Redirects and more and wierd program i cant remove in program list

[Lichyy]

So here i am was looking on a Swedish forum around and they said use Malwarebytes and so got into program list earlier when trying to update my phone and there taking away the stuff for update programs and so and saw some weird program called Tagging system CashTitan so i used this program here and found a lot more stuff and now using different searches and gets redirected with searches on Google log from Maleware:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Databasversion: 4309

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18928

2010-07-14 00:47:03

mbam-log-2010-07-14 (00-47-03).txt

Skanningstyp: Snabbskanning

Antal skannade objekt: 145843

F

[Lichyy]

got alot away with eset nods scan but from maleware i cant find any more except the

C:\Windows\system32\sshnas21.dll (Trojan.Downloader) -> Delete on reboot.

C:\Windows\msa.exe (Trojan.Agent) -> Delete on reboot.

C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Delete on reboot. tried press restart now but always on start it gets blocked and whne i manualy start it from icon about block left corner from windows it wont do that and cant add it to auto start for some wierd reason but eset nod did dlt theses :

C:\Program Files\VentriloMIX\Ventrilo 2.2.0.exe probably a variant of Win32/Agent trojan cleaned by deleting - quarantined

C:\Users\oskar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\7bb99554-11b784b0 probably a variant of Win32/Agent trojan deleted - quarantined

C:\Users\oskar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\7adbb65d-17057d85 a variant of Java/TrojanDownloader.Agent.NAN trojan deleted - quarantined

C:\Users\oskar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\37e00024-2304312b multiple threats deleted - quarantined

C:\Users\oskar\Desktop\M&B\GonZors_SwitchBlade-V2.0.zip.part multiple threats deleted - quarantined

C:\Users\oskar\Desktop\M&B\grejer\spel\ventriloMIX05.exe a variant of Win32/PSW.Tibia.NBI trojan deleted - quarantined

C:\Users\oskar\Documents\grejer\CheatEngine55.exe Win32/HackTool.CheatEngine application deleted - quarantined

C:\Users\oskar\grejer\Super Simple Wallhack v6.71\SSWv6.71.dll a variant of Win32/Conficker.X worm cleaned by deleting - quarantined

C:\Users\oskar\grejer\Super Simple Wallhack v6.71\SSWv6.71.exe Win32/HackTool.SuperSimpleWall application cleaned by deleting - quarantined

C:\Users\oskar\roligt\cssfusk\Super Simple CSS Wall v1.7\SSWSv1.7.exe Win32/HackTool.SuperSimpleWall application cleaned by deleting - quarantined

C:\Windows\System32\jjugtucxyqzj.exe Win32/Adware.CashTitan application deleted - quarantined

some of them used to cheat yes i know

but as stated in my first post that Cash titan is still in my program list hmm and those 3 i listed here first is those i cant manage to get away have run TDSS killer it dident found any to kill so please some of the experts help me and now RUbotted starting to detect bots please help

[Elise]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.
  

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• GMER log
  

[Lichyy]

Hey Elise ty for helping me i did tihnk i was almost fixed awhile untill awhile ago when old files deleted one started to pop out cant acces all my files got all rights otherwise and so and OTL gets stuck at some registery key with internet explorer settings and hangs totally there and gmer log dident open was forced after pressing scan to save it was to big to copy and paste the log sorry

dont know if thats before or after all started to pop up and also having in right when i right click then properties on file a unknown user never been there before it apperd today some hour ago i found some ini file one of them says like this : [.ShellClassInfo]

LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-9031

IconResource=%SystemRoot%\system32\imageres.dll,-18

[LocalizedFileNames]

Indexed Locations.search-ms=@shell32.dll,-32811

Everywhere.search-ms=@shell32.dll,-32814

Shared By Me.search-ms=@shell32.dll,-32802

Recent Music.search-ms=@shell32.dll,-32803

Recent Documents.search-ms=@shell32.dll,-32804

Recent Pictures and Videos.search-ms=@shell32.dll,-32806

Recent E-mail.search-ms=@shell32.dll,-32807

Recently Changed.search-ms=@shell32.dll,-32813

and this in onother:

[.ShellClassInfo]

LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21816

almost all about that shell32 it poped programs and files and all kind of stuff i cna open for remote help if you want please tell me your timezon if thats the case becuse this starting to grow way out of my experience thinks i have been veary veary bad hacked

but the things i have done before is

1.Avast full searches both the one they provided and custom that i did make for even more in deep no from that

2.Pctools threatfire search showed nothing both fast and complet

3.Did get MBAM and search with that removed alot and those i cant get away is on reboot tried the regiester fix but they still is there

4. Eset online scanner removed alot stands in thread also

5. TDSSkiller found nothing and removed nothing

and now that you told me and the problem is my searches gets redircted my internet is slower i can even get faster with my mobile phone with WLAN and its not my computer if you look hardware becuse there im is secured for some year a head i think except OS and maybe increase ram if get 64bit and i have a program in unistall menu called Systemtagger Cashtitan wich i cannot unistall that made me look further and got MBAM that found more and it have grown so i have found all this always using show hidden files also otherwise i wouldent have seen all new that poped just over a restart so please help me my comp is my LOVE i would hate to have to reinstall it can do almost anything for it to work please help me

MvH

Oskar

Gmer.txt

[Elise]

Hello again,

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
    

  [*]Double click on the DDS icon, allow it to run.

  [*]A small box will open, with an explaination about the tool. No input is needed, the scan is running.

  [*]Notepad will open with the results.

  [*]Follow the instructions that pop up for posting the results.

  [*]Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

[Lichyy]

here is the logs both files ziped as it did stand

DDS.zip

[Elise]

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[Lichyy]

ComboFix 10-07-15.05 - oskar 2010-07-17 15:35:22.1.4 - x86

Microsoft

[Elise]

That is not a complete log. If that was all, please rerun Combofix and see how the new log is.

[Lichyy]

sorry on first log but heres the new it took whole night for it to create the text file

ComboFix 10-07-16.01 - oskar 2010-07-17 20:39:37.2.4 - x86

Microsoft

[Elise]

Please let me know how things are running now. Try also to run OTL now.

[Lichyy]

still folders popping up and aint having the acces to all my files i had before and so and OTL still stucks at:

HKEY_USERS\S-1-5-21-1064922173-4004507268-475318638-1000\ Internet Explorer settings

and what shuld i do with like the zzz folder shuld i take SS of it and under folder and under those and post?

[Elise]

Hello again,

First of all, I see you have Threatfire installed. This can cause quite some computer issues (it is not a bad program, just causes incompatibility problems for some reason). Please uninstall this program using Add/Remove programs.

Please try to run OTL from safe mode and see if that works.

[Lichyy]

threatfire is removed now and tried OTL in safemode dident work stuck at same place did try it after i removed threatfire and did reboot before becuse threatfire needed it what now?

[Elise]

Please launch MBAM, update it and run a full scan. Post me the resulting log.

[Lichyy]

heres the log you requested

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Databasversion: 4324

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18928

2010-07-19 00:08:14

mbam-log-2010-07-19 (00-08-14).txt

Skanningstyp: Fullst

[Elise]

First of all, RUbotted is not a very trustworthy application; I never saw it pick up anything of interest.

Malicious DNS query's are something quite normal if you are not behind a router.

Please click Start > Run, type chkdsk /r and press enter.

Type Y to schedule the disk check for the next reboot. Reboot your computer and let the scan run unhindered. Note - this may take a while.

When done let me know if you notice any difference and give me an example of such a weird folder (give me the complete folder path).

[Lichyy]

when trying to run(was K

[Elise]

Doesn't look like anything useful. What happens when you just delete all these? Do you know when they started appearing?

[Lichyy]

stands in picture in bottom of both but Swedish : Skapad den: 2010-07-16 19:46 on one of the winrar files so i can guess thats the time the main folder was created : 2010-07-16 19;35:37 thers the time up the second and its a total right now of 55 folders and 13 779 files

size 7,86 MB (8

[Lichyy]

and it did let me delete those now i still have more file that wasent there since before my first post direct in c can post a

My C directory

and this also file with difrent in it lay all over the comp in folders and so on my other harddrive to

[Elise]

Just leave those files as they are! Some of them are created by the tools we used and will be removed once done.

As long as you can delete those rar files fine, there is nothing to worry about.

Apart from this and the RUbotted entries, do you have any other problems?

[Lichyy]

sorry for the time for the replay but its seems we have gotten all virus and so away or am i wrong? What shuld i do now and ty for the help so far

[Elise]

No problem for the delay.

Lets do some updating and a last check for leftovers.

UPDATE JAVA

------------------

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  
• Look for "JDK 6 Update 21 (JDK or JRE)".
  
• Click the "Download JRE" button to the right.
  
• Select your Platform: "Windows".
  
• Select your Language: "Multi-language".
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
• Click Continue and the page will refresh.
  
• Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.
  

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
  
• If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  
• When the Java Setup - Welcome window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
   
2. Click the button.
   
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. 
      
   2. Click on to download the ESET Smart Installer. Save it to your desktop.
      
   3. Double click on the icon on your desktop.
      
      
   4. Check
      
   5. Click the button.
      
   6. Accept any security warnings from your browser.
      
   7. Check
      
   8. Push the Start button.
      
   9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      
   10. When the scan completes, push
       
   11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
       Note - when ESET doesn't find any threats, no report will be created.
       
   12. Push the button.
       
   13. Push
       
       

[Lichyy]

Malicious DNS query's are something quite normal if you are not behind a router.

i am behind router is that's why i get disconnects from my internet all the time and windows auto search says says that DNS is wrong or so don't remember exactly and its cant connect to the know windows or something like that? gonna post the exact message when it go down next time im on the network when it do but only local not to internet when it crashes so(released now but to short for it to diagnostic it done)

And now to the current noticed that DNS now but i did remove all java stuff before installing new its installed now ESET Online Scan No Threats found.

What now?