208.73.210.29 ,95.211.187.165,176.36.192.16 is attacking my laptop, MBAM blocking oftenly

[GopalPatel]

Dear Sir,

My MalwareBytes is showing notification that 208.73.210.29, 95.211.187.165 and 176.36.192.16 is attacking my laptop.

And it also enables the "don't show hidden files" option frequently.

and it opens unwanted pop-ups also in firefox which opens Ads page.

I have tried lots of softwares like, Malwarebytes, Trojan Remover, UnHaskMe, SuperAntiSpyware, TDSKiller (Kaspersky), but no result found.

few software shows that there are suspecious DLL's is in my System32/Drivers folder and I have removed also.

Still after some time malwarebytes shows notification of blocking IP.

208.73.210.29 IP is the most often time blocked by MBAM.

Please help me to remove this nasty thing.

[Maniac]

Hello GopalPatel and ! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

• If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
• I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
• Make sure you read all of the instructions and fixes thoroughly before continuing with them.
• Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
• Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
• Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please follow the instructions here and then post the log files in your next reply.

http://forums.malwarebytes.org/index.php?showtopic=9573

[GopalPatel]

Here is a log of MBAM , there are some IP's attacking continuously my laptop.
26-07-2013

00:18:04 Shyam IP-BLOCK 208.73.210.2900:53:53 Shyam IP-BLOCK 208.73.210.2900:54:18 Shyam IP-BLOCK 219.146.225.14701:10:55 Shyam IP-BLOCK 95.211.7.14502:06:11 Shyam IP-BLOCK 208.73.210.2902:19:22 Shyam IP-BLOCK 208.73.211.18302:41:59 Shyam IP-BLOCK 208.73.210.29

25-07-2013

 

00:28:54 Shyam IP-BLOCK 208.73.210.2901:04:32 Shyam IP-BLOCK 208.73.210.2901:40:04 Shyam IP-BLOCK 208.73.210.2916:28:27 Shyam IP-BLOCK 208.73.210.2917:04:17 Shyam IP-BLOCK 208.73.210.2917:39:58 Shyam IP-BLOCK 208.73.210.2918:15:31 Shyam IP-BLOCK 208.73.210.2918:51:59 Shyam IP-BLOCK 208.73.210.2919:29:26 Shyam DETECTION C:\program files\microsoft office\Office12\Microsoft Office Ultimate 2007 SP1 Patch.exe Trojan.Agent.CK QUARANTINE19:29:35 Shyam IP-BLOCK 208.73.210.2920:03:46 Shyam IP-BLOCK 208.73.210.2920:05:53 Shyam MESSAGE IP Protection stopped20:05:55 Shyam MESSAGE IP Protection started successfully20:06:33 Shyam MESSAGE IP Protection stopped20:06:34 Shyam MESSAGE IP Protection started successfully20:33:59 Shyam IP-BLOCK 95.211.187.16520:34:08 Shyam IP-BLOCK 95.211.187.16520:40:03 Shyam IP-BLOCK 208.73.210.2921:54:00 Shyam IP-BLOCK 208.73.210.2922:30:08 Shyam IP-BLOCK 208.73.210.2923:42:27 Shyam IP-BLOCK 208.73.210.29

[GopalPatel]

I had run dds.com on laptop and posting two files here. 

 

attach.txtdds.txt

[Maniac]

Hello GopalPatel and ! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

• Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Please follow the instructions here and then post the log files in your next reply.

http://forums.malwarebytes.org/index.php?showtopic=9573

[GopalPatel]

ok, here i'm pasting both files,

 

Attach.txt

 

 

 

.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2012-11-20.01).Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1Install Date: 13-04-2013 01:03:43 AMSystem Uptime: 25-07-2013 11:19:30 AM (29 hours ago).Motherboard: Hewlett-Packard |  | 308AProcessor: Intel(R) Core(TM)2 Duo CPU     T5870  @ 2.00GHz | U10 | 1180/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 20 GiB total, 3.072 GiB free.D: is FIXED (NTFS) - 20 GiB total, 0.193 GiB free.E: is FIXED (NTFS) - 59 GiB total, 0.618 GiB free.F: is FIXED (NTFS) - 135 GiB total, 2.062 GiB free.G: is CDROM ()H: is CDROM (CDFS)I: is CDROM ()L: is Removable.==== Disabled Device Manager Items =============.Class GUID: Description: Device ID: ACPI\HPQ0006\2&DABA3FF&1Manufacturer: Name: PNP Device ID: ACPI\HPQ0006\2&DABA3FF&1Service: .==== System Restore Points ===================.RP77: 25-07-2013 06:24:21 PM - Scheduled Checkpoint.==== Hosts File Hijack ======================.Hosts: 127.0.0.1  ads.mcafee.comHosts: 127.0.0.1  analytics.microsoft.comHosts: 127.0.0.1  metrics.bitdefender.comHosts: 127.0.0.1  metrics.mcafee.comHosts: 127.0.0.1  om.symantec.comHosts: 127.0.0.1  ads.bleepingcomputer.comHosts: 127.0.0.1  wdcs.trendmicro.com.==== Installed Programs ======================.Adobe After Effects CS4Adobe After Effects CS4 PresetsAdobe AIRAdobe Anchor Service CS4Adobe CMaps CS4Adobe Color Video Profiles AE CS4Adobe Dynamiclink SupportAdobe Extension Manager CS4Adobe Flash Player 11 PluginAdobe Fonts AllAdobe Media PlayerAdobe MotionPicture Color Files CS4Adobe PDF Library Files CS4Adobe Photoshop CS2Adobe Reader X (10.1.6)Adobe SetupAdobe Type Support CS4Adobe Update Manager CS4AdobeColorCommonSetRGBAdvanced Port Scanner v1.3Apache Tomcat 7.0.22AutoHotkey 1.1.09.04BitTorrentBulk Image Downloader v4.21.0.0CutePDF Writer 3.0EasyBCD 2.1.2EvernoteGoogle Input GujaratiGoogle Input ToolsGoogle Talk PluginGoogle Update HelperHavij 1.15 FreeHP Web CameraHP WebcamIDT AudioIntel(R) Graphics Media Accelerator DriverIntel(R) TV WizardJava Auto UpdaterJava DB 10.5.3.0Java(TM) 6 Update 18Java(TM) SE Development Kit 6 Update 18Macromedia Dreamweaver 8Macromedia Extension ManagerMalwarebytes' Anti-MalwareMarvell Miniport DriverMaxthon Cloud BrowserMedia Player Codec Pack 4.2.2Microsoft .NET Framework 4 Client ProfileMicrosoft .NET Framework 4 ExtendedMicrosoft Application Error ReportingMicrosoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Enterprise 2007Microsoft Office Excel MUI (English) 2007Microsoft Office Groove MUI (English) 2007Microsoft Office Groove Setup Metadata MUI (English) 2007Microsoft Office InfoPath MUI (English) 2007Microsoft Office OneNote MUI (English) 2007Microsoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Word MUI (English) 2007Microsoft Save as PDF Add-in for 2007 Microsoft Office programsMicrosoft Visual C++ 2008 Redistributable - x86 9.0.21022Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319Mozilla Firefox 22.0 (x86 en-US)Mozilla Maintenance ServiceNetBeans IDE 7.1.2Netsparker [Community Edition] - Web Application Security ScannerNMapWinNo-IP DUCNotepad++Orbit DownloaderPdaNet+ for Android 4.01PhotoScapePhotoshop Camera RawPicasa 3PowerISOPremiere Pro CS4 and After Effects CS4, 32-bit support for CS5QuickTimeSubway SurfersSuite Shared Configuration CS4Synaptics Pointing Device DriverThe KMPlayer (remove only)Unlocker 1.8.9USB Disk SecurityVLC media player 2.0.5wePN SSL version 0.5WinPcap 4.1.2WinRAR 4.01 (32-bit)Wireshark 1.5.0.==== Event Viewer Messages From Past Week ========.26-07-2013 12:42:23 AM, Error: Service Control Manager [7032]  - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Program Compatibility Assistant Service service, but this action failed with the following error:  An instance of the service is already running.26-07-2013 12:41:23 AM, Error: Service Control Manager [7034]  - The Diagnostic System Host service terminated unexpectedly.  It has done this 1 time(s).26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The WLAN AutoConfig service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Windows Audio Endpoint Builder service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Superfetch service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Remote Desktop Services UserMode Port Redirector service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Program Compatibility Assistant Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Portable Device Enumerator Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Offline Files service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Network Connections service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 100 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Distributed Link Tracking Client service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.26-07-2013 12:41:23 AM, Error: Service Control Manager [7031]  - The Desktop Window Manager Session Manager service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.26-07-2013 12:41:11 AM, Error: Service Control Manager [7034]  - The Windows Backup service terminated unexpectedly.  It has done this 1 time(s).26-07-2013 12:40:57 AM, Error: Service Control Manager [7034]  - The Windows Image Acquisition (WIA) service terminated unexpectedly.  It has done this 1 time(s).25-07-2013 07:50:00 PM, Error: Disk [11]  - The driver detected a controller error on \Device\Harddisk2\DR19.25-07-2013 05:52:39 PM, Error: volsnap [36]  - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit..==== End Of File ===========================

 DDS.TXT

 

 

 

[GopalPatel]

DDS.txt

[GopalPatel]

why dds.txt is showing. I'm pasting this but after posting it disappears.

[AdvancedSetup]

Why is this software installed on this system?  Havij 1.15 Free this is not a typical tool for a home user to have and is often used in unethical hacking.

[GopalPatel]

Sorry for late,

I know sir its not for home user, but i have just installed for my educational purpose

[AdvancedSetup]

Please visit this webpage and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.
  

 

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!