MrCharlie Posted July 9, 2014 ID:850901 Share Posted July 9, 2014 Run another scan with rkill. Run another scan with RogueKiller. Post both logs, MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 10, 2014 Author ID:850936 Share Posted July 10, 2014 Evening MrC, RKreport_SCN_07092014_171156.log Rkill 2.6.7 by Lawrence Abrams (Grinler)http://www.bleepingcomputer.com/Copyright 2008-2014 BleepingComputer.comMore Information about Rkill can be found at this link: http://www.bleepingcomputer.com/forums/topic308364.htmlProgram started at: 07/09/2014 05:27:56 PM in x86 mode.Windows Version: Windows Vista Ultimate Service Pack 2Checking for Windows services to stop: * No malware services found to stop.Checking for processes to terminate: * No malware processes found to kill.Checking Registry for malware related settings: * No issues found in the Registry.Resetting .EXE, .COM, & .BAT associations in the Windows Registry.Performing miscellaneous checks: * Windows Defender Disabled [HKLM\SOFTWARE\Microsoft\Windows Defender] "DisableAntiSpyware" = dword:00000001 * Windows Firewall Disabled [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = dword:00000000Checking Windows Service Integrity: * Windows Defender (WinDefend) is not Running. Startup Type set to: Manual * DFSR [Missing Service]Searching for Missing Digital Signatures: * No issues found.Checking HOSTS File: * HOSTS file entries found: 127.0.0.1 localhostProgram finished at: 07/09/2014 05:29:00 PMExecution time: 0 hours(s), 1 minute(s), and 4 seconds(s)RKreport_SCN_07092014_171156.log Link to post Share on other sites More sharing options...
MrCharlie Posted July 10, 2014 ID:850940 Share Posted July 10, 2014 The proxy address is there but it's not active:[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:5555 -> FOUND[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:5555 -> FOUND These indicate your using a router..correct????:[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0339F91D-C799-4867-915D-12085C363670} | DhcpNameServer : 172.20.10.1 -> FOUND[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{0339F91D-C799-4867-915D-12085C363670} | DhcpNameServer : 172.20.10.1 -> FOUND[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{0339F91D-C799-4867-915D-12085C363670} | DhcpNameServer : 172.20.10.1 -> FOUND -----------------------------------------Please run this scan:Download aswMBR to your desktop.http://public.avast.com/~gmerek/aswMBR.exeDouble click the aswMBR.exe to run it.If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".Click the "Scan" button to start scan.On completion of the scan click "Save log", save it to your desktop and post in your next reply.NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.Please zip it up and attach it to your next post.MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 10, 2014 Author ID:851202 Share Posted July 10, 2014 Norton360 didn't like aswMBR, so I disabled it, then downloaded the file. After selecting "Run", a pop-up from the aswMBR program gave me the following option: "This computer supports 'Virtualization Technology'. Would you like to use it for rootkit detection? YES/NO" and the correct answer is ...? Link to post Share on other sites More sharing options...
MrCharlie Posted July 11, 2014 ID:851317 Share Posted July 11, 2014 YES Link to post Share on other sites More sharing options...
fr8pil8 Posted July 11, 2014 Author ID:851336 Share Posted July 11, 2014 I am using a router supplied by Comcast (Arris TG862). The aswMBR log aswMBR.txt Haven't used a zip process in years...hope this works MBR.zip Link to post Share on other sites More sharing options...
fr8pil8 Posted July 11, 2014 Author ID:851338 Share Posted July 11, 2014 That zip didn't seem to work...at least I couldn't open it into anything coherent. Still working on it Link to post Share on other sites More sharing options...
fr8pil8 Posted July 11, 2014 Author ID:851359 Share Posted July 11, 2014 Ran aswMBR again, right clicked on MBR.dat and chose "send to/ compressed zip file" and this is what I got: MBR.zip If that isn't what we need, I'm going to need help on sending a zip file. Link to post Share on other sites More sharing options...
MrCharlie Posted July 11, 2014 ID:851466 Share Posted July 11, 2014 Give this a try:Reboot into safe mode and run RogueKiller.Delete any bad proxy settings as before: [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:5555 [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:5555 Now reset Internet Explorer:http://malwaretips.com/blogs/reset-internet-explorer-settings/Reboot into normal mode.Let me know....MrC (I won't be around much on Saturday) Link to post Share on other sites More sharing options...
fr8pil8 Posted July 11, 2014 Author ID:851570 Share Posted July 11, 2014 Thanks MrC...I'll get on this tonight Link to post Share on other sites More sharing options...
MrCharlie Posted July 11, 2014 ID:851572 Share Posted July 11, 2014 OK...MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 11, 2014 Author ID:851579 Share Posted July 11, 2014 Had a minute before work...no PUM.Proxy files found. 7-11RKreport_SCN_07112014_103613.log Link to post Share on other sites More sharing options...
MrCharlie Posted July 11, 2014 ID:851588 Share Posted July 11, 2014 See if they show in normal mode. If not reset Internet Explorer in safe mode. Let me know. MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 12, 2014 Author ID:851738 Share Posted July 12, 2014 I had reset IE while in safe mode as per the 'malwaretips' article. Still in safe mode I ran ADW Cleaner, twice. Both times the scan showed nothing...no files, folders or anything from the registry listed...all lines in all categories were blank, as if I hadn't run the scan. Just ran RougeKiller in normal and both the PUB.Proxy files were back. 7-11RKreport_SCN_07112014_205735.log I deleted them. Link to post Share on other sites More sharing options...
MrCharlie Posted July 12, 2014 ID:851804 Share Posted July 12, 2014 See if you can reset your router: Shut down the computer and reset the router: http://www.online-tech-tips.com/computer-tips/reset-wireless-router-default-settings/ There should be a reset button that you push or hole that you stick a pin to reset the router (usually 10 seconds) It's usually located on the back of the router, check your owners manual. If you can't find one, just disconnect the power from the router for about a minute, then reconnect it, let it reset then turn the computer back on and see how it is. --------------------------------------------------- Download and run Panda Cloud Cleaner: (run the standard scan and clean all that's found) http://www.pandasecurity.com/usa/homeusers/support/card?id=1674 --------------------------------------------------- Give this a try: Download zoek.exe to your Desktop: http://hijackthis.nl/smeenk/ Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications Here http://www.bleepingcomputer.com/forums/topic114351.html On Windows Vista, 7, and 8, right-click Zoek.exe and select: Run as Administrator Give it a few seconds to appear Next, copy/paste the entire script inside the codebox below to the input field of Zoek: autoclean; resetIEproxy; iedefaults; startupall; emptyalltemp; Now... Close any open programs. Click the Run script button, and wait. It takes a few minutes to run. When the tool finishes, the zoek-results.log is opened in Notepad. The log is also found on the systemdrive, normally C:\ If a reboot is needed, the log is opened after the reboot. MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 12, 2014 Author ID:851968 Share Posted July 12, 2014 My modem is only two weeks old...do I really need to reset it? Panda Cleaner found a few things which I deleted. Zoek didn't seem to find anything: zoek-results.log Link to post Share on other sites More sharing options...
fr8pil8 Posted July 12, 2014 Author ID:851982 Share Posted July 12, 2014 OOPS, Zoek is still running-DOH! I'll repost. Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2014 ID:852011 Share Posted July 13, 2014 My modem is only two weeks old...do I really need to reset it? Was the problem there before or after the new modem??? MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 13, 2014 Author ID:852295 Share Posted July 13, 2014 zoek has been running now for almost 24 hrs. I think it's safe to say it has frozen up. I can't close the program, even with task manager, so I'm guessing I'll have to manually shut down the computer and maybe try running zoek again...thoughts... Link to post Share on other sites More sharing options...
fr8pil8 Posted July 13, 2014 Author ID:852299 Share Posted July 13, 2014 Sorry, missed your post...the problem was there several months before (first log was actually back in April, which suprised me). Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2014 ID:852301 Share Posted July 13, 2014 OK, reboot and try the program again, it's should only have to run for 10-20 minutes. MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 13, 2014 Author ID:852376 Share Posted July 13, 2014 Second try seems to have hung up also. Both scans got stalled at the "Documents DB Check" Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2014 ID:852385 Share Posted July 13, 2014 Try it with this script:resetIEproxy;iedefaults;startupall;emptyalltemp;Let me know...MrC Link to post Share on other sites More sharing options...
fr8pil8 Posted July 13, 2014 Author ID:852397 Share Posted July 13, 2014 That did the trick: zoek-results.log Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2014 ID:852404 Share Posted July 13, 2014 Nothing showing, I guess it's still there.I'm running out of options at this point, the setting that Malwarebytes keeps finding is harmless though.My suggestion would be....next time Malwarebytes finds it, just have Malwarebytes ignore it.I've been down this road before...sometimes I can rid the computer of it and sometimes I can't.What do you think?? MrC EDIT: I just had another thought, it's not a fix but it will keep that proxy entry deleted.I could create a bat file that will run when ever Windows starts and delete the proxy entry if present.Let me know...MrC Link to post Share on other sites More sharing options...
Recommended Posts