Jump to content

Trojan.BHO.H


Recommended Posts

ive run malwarebytes a few times and it keeps saying "no action taken"

here is the log from the last quick scan.

i know it says quarantined and removed but even after i restart and run malware again it still shows up.

======================================

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4136

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18904

5/24/2010 11:51:03 PM

mbam-log-2010-05-24 (23-51-03).txt

Scan type: Quick scan

Objects scanned: 139109

Time elapsed: 7 minute(s), 11 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Margo\AppData\Local\Temp\low\COUPON~1.DLL (Trojan.BHO.H) -> Quarantined and deleted successfully.

Link to post
Share on other sites

Hello ,

And :) My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the runscanbutton.png button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
    gmer_zip.gif
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • GMER log

Link to post
Share on other sites

when i downloaded OTL this is what happens when i double click it.

should i continue with the GMER instructions?

=================================

OTL has stopped working

Do you want to send more information about this problem?

Detials:

Files that help describe the problem:

C:\Users\Neil.Margo-PC\AppData\Local\Temp\WERD519.tmp.version.txt

C:\Users\Neil.Margo-PC\AppData\Local\Temp\WERE502.tmp.appcompat.txt

C:\Users\Neil.Margo-PC\AppData\Local\Temp\WERE522.tmp.mdmp

Link to post
Share on other sites

Yes, please continue with GMER.

Lets use DDS as alternative for OTL:

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Download DDS by sUBs from one of the following links. Save it to your desktop.

    [*]Double click on the DDS icon, allow it to run.

    [*]A small box will open, with an explaination about the tool. No input is needed, the scan is running.

    [*]Notepad will open with the results.

    [*]Follow the instructions that pop up for posting the results.

    [*]Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Link to post
Share on other sites

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-05-25 18:32:13

Windows 6.0.6002 Service Pack 2

Running: c8qqltir.exe; Driver: C:\Users\NEIL~1.MAR\AppData\Local\Temp\uwlcypod.sys

---- System - GMER 1.0.15 ----

SSDT 86E26120 ZwAlertResumeThread

SSDT 86E00DB0 ZwAlertThread

SSDT 87097970 ZwAllocateVirtualMemory

SSDT 86E0ABD0 ZwAlpcConnectPort

SSDT 87129348 ZwAssignProcessToJobObject

SSDT 86DD0E58 ZwCreateMutant

SSDT 86E018C0 ZwCreateSymbolicLinkObject

SSDT 86E09068 ZwCreateThread

SSDT 86F1F120 ZwDebugActiveProcess

SSDT 871183D8 ZwDuplicateObject

SSDT 870975F8 ZwFreeVirtualMemory

SSDT 86E50B80 ZwImpersonateAnonymousToken

SSDT 86E23110 ZwImpersonateThread

SSDT 86E0AB58 ZwLoadDriver

SSDT 86BE1550 ZwMapViewOfSection

SSDT 86F45110 ZwOpenEvent

SSDT 86D09920 ZwOpenProcess

SSDT 86DF2310 ZwOpenProcessToken

SSDT 86EF9118 ZwOpenSection

SSDT 86BE1968 ZwOpenThread

SSDT 86E00460 ZwProtectVirtualMemory

SSDT 86DF5C48 ZwResumeThread

SSDT 86DD0110 ZwSetContextThread

SSDT 86E47558 ZwSetInformationProcess

SSDT 871BDEC8 ZwSetSystemInformation

SSDT 86E27520 ZwSuspendProcess

SSDT 86DF4118 ZwSuspendThread

SSDT 86DF1068 ZwTerminateProcess

SSDT 86DCF5A0 ZwTerminateThread

SSDT 86D96068 ZwUnmapViewOfSection

SSDT 86E479D8 ZwWriteVirtualMemory

SSDT 86DCC110 ZwCreateThreadEx

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 11D 820C6880 8 Bytes [20, 61, E2, 86, B0, 0D, E0, ...]

.text ntkrnlpa.exe!KeSetEvent + 131 820C6894 4 Bytes [70, 79, 09, 87]

.text ntkrnlpa.exe!KeSetEvent + 13D 820C68A0 4 Bytes [D0, AB, E0, 86]

.text ntkrnlpa.exe!KeSetEvent + 191 820C68F4 4 Bytes [48, 93, 12, 87]

.text ntkrnlpa.exe!KeSetEvent + 1F5 820C6958 4 Bytes [58, 0E, DD, 86]

.text ...

.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C409340, 0x3DA8C7, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

---- EOF - GMER 1.0.15 ----

Attach.zip

DDS.zip

Link to post
Share on other sites

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites

MBAM full scan most likely finds an object in System Restore or Quarantine if the quick scan detects nothing. Usually this is nothing to worry about.

How are things running now, what problems do you still have left?

Regarding the MBAM stop error, do you get also an error code 721 with this?

Link to post
Share on other sites

Hello again, yes a few minor issues to take care of :welcome:

CF-SCRIPT

-------------

We need to execute a CF-script.

  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

File::
c:\windows\TEMP\TMP00000007D39E1601A6E0850A

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Now please click Start > Run, type chkdsk /r in the runbox and press enter. You will be prompted in a command window to confirm to run the disk check on the next reboot. Type Y and press enter.

Now reboot your computer and allow the disk check to run unhindered.

Afterwards try the MBAM scan again and see if you get the stop error now.

Link to post
Share on other sites

here is the log file combofix.txt

i followed directions for the disk check. although after i type chkdsk /r into the run box

a small black window pops up and disappears with out time to even read it

so after the reboot no disk chack was run that i know of.

================================================

ComboFix 10-05-26.01 - Neil 05/28/2010 10:16:46.2.2 - x86

Microsoft

Link to post
Share on other sites

In Vista, even if you have an account with Admin rights, sometimes you need to choose to run certain applications as Administrator. This is done to make it harder for things like malware to take control of your computer.

Lets just open an elevated command prompt:

Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

Run chkdsk /r from the commandprompt.

Link to post
Share on other sites

This indicates a problem with the disk usually, not malware.

Run a Disk Check on your C: drive in Windows Vista or Windws 7:

  • Click the Start vista-7-start.png button and select Computer
  • Right-click on C: and select Properties
  • Click on the Tools tab
  • Under Error-checking click the Check Now... button and click Continue at the User Account Control prompt
  • Mark the box next to Automatically fix file system errors and Scan for and attempt recovery of bad sectors
  • When the message box pops up, click the Schedule disk check button and restart your computer
  • Once your computer restarts it will check the drive, don't press any keys so that it is allowed to do so

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.