Hidden Process trying to access malicious site 193.105.207.151

[aadi]

I followed all the steps as mentioned in the reply to my erlier post with the same topic title. I am sending the detail logs after running following utilities

DeFogger

DDS

GMER Rootkit Scanner

Please go through these log files and suggest me next course of action. for your help below is the text of my earlier post related to this problem

Thanks!

Aadi

Hi,

My PC seems to be under attack of a virus/Trojan/Malware. Everytime I connect to Internet, some process try to connect to the IP address 193.105.207.151. I have installed Malwarebyte's Anti-Malware. every time it shows me the popup saying it blocked access to the site 193.105.207.151. Google Chrome has been crashed as well but I can run IE and Firefox. As soon as I open IE or Firefox I start getting this popup from Malwarebyte's. I have latest version of Mcafee and Malwarebytes but none of them could find any virus/trojan definition in my system. Here is my System Info

OS Version: Microsoft

ark.txt

Attach.txt

DDS.txt

mbam_log_2010_09_25__12_07_24_.txt

defogger_disable.txt

[kahdah]

Hello aadi

Welcome to Malwarebytes.

=====================

Are you connected via a router?

=====================

• Download OTL to your desktop.
  
• Double click on OTL to run it.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Under Custom scan's and fixes section paste in the below in bold
  

  
  

  netsvcs
  
  
  %SYSTEMDRIVE%\*.*
  
  
  %systemroot%\system32\*.dll /lockedfiles
  
  
  %systemroot%\Tasks\*.job /lockedfiles
  
  
  %systemroot%\System32\config\*.sav
  
  
  %systemroot%\system32\drivers\*.sys /90
  
  
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll

  
  

• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    

====================

Please download Rootkit Unhooker and save it to your desktop.

• Double-click RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan
  
• Check Drivers, Stealth Code, Files, and Code Hooks
  
• Uncheck the rest, then click OK
  
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  
• Wait till the scanner has finished then go File > Save Report
  
• Save the report somewhere you can find it, typically your desktop. Click Close
  
• Copy the entire contents of the report and paste it in your next reply.
  

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

[aadi]

Hi ,

Thanks for responding to my problem. I followed the steps by running the utilities OTL and Rootkit Unhooker. I am sending the reports as attached files as upon pasting the contents of file i am getting the error that text is too long to post. Please review these reports and let me know what should be my next step.

Thanks!

Aadi

OTL.Txt

Extras.Txt

Report.txt

[kahdah]

Are you connected with a router?

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

========

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
• Double click on ComboFix.exe & follow the prompts.
  

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[aadi]

Yes, I am connected with a wireless router. I ran the TDSKiller and Combofix utilities and sending you the log files as per guidelines. Please see the attachments as TDSSKiller.2.4.2.1_27.09.2010_17.55.44_log.txt and log.txt.

Please let me know about the next step in removing this virus.

Thanks a lot!

Hitesh

Are you connected with a router?

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

========

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
• Double click on ComboFix.exe & follow the prompts.
  

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

TDSSKiller.2.4.2.1_27.09.2010_17.55.44_log.txt

log.txt

[kahdah]

See if you can bypass the router and see if you get the same detections.

Let me know the outcome.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!