to get rid of both Javas installed. Neither Revo or Add/Remove was able to find any of the other programs (Ask Toolbar and Bing), but I remember removing Ask on my own before we started this whole process.

    Java asked me to install Ask toolbar, which I unchecked, and CCleaner didn't ask me to install Yahoo toolbar, so you should probably update your instructions.

    Here are the two log files you requested, no signs of any problems lately:

    Malwarebytes Anti-Malware 1.70.0.1100

    www.malwarebytes.org

    Database version: v2013.01.06.06

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Clarissa :: CLARISSA-HP [administrator]

    1/6/2013 4:17:06 PM

    mbam-log-2013-01-06 (16-17-06).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 212119

    Time elapsed: 2 minute(s), 53 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    ***************************************************************************************

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 4:28:00 PM, on 1/6/2013

    Platform: Windows 7 SP1 (WinNT 6.00.3505)

    MSIE: Internet Explorer v9.00 (9.00.8112.16457)

    Boot mode: Normal

    Running processes:

    C:\Program Files (x86)\ooVoo\ooVoo.exe

    C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe

    C:\Program Files (x86)\SafeConnect\scClient.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

    C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

    C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe

    C:\Windows\SysWOW64\RunDll32.exe

    C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe

    C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Users\Clarissa\Desktop\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

    http://g.msn.com/HPNOT/1

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

    http://go.microsoft....k/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

    http://go.microsoft....k/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows

    \SysWOW64\blank.htm

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =

    *.local

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files

    (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

    Files (x86)\Java\jre7\bin\ssv.dll

    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:

    \Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:

    \Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program

    Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck

    \HPNetworkCheckPlugin.dll

    O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static

    \CLIStart.exe" MSRun

    O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage

    Technology\IAStorIcon.exe

    O4 - HKLM\..\Run: [HP Envy Guides AutoPlay] C:\Program Files (x86)\Hewlett-Packard\HP ENVY

    Document Card Utilities\hpdocstart.exe

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM

    \1.0\AdobeARM.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -

    atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch

    \HPMSGSVC.exe

    O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft

    \Connection Service\Bin\ACDaemon.exe

    O4 - HKLM\..\Run: [Absolute Notifier] "C:\Program Files (x86)\Absolute Software\Absolute

    Notifier\AbsoluteNotifier.exe"

    O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX

    \CNSEMAIN.EXE /logon

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java

    Update\jusched.exe"

    O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files (x86)\ooVoo\oovoo.exe /minimized

    O4 - Global Startup: Bluetooth.lnk = ?

    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files (x86)\Kodak\Kodak

    EasyShare software\bin\EasyShare.exe

    O4 - Global Startup: SafeConnect.lnk = ?

    O4 - Global Startup: Stardock MyColors.lnk = C:\Program Files (x86)\Stardock\MyColors

    \SDDelayedLaunch.exe

    O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files

    \WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

    O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM

    \Bluetooth Software\btsendto_ie.htm

    O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer

    \WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program

    Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer

    \WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program

    Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources

    \HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} -

    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck

    \NCLauncherFromIE.exe

    O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework

    \Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-

    DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources

    \HPNetworkCheck\NCLauncherFromIE.exe

    O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program

    Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

    O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-

    5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared

    \windows live\wlidnsp.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared

    \windows live\wlidnsp.dll

    O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:

    \PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

    O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files

    (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    O23 - Service: Absolute Notifier (AbsoluteNotifier) - Absolute Software - C:\Program Files

    (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe

    O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files

    (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

    O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems

    Incorporated - C:\Program Files (x86)\Adobe\Elements Organizer

    8.0\PhotoshopElementsFileAgent.exe

    O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated

    - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe

    Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

    O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation -

    C:\Program Files\IDT\WDM\AESTSr64.exe

    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows

    \System32\alg.exe (file missing)

    O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows

    \system32\atiesrxx.exe (file missing)

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files

    \Apple\Mobile Device Support\AppleMobileDeviceService.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour

    \mDNSResponder.exe

    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files

    \WIDCOMM\Bluetooth Software\btwdins.exe

    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows

    \System32\lsass.exe (file missing)

    O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:

    \Program Files\Intel\WiFi\bin\EvtEng.exe

    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows

    \system32\fxssvc.exe (file missing)

    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files

    (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files

    (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files

    (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files

    (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

    O23 - Service: HP Wireless Assistant Service - Hewlett-Packard Company - C:\Program Files

    \Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

    O23 - Service: HP Documention Flash Card Detection Service (hpdoccardsvc) - Hewlett-Packard

    Developement Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card

    Utilities\doccardsvc.exe

    O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:

    \Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

    O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file

    missing)

    O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files

    (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

    O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation -

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

    O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) -

    Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe

    (file missing)

    O23 - Service: Intel® Management and Security Application Local Management Service (LMS)

    - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components

    \LMS\LMS.exe

    O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:

    \Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe

    (file missing)

    O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files

    \Intel\WiFi\bin\PanDhcpDns.exe

    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:

    \Windows\system32\lsass.exe (file missing)

    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner -

    C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation -

    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

    O23 - Service: RoxioNow Service - Roxio - C:\Program Files (x86)\Roxio\RoxioNow Player

    \RNowSvc.exe

    O23 - Service: Remote Procedure Call (RPC) LD (rpcld) - Unknown owner - C:\ProgramData

    \Rpcnet\Bin\rpcld.exe (file missing)

    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:

    \Windows\system32\locator.exe (file missing)

    O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:

    \Windows\SysWOW64\rpcnet.exe

    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows

    \system32\lsass.exe (file missing)

    O23 - Service: SafeConnect Manager (SCManager) - Unknown owner - C:\Program Files

    (x86)\SafeConnect\scManager.sys servicestart (file missing)

    O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files

    (x86)\Skype\Updater\Updater.exe

    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:

    \Windows\System32\snmptrap.exe (file missing)

    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:

    \Windows\System32\spoolsv.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:

    \Windows\system32\sppsvc.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program

    Files\IDT\WDM\STacSV64.exe

    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:

    \Windows\system32\UI0Detect.exe (file missing)

    O23 - Service: Intel® Management & Security Application User Notification Service (UNS) -

    Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS

    \UNS.exe

    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:

    \Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows

    \System32\vds.exe (file missing)

    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows

    \system32\vssvc.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner -

    C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:

    \Windows\system32\wbengine.exe (file missing)

    O23 - Service: Stardock WindowBlinds (WindowBlinds) - Stardock Corporation - C:\Program

    Files (x86)\Stardock\MyColors\VistaSrv.exe

    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner -

    C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) -

    Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --

    End of file - 14377 bytes

  3. Here is the information you requested from running ComboFix. It seems the problem is still occurring. At this point, I'm thinking it's limited to Firefox, as I can't seem to get the problem to happen on other browsers like Chrome and Internet Explorer. I think I'm going to attempt a clean install of Firefox to see if that makes it go away. Let me know if there's anything else I can try. Thanks.

    log.txt

  4. I have an HP envy laptop with Windows 7 using Firefox (17.0.1) as the primary browser and when performing internet searches with Google, any search results I click on will randomly redirect me to another site such as one of these:

    way-search.net

    searchbytitle.com

    protection-searcher.com

    discount-find.in/

    www.feedsmixer.org

    r.looksmart.com

    Sources tell me it's a rootkit, but I haven't been able to find one so far. I've checked the DNS settings to make sure there isn't a proxy setup. I've tried using removal tools like Kapersky's TDSKiller, Combofix, and Malware Bytes without success (although they seemed to remove some malware/viruses/etc). I even tried running them in safe mode, but no luck. It seems the search redirect is happening less frequently than it was when I started, but that's probably just me being optimistic that I actually made it better through the course of running all these tools along the way.

    Per this page's instructions (http://forums.malwar...?showtopic=9573) I ran the DDS tool and attached the 2 log files it produced in hopes that I can get some help solving this problem.

    I know my way around Windows and I'm relatively technical so I should be able to follow most any instructions you suggest I try. I just don't run Windows on my primary computer (except for games) and I don't make it my business to remove viruses/spyware/malware from other people's computer's on a regular basis, so I'm at a loss for what to try next short of reinstalling windows.

    Any help is much appreciated. Thanks.

    dds.txt

    attach.txt

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.