Jump to content

Malicious programs reinstall themselves and disabled firewall


Recommended Posts

Hello, my firewall has been disabled and I cannot activate it again, I get an error code 0x80070003 when I try to restore it. This I am pretty sure has been caused by a bundle of 3 p2p sharing programs that got installed somehow and cannot be removed. They do not appear in the programs list to uninstall, and if the folders where they are get deleted, they just reinstall themselves after a while. In addition to the firewall being disabled, MBAM fails to update.

The dds logs are attached.

Attach.txt

DDS.txt

Link to post
Share on other sites

Run RogueKiller again and click scan > now click delete.

These are all bad:

¤¤¤ Bad processes: 3 ¤¤¤
[SUSP PATH] conime.exe -- C:\Users\Public\AppData\eMuleMorphXT\conime.exe -> KILLED [TermProc]
[HJ NAME] ctfmon.exe -- C:\Users\Public\AppData\Shareobj\ctfmon.exe -> KILLED [TermProc]
[SUSP PATH] ctfldr.ExE -- C:\Users\Public\AppData\Aobj\ctfldr.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 5 ¤¤¤
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

-----------------------

Next......

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Make sure you run ComboFix from your desktop.

Please include the C:\ComboFix.txt in your next reply for further review.

MrC

Link to post
Share on other sites

Apparently all is good, MBAM did not find problems, but when i start up i get an error that says

Error loading

C:\Users\Public\{B82BE595-687A-4cd0-A24E-50C38F27DA81}.dll

The specified module cannot be found.

Firewall was restored, but the folders where the p2p programs are installed are still there, would they be safe to delete now?

Sorry if the MBAM log is in spanish, if you need it in english i can reinstall in english and post it back. Thanks for all the help so far.

mbam-log-2012-02-16 (19-54-20).txt

Link to post
Share on other sites

First please do this:

Please run TDSSKiller as outlined in the link below:

http://forums.malwar...ndpost&p=526979

Post back the report.

---------------------------------------

Firewall was restored, but the folders where the p2p programs are installed are still there, would they be safe to delete now?

Yes go ahead and delete them.

---------------------------------------

Apparently all is good, MBAM did not find problems, but when i start up i get an error that says

Error loading

C:\Users\Public\{B82BE595-687A-4cd0-A24E-50C38F27DA81}.dll

The specified module cannot be found.

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

Link to post
Share on other sites

Please do this:

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    [2012/02/14 02:50:36 | 000,001,035 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\{B82BE595-687A-4cd0-A24E-50C38F27DA81}.lnk
    O3 - HKU\S-1-5-21-1950910400-1506295391-1780677180-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O4 - Startup: C:\Users\Ramiro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = File not found
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
    :Commands
    [emptytemp]


  • Then click the Run Fix button at the top
  • Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  • Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

MrC

Link to post
Share on other sites

Ok, here is the log from OTL:

All processes killed

========== OTL ==========

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\{B82BE595-687A-4cd0-A24E-50C38F27DA81}.lnk moved successfully.

Registry value HKEY_USERS\S-1-5-21-1950910400-1506295391-1780677180-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

C:\Users\Ramiro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk moved successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Agus

->Temp folder emptied: 98033 bytes

->Temporary Internet Files folder emptied: 49925 bytes

->Java cache emptied: 8194588 bytes

->FireFox cache emptied: 139185162 bytes

->Flash cache emptied: 1861 bytes

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Flash cache emptied: 56475 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Invitado

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->FireFox cache emptied: 395510017 bytes

->Flash cache emptied: 1772 bytes

User: Public

->Temp folder emptied: 0 bytes

User: Ramiro

->Temp folder emptied: 880576 bytes

->Temporary Internet Files folder emptied: 2438369 bytes

->Java cache emptied: 163523 bytes

->FireFox cache emptied: 963068221 bytes

->Flash cache emptied: 126029 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 757760 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 18655 bytes

RecycleBin emptied: 2841169512 bytes

Total Files Cleaned = 4.150,00 mb

OTL by OldTimer - Version 3.2.32.0 log created on 02182012_125951

Files\Folders moved on Reboot...

File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Link to post
Share on other sites

Good ;)

Go to your control panel > Java > Update Tab > Update Now

This will download and install the latest version of Java.

Java™ 6 Update 29 <---should be 31

----------------------------

Please Uninstall ComboFix:

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

------------------

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.