RDR Posted May 5, 2010 ID:245102 Share Posted May 5, 2010 I'm at my wits end. Looking to avoid having to reinstall the OS. Please help, if you can. Thanks!DDS.txtAttach.txt Link to post Share on other sites More sharing options...
Maniac Posted May 9, 2010 ID:247495 Share Posted May 9, 2010 Hello RDR! Welcome to MalwareBytes' Anti-Malware Forums!My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following: The process of cleaning your system may take some time, so please be patient.Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.Instructions that I give are for your system only!If you don't know or can't understand something please ask. Do not install or uninstall any software or hardware, while work on.Step 1:Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVAThen run this tool to help cleanup any left over JavaYour Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.Please download JavaRa and unzip it to your desktop.***Please close any instances of Internet Explorer (or other web browser) before continuing!***Double-click on JavaRa.exe to start the program.From the drop-down menu, choose English and click on Select.JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.A logfile will pop up. Please save it to a convenient location and post it back when you replyThen look for the following Java folders and if found delete them.C:\Program Files\JavaC:\Program Files\Common Files\JavaC:\Windows\SunC:\Documents and Settings\All Users\Application Data\JavaC:\Documents and Settings\All Users\Application Data\Sun\JavaC:\Documents and Settings\username\Application Data\JavaC:\Documents and Settings\username\Application Data\Sun\JavaStep 2:Launch Malwarebytes' Anti-MalwareGo to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.Step 3:Please download the following scanning tool. GMEROpen the zip file and copy the file gmer.exe to your Desktop.Double click on gmer.exe and run it.It may take a minute to load and become available.Do not make any changes. Click on the SCAN button and DO NOT use the computer while it's scanning.Once the scan is done click on the SAVE button and browse to your Desktop and save the file as GMER.LOGZip up the GMER.LOG file and save it as gmerlog.zip and attach it to your reply post.DO NOT directly post this log into a reply. You MUST attach it as a .ZIP file.Click OK and quit the GMER program.How To Use Compressed (Zipped) Folders in Windows XPCompress and uncompress files (zip files) in VistaJavaRa logMalwareBytes' Anti-Malware loga new fresh DDS log onlyGMER log Link to post Share on other sites More sharing options...
RDR Posted May 11, 2010 Author ID:248426 Share Posted May 11, 2010 Hello Borislov... Thank you so much for agreeing to help me. I am hopeful we can restore my system to it's former glory. I have proceeded through your instuction. The JavaRA and mbam-log are cpy/pasted here:Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4090Windows 6.0.6002 Service Pack 2Internet Explorer 8.0.6001.189045/11/2010 12:34:01 PMmbam-log-2010-05-11 (12-34-01).txtScan type: Quick scanObjects scanned: 160697Time elapsed: 2 minute(s), 38 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)JavaRa 1.15 Removal Log.Report follows after line.------------------------------------The JavaRa removal process was started on Tue May 11 11:38:08 2010Found and removed: C:\Users\CIV Dec2008\AppData\LocalLow\Sun\Java\jre1.6.0_11------------------------------------Finished reporting.JavaRa 1.15 Removal Log.Report follows after line.------------------------------------The JavaRa removal process was started on Tue May 11 11:42:03 2010------------------------------------Finished reporting.The GMER scan game back negative and there was no information to "save". Is this normal? I have attached the DDS file. I ran the DDS scan again, do you need that? Please advise on how I should proceed. I don't want to waste your time with unneccessary information, however please feel free to ask me any questions you might have. I will try to provide you with any information you might think usefull. Thanks again Boris!RDRHello RDR! Welcome to MalwareBytes' Anti-Malware Forums!My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following: The process of cleaning your system may take some time, so please be patient.Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.Instructions that I give are for your system only!If you don't know or can't understand something please ask. Do not install or uninstall any software or hardware, while work on.Step 1:Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVAThen run this tool to help cleanup any left over JavaYour Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.Please download JavaRa and unzip it to your desktop.***Please close any instances of Internet Explorer (or other web browser) before continuing!***Double-click on JavaRa.exe to start the program.From the drop-down menu, choose English and click on Select.JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.A logfile will pop up. Please save it to a convenient location and post it back when you replyThen look for the following Java folders and if found delete them.C:\Program Files\JavaC:\Program Files\Common Files\JavaC:\Windows\SunC:\Documents and Settings\All Users\Application Data\JavaC:\Documents and Settings\All Users\Application Data\Sun\JavaC:\Documents and Settings\username\Application Data\JavaC:\Documents and Settings\username\Application Data\Sun\JavaStep 2:Launch Malwarebytes' Anti-MalwareGo to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.Step 3:Please download the following scanning tool. GMEROpen the zip file and copy the file gmer.exe to your Desktop.Double click on gmer.exe and run it.It may take a minute to load and become available.Do not make any changes. Click on the SCAN button and DO NOT use the computer while it's scanning.Once the scan is done click on the SAVE button and browse to your Desktop and save the file as GMER.LOGZip up the GMER.LOG file and save it as gmerlog.zip and attach it to your reply post.DO NOT directly post this log into a reply. You MUST attach it as a .ZIP file.Click OK and quit the GMER program.How To Use Compressed (Zipped) Folders in Windows XPCompress and uncompress files (zip files) in VistaJavaRa logMalwareBytes' Anti-Malware loga new fresh DDS log onlyGMER logDDS_2010_05_11.txt Link to post Share on other sites More sharing options...
Maniac Posted May 11, 2010 ID:248434 Share Posted May 11, 2010 Thanks again Boris!Borislav (Boris is a different name).GMER not working... bad, but let's try another way:Download RootRepeal Beta on your desktop.Double click RootRepeal.exe to start the programClick on the Report tab at the bottom of the program windowClick the Scan buttonIn the Select Scan dialog, check:DriversFilesProcessesSSDTStealth ObjectsHidden Services[*]Click the OK button[*]In the next dialog, select all drives showing[*]Click OK to start the scanNote: The scan can take some time. DO NOT run any other programs while the scan is running[*]When the scan is complete, the Save Report button will become available[*]Click this and save the report to your Desktop as RootRepeal.txt[*]Go to File, then Exit to close the programIf the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead. Link to post Share on other sites More sharing options...
RDR Posted May 12, 2010 Author ID:248633 Share Posted May 12, 2010 Hi Borislav... Sorry about the name, I assumed Boris would be your nickname. Unfortunately, RootRepeal is not compatible with window 64bit systems, wich is my OS. Is there any other programs or another work-around I might try?RDRBorislav (Boris is a different name).GMER not working... bad, but let's try another way:Download RootRepeal Beta on your desktop.Double click RootRepeal.exe to start the programClick on the Report tab at the bottom of the program windowClick the Scan buttonIn the Select Scan dialog, check:DriversFilesProcessesSSDTStealth ObjectsHidden Services[*]Click the OK button[*]In the next dialog, select all drives showing[*]Click OK to start the scanNote: The scan can take some time. DO NOT run any other programs while the scan is running[*]When the scan is complete, the Save Report button will become available[*]Click this and save the report to your Desktop as RootRepeal.txt[*]Go to File, then Exit to close the programIf the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead. Link to post Share on other sites More sharing options...
Maniac Posted May 12, 2010 ID:248678 Share Posted May 12, 2010 Skip RootRepeal.Important!All of the following instructions must be run on the affected computer. Logs from a different computer will not help me help you. So, if you need to download all of this and then copy it to CD or memory stick and take it to the other computer, please do so. Either way, it's important. The logs have to be made by the computer with the problem.I need you to follow the instructions provided here Pre- HJT Post Instructions first. I also need for you to download this program OTListIt.exe to your desktop.Close all applications and windows so that you have nothing open and are at your DesktopDouble-click on the OTListIt.exe file to start OTListIt. OK any warning about running OTListIt.Place a checkmark in the Scan All Users checkbox (Leave the 'Use Whitelist' checked' and the 'File Age:' at 30 days)Click the Run Scan buttonNOTE: Please be patient and let the scan run without using the computerWhen the scan is complete, a text file (OTListIt.Txt) will open in Notepad (if not, it can be found on your Desktop)In Notepad, click Edit, Select all then Edit, CopyReply to this topic, click in the topic reply window, and press Ctrl+V to paste the log or Righ click paste.Submit your reply and close the Notepad window with OTList.txtAlso OTListIt's Extras.txt log file will be minimized in the Taskbar (and located on your Desktop) - click on this and maximize the windowIn Notepad, click Edit, Select all then Edit, CopyReply to this topic again, click in the topic reply window, and press Ctrl+V to paste the extras log or Right click paste.NOTE: If the files (OTListIt.txt, Extras.txt) do not appear in your taskbar, just open the files in notepad from your desktop.Please allow me time to analyze your post. If you don't see a reply from me after 24 hours, feel free to PM me. Link to post Share on other sites More sharing options...
RDR Posted May 13, 2010 Author ID:249187 Share Posted May 13, 2010 Hello Borislav... Both of these files are rather large, so I have attached them instead of copy/paste.Skip RootRepeal.Important!All of the following instructions must be run on the affected computer. Logs from a different computer will not help me help you. So, if you need to download all of this and then copy it to CD or memory stick and take it to the other computer, please do so. Either way, it's important. The logs have to be made by the computer with the problem.I need you to follow the instructions provided here Pre- HJT Post Instructions first. I also need for you to download this program OTListIt.exe to your desktop.Close all applications and windows so that you have nothing open and are at your DesktopDouble-click on the OTListIt.exe file to start OTListIt. OK any warning about running OTListIt.Place a checkmark in the Scan All Users checkbox (Leave the 'Use Whitelist' checked' and the 'File Age:' at 30 days)Click the Run Scan buttonNOTE: Please be patient and let the scan run without using the computerWhen the scan is complete, a text file (OTListIt.Txt) will open in Notepad (if not, it can be found on your Desktop)In Notepad, click Edit, Select all then Edit, CopyReply to this topic, click in the topic reply window, and press Ctrl+V to paste the log or Righ click paste.Submit your reply and close the Notepad window with OTList.txtAlso OTListIt's Extras.txt log file will be minimized in the Taskbar (and located on your Desktop) - click on this and maximize the windowIn Notepad, click Edit, Select all then Edit, CopyReply to this topic again, click in the topic reply window, and press Ctrl+V to paste the extras log or Right click paste.NOTE: If the files (OTListIt.txt, Extras.txt) do not appear in your taskbar, just open the files in notepad from your desktop.Please allow me time to analyze your post. If you don't see a reply from me after 24 hours, feel free to PM me.Extras.TxtOTL.Txt Link to post Share on other sites More sharing options...
Maniac Posted May 13, 2010 ID:249211 Share Posted May 13, 2010 ESET Online ScannerNote: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.Please go here then click on: Select the option YES, I accept the Terms of Use then click on: When prompted allow the Add-On/Active X to install.Now click on Advanced Settings and select the following:Remove found threatsScan archivesScan for potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth Technology[*]Now click on: [*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.[*]When completed the Online Scan will begin automatically. [*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall. [*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first![*]Now click on: [*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.[*]Copy and paste that log as a reply to this topic.Note: Do not forget to re-enable your Anti-Virus application after running the above scan! Link to post Share on other sites More sharing options...
RDR Posted May 14, 2010 Author ID:249757 Share Posted May 14, 2010 Hi Borislav... Here are the results of the ESET scan:ESETSmartInstaller@High as CAB hook log:OnlineScanner64.ocx - registred OKOnlineScanner.ocx - registred OK# version=7# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)# OnlineScanner.ocx=1.0.0.6211# api_version=3.0.2# EOSSerial=c35b6187eefa06409b19cfb17b873075# end=stopped# remove_checked=true# archives_checked=true# unwanted_checked=true# unsafe_checked=true# antistealth_checked=true# utc_time=2010-05-13 04:14:40# local_time=2010-05-13 10:14:40 (-0700, Mountain Daylight Time)# country="United States"# lang=1033# osver=6.0.6002 NT Service Pack 2# compatibility_mode=512 16777215 100 0 0 0 0 0# compatibility_mode=5121 16776893 100 82 2798516 26601690 0 0# compatibility_mode=5891 16776893 100 83 0 13893146 0 0# compatibility_mode=8192 67108863 100 0 0 0 0 0# scanned=112837# found=2# cleaned=2# scan_time=2314C:\Documents and Settings\Administrator\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\6189068c-1969cd39 a variant of Java/TrojanDownloader.Agent.NAN trojan (deleted - quarantined) 00000000000000000000000000000000 CC:\Documents and Settings\Administrator\Documents\Downloads\free-wma-mp3-converter.exe probably a variant of Win32/PSW.Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C# version=7# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)# OnlineScanner.ocx=1.0.0.6211# api_version=3.0.2# EOSSerial=c35b6187eefa06409b19cfb17b873075# end=finished# remove_checked=true# archives_checked=true# unwanted_checked=true# unsafe_checked=true# antistealth_checked=true# utc_time=2010-05-14 02:19:46# local_time=2010-05-13 08:19:46 (-0700, Mountain Daylight Time)# country="United States"# lang=1033# osver=6.0.6002 NT Service Pack 2# compatibility_mode=512 16777215 100 0 0 0 0 0# compatibility_mode=5121 16776893 100 82 2818000 26621174 0 0# compatibility_mode=5891 16776893 100 83 0 13912630 0 0# compatibility_mode=8192 67108863 100 0 0 0 0 0# scanned=613708# found=6# cleaned=6# scan_time=19136C:\Documents and Settings\CIV Dec2008\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\6189068c-1969cd39 a variant of Java/TrojanDownloader.Agent.NAN trojan (deleted - quarantined) 00000000000000000000000000000000 CC:\Documents and Settings\CIV Dec2008\Documents\Downloads\free-wma-mp3-converter.exe probably a variant of Win32/PSW.Agent trojan (deleted - quarantined) 00000000000000000000000000000000 CC:\Documents and Settings\RD May 2010\Documents\Downloads\free-wma-mp3-converter.exe probably a variant of Win32/PSW.Agent trojan (deleted - quarantined) 00000000000000000000000000000000 CC:\Downloads\Nero-9.0.9.4c_update.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 CC:\Program Files (x86)\Nero\Nero LiquidTV\Nero_LiquidTV-1.6.2.114_setup.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 CC:\Windows\Installer\d51bd.msi Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 CESET Online ScannerNote: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.Please go here then click on: Select the option YES, I accept the Terms of Use then click on: When prompted allow the Add-On/Active X to install.Now click on Advanced Settings and select the following:Remove found threatsScan archivesScan for potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth Technology[*]Now click on: [*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.[*]When completed the Online Scan will begin automatically. [*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall. [*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first![*]Now click on: [*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.[*]Copy and paste that log as a reply to this topic.Note: Do not forget to re-enable your Anti-Virus application after running the above scan! Link to post Share on other sites More sharing options...
Maniac Posted May 14, 2010 ID:250008 Share Posted May 14, 2010 How are things now? Link to post Share on other sites More sharing options...
RDR Posted May 14, 2010 Author ID:250065 Share Posted May 14, 2010 I am in the proccess of checking everything out top to bottom. The system is operating much more smoothly now. Several programs that would not run before (abobe acrobat) are functioning again. Currently, I am running McAfee Security Center, Microsoft Security Essentials, & Malwarebytes' Anti-Malware (registered). Do you think this is suffecicient to prevent any further attacks, or is there something more you would suggest? Also I have purchased and installed PC Medkit for registry maintenance. Thanks again for all your help Borislav. You have been amazing.RDRHow are things now? Link to post Share on other sites More sharing options...
Maniac Posted May 14, 2010 ID:250088 Share Posted May 14, 2010 You should not have more than one anti-virus program installed as they will conflict and cause problems. You have two so you need to uninstall one of them. Of the two, I would recommend keeping Microsoft Security Essentials , so please uninstall McAfee Security Center .Please keep watching your system for a few days and let me know how are things running now. Link to post Share on other sites More sharing options...
Maurice Naggar Posted May 21, 2010 ID:253848 Share Posted May 21, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts