Hijacked - need help

[Norwalk55]

I believe that my computer is infected. When I am online I see occasionally see programs in the taskbar (e.g., Garmin updater) that I am not running or a brief glimpse of a program in the taskbar (a marketing company). I also have seen 2 "wireless network connection on" icons in the start bar when I am the only person online. Super antispyware removed 6 tracking cookies; the complete and quick Malwarebytes scan found no objects. I have attached the Attach and DDS files.

Thank you

dds.txt

attach.txt

[MrCharlie]

Welcome to the forum.

Immediately please uninstall these form add/remove programs:

J2SE Runtime Environment 5.0 Update 6

Java™ 6 Update 31

----------------------------------

Then update tour Java from the control panel: (should be Update 11)

Java 7 Update 9

http://www.java.com/...p-autocheck.jpg

------------------------------------

Then............

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[Norwalk55]

MrCharlie;

I have followed your instructions, removed the listed programs, updated Java, run the RogueKiller program and attached the associated files from my desktop. (I hope I did it correctly!)

Thank you for your help!

QuarantineReport.txt

Eula.txt

[MrCharlie]

Those aren't the log, should be on your desktop and look something like this:

RKreport[1]_S_01212013_02d2107.txt

MrC

[Norwalk55]

So sorry! Is this better?

Thanks!

RKreport1_S_01212013_02d2049.txt

[MrCharlie]

OK..............

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

[Norwalk55]

MrC

Thank you for the detailed instructions - I found them so helpful! I installed and ran the MBAR Anti-Rootkit as you described (logs attached). After the 1st run, 2 malware programs were found. I ran Cleanup and restarted my computer. The "Garmin Updater" appeared briefly in the taskbar as described above (I did not start this and it seems to appear randomly). I re-ran the Anti-Rootkit and no threats were detected. Windows Firewall and Internet access seem okay.

Windows updater seemed to freeze when I tried to check for updates. I eventually ran it and attached the screen shot of the error. When I clicked on the error icon as instructed, advertisements appear (2nd screen shot).

I need to log off now but I will run the fixdamge tool and repost.

Thanks again!

mbar-log-2013-01-22 (20-12-06).txt

mbar-log-2013-01-22 (21-02-33).txt

system-log.txt

Windows update_01222013.doc

[MrCharlie]

OK...next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[Norwalk55]

MrC

I ran ComboFix and the log is attached. Thanks!

[Norwalk55]

Sorry - here's the attachment. I am still getting the advertisement when I run the mouse over a link (see attached screen shot). This was taken after the completion of ComboFix, when I was attempting to attach the log that I forgot the first time. I have also seen other ads - e.g., selling iPads

Thanks

ComboFix.txt

ScreenShot_01232013.doc

[MrCharlie]

I can't open that attached screenshot, you'll have to post it.

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Please look over what was found, we're going to delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

MrC

[Norwalk55]

MrC

I rebooted my computer after generating the ComboFix log. Now the Garmin Updater is showing up in the autostart bar (I know that's not it's real name but not sure what it's called) - See screen shot. It has never appeared here before; it was usually on the task bar. I also ran Windows Update and it appears to have worked this time - it lists today's date and time for the most recent update.

Thanks

screenshot_01232013_2.doc

[MrCharlie]

Once again, I can't open up the attachments from you, you have to post the screen shots.

I gave you instructions here, please follow them:

http://forums.malwarebytes.org/index.php?showtopic=121372&view=findpost&p=638513

MrC

[Norwalk55]

Sorry - I needed to switch to the advanced uploader. I've re-attached this evening's previous files and hope it works this time. I will give AdwCleaner a try now. Thanks!

ComboFix.txt

screenshot_01232013_2.doc

ScreenShot_01232013.doc

[Norwalk55]

The AdwCleaner log is attached. I reviewed it and did not recognize anything that I needed.

Thanks!

AdwCleanerR1.txt

[MrCharlie]

It's all adware >>>>

Lots of adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

[Norwalk55]

The log generated after deleting the Adware is attached. The Garmin Updater came on in the taskbar (left, next to the Start button) as soon as the computer rebooted. It disappeared before I could get a screen shot.

Thanks.

AdwCleanerS1.txt

[MrCharlie]

OK, you have Garmin installed:

Garmin Communicator Plugin

Garmin Lifetime Updater

Uninstall both or just the updater from your add/remove programs.

Let me know.....MrC

[Norwalk55]

I uninstalled both Garmin programs as you instructed. Windows Firewall, WIndows update and Internet access seem okay. I did not see any programs that I am not running in the task bar or system tray.

I confess that I know very little about how these viruses (or whatever it was) take over my computer, but the reason that I did not remove the Garmin programs before was because I thought that the virus would just "attach" to another one of my programs. Do you think my computer is okay now? If so, do you have any recommendations to help prevent this in the future? I do not generally open unsolicited emails or the ads next to the inbox. I would appreciate any suggestions.

Thanks!

[Norwalk55]

I just noticed that the Java icon is no longer in my control panel. Did I do something wrong?

[MrCharlie]

I just noticed that the Java icon is no longer in my control panel. Did I do something wrong?

No for some reason that happens in XP

To fix it just copy javacpl.cpl located here:

C:\Program Files\Java\jre7\bin\javacpl.cpl

into this folder:

C:\WINDOWS\system32

---------------------------------

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC

[Norwalk55]

I ran SecurityCheck from my desktop and the results are below

Thank you

Results of screen317's Security Check version 0.99.57

Windows XP Service Pack 3 x86

Internet Explorer 8

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Microsoft Security Essentials

`````````Anti-malware/Other Utilities Check:`````````

SUPERAntiSpyware

Malwarebytes Anti-Malware version 1.70.0.1100

Java 7 Update 11

Adobe Flash Player 11.5.502.146

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox (18.0.1)

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

[Norwalk55]

The ads are still showing up occasionally if I mouse over a link. This one was flashing and automatically opened another window.

Thanks,

[MrCharlie]

Can you right click on the ad and check properties or give me the web address of the new window that comes up.

MrC

[Norwalk55]

No sorry, I turned my computer off shortly after my last post. I will try to do that the next time an ad appears and post the requested info. I am now getting a Security Alert when I perform a google search.