Infected with Disk Doctor Application

[Guest Pitmaster]

Hi,

Disk Doctor were installed into my computer without permission and made a big mess.

I used Malwarebytes to clean my pc but still i have black, empty desktop ;/

DDS (Ver_10-12-05.01) - NTFSx86

Run by Pitmaster at 13:50:41,62 on Fri 12/10/2010

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Home Premium 6.1.7600.0.1250.48.1033.18.3033.1864 [GMT 1:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\MetaTrader 5\metatester.exe

C:\Program Files\MetaTrader 5\metatester.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Program Files\Google\Gmail Notifier\gnotify.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\igfxpers.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Gadu-Gadu 10\gg.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Users\Pitmaster\Downloads\putty_ssh.exe

C:\Users\Pitmaster\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Pitmaster\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Pitmaster\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Users\Pitmaster\Downloads\dds.scr

C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uStart Page = https://fxtrade.oanda.com/your_account/logi...rading_platform

BHO: vShare Plugin: {043c5167-00bb-4324-af7e-62013faedacf} - c:\program files\vshare\vshare_toolbar.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: QUICKfind BHO Object: {c08df07a-3e49-4e25-9ab0-d3882835f153} - c:\progra~1\idm\quickf~1\plugins\IEHelp.dll

BHO: Java

Attach.txt

ark.txt

[Maniac]

Hello Pitmaster! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Step 1

Going over your logs I noticed that you have

[Guest Pitmaster]

I have message:

The error returned was:

Sorry, your post was too long, please reduce it

...

so i attach this file.

i am not able to find extras.txt

otl.txt

[Maniac]

Please go to www.virustotal.com and upload these files one by one:

C:\Windows\DI5JD5WJ.ocx

C:\Windows\System32\9RRJBIWD.ocx

Please post the resaults in your next reply.

[Guest Pitmaster]

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: DI5JD5WJ.ocx

Submission date: 2010-12-14 09:48:07 (UTC)

Current status: finished

Result: 0/ 43 (0.0%)

VT Community

not reviewed

Safety score: -

Compact

Print results

Antivirus Version Last Update Result

AhnLab-V3 2010.12.14.00 2010.12.14 -

AntiVir 7.11.0.31 2010.12.14 -

Antiy-AVL 2.0.3.7 2010.12.14 -

Avast 4.8.1351.0 2010.12.13 -

Avast5 5.0.677.0 2010.12.13 -

AVG 9.0.0.851 2010.12.13 -

BitDefender 7.2 2010.12.14 -

CAT-QuickHeal 11.00 2010.12.14 -

ClamAV 0.96.4.0 2010.12.14 -

Command 5.2.11.5 2010.12.14 -

Comodo 7057 2010.12.14 -

DrWeb 5.0.2.03300 2010.12.14 -

Emsisoft 5.1.0.1 2010.12.14 -

eSafe 7.0.17.0 2010.12.13 -

eTrust-Vet 36.1.8040 2010.12.14 -

F-Prot 4.6.2.117 2010.12.13 -

F-Secure 9.0.16160.0 2010.12.14 -

Fortinet 4.2.254.0 2010.12.13 -

GData 21 2010.12.14 -

Ikarus T3.1.1.90.0 2010.12.14 -

Jiangmin 13.0.900 2010.12.13 -

K7AntiVirus 9.72.3235 2010.12.13 -

Kaspersky 7.0.0.125 2010.12.14 -

McAfee 5.400.0.1158 2010.12.14 -

McAfee-GW-Edition 2010.1C 2010.12.14 -

Microsoft 1.6402 2010.12.14 -

NOD32 5700 2010.12.13 -

Norman 6.06.12 2010.12.14 -

nProtect 2010-12-14.01 2010.12.14 -

Panda 10.0.2.7 2010.12.13 -

PCTools 7.0.3.5 2010.12.14 -

Prevx 3.0 2010.12.14 -

Rising 22.78.00.04 2010.12.14 -

Sophos 4.60.0 2010.12.14 -

SUPERAntiSpyware 4.40.0.1006 2010.12.14 -

Symantec 20101.3.0.103 2010.12.14 -

TheHacker 6.7.0.1.099 2010.12.13 -

TrendMicro 9.120.0.1004 2010.12.14 -

TrendMicro-HouseCall 9.120.0.1004 2010.12.14 -

VBA32 3.12.14.2 2010.12.13 -

VIPRE 7644 2010.12.14 -

ViRobot 2010.12.14.4199 2010.12.14 -

VirusBuster 13.6.92.0 2010.12.13 -

Additional informationShow all

MD5 : 2d4347fa9d465db93f7319ce9e90294c

SHA1 : be3792daf77185af0fef2b98604536302ae3429c

SHA256: f0453606c18cb5ce24a58fcdf1d79844f92d1693597df961d8c54e613c549041

ssdeep: 12:DlZt5Kg0+aI+aI+aN2rA2222222222e9rmmmmmmmmmbQgttneKz+aA:5VhFXhQeR

File size : 3120 bytes

First seen: 2010-12-14 09:48:07

Last seen : 2010-12-14 09:48:07

TrID:

Game Music Creator Music (21.2%)

MacBinary 1 header (19.3%)

MacBinary 2 header (18.8%)

Adobe PhotoShop Brush (18.8%)

BONK lossless/lossy audio compressor (18.7%)

sigcheck:

publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

==================================

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: 9RRJBIWD.ocx

Submission date: 2010-12-14 09:56:42 (UTC)

Current status: finished

Result: 0/ 42 (0.0%)

VT Community

not reviewed

Safety score: -

Compact

Print results

Antivirus Version Last Update Result

AhnLab-V3 2010.12.14.00 2010.12.14 -

AntiVir 7.11.0.31 2010.12.14 -

Antiy-AVL 2.0.3.7 2010.12.14 -

Avast 4.8.1351.0 2010.12.13 -

Avast5 5.0.677.0 2010.12.13 -

AVG 9.0.0.851 2010.12.13 -

BitDefender 7.2 2010.12.14 -

CAT-QuickHeal 11.00 2010.12.14 -

ClamAV 0.96.4.0 2010.12.14 -

Command 5.2.11.5 2010.12.14 -

Comodo 7057 2010.12.14 -

DrWeb 5.0.2.03300 2010.12.14 -

Emsisoft 5.1.0.1 2010.12.14 -

eSafe 7.0.17.0 2010.12.13 -

eTrust-Vet 36.1.8040 2010.12.14 -

F-Prot 4.6.2.117 2010.12.13 -

F-Secure 9.0.16160.0 2010.12.14 -

Fortinet 4.2.254.0 2010.12.13 -

GData 21 2010.12.14 -

Ikarus T3.1.1.90.0 2010.12.14 -

Jiangmin 13.0.900 2010.12.13 -

K7AntiVirus 9.72.3235 2010.12.13 -

Kaspersky 7.0.0.125 2010.12.14 -

McAfee 5.400.0.1158 2010.12.14 -

McAfee-GW-Edition 2010.1C 2010.12.14 -

Microsoft 1.6402 2010.12.14 -

NOD32 5700 2010.12.13 -

Norman 6.06.12 2010.12.14 -

nProtect 2010-12-14.01 2010.12.14 -

Panda 10.0.2.7 2010.12.13 -

PCTools 7.0.3.5 2010.12.14 -

Rising 22.78.00.04 2010.12.14 -

Sophos 4.60.0 2010.12.14 -

SUPERAntiSpyware 4.40.0.1006 2010.12.14 -

Symantec 20101.3.0.103 2010.12.14 -

TheHacker 6.7.0.1.099 2010.12.13 -

TrendMicro 9.120.0.1004 2010.12.14 -

TrendMicro-HouseCall 9.120.0.1004 2010.12.14 -

VBA32 3.12.14.2 2010.12.13 -

VIPRE 7644 2010.12.14 -

ViRobot 2010.12.14.4199 2010.12.14 -

VirusBuster 13.6.92.0 2010.12.13 -

[Maniac]

• Run OTL.exe
  
• Under Custom Scans/Fixes post the following script:
  

:files
C:\Users\Pitmaster\AppData\Local\*.html
C:\Windows\*.tmp

:Commands
[purity]
[emptytemp]

• Then click the Run Fix button at the top
  
• Let the program run unhindered,when it is done it will say "Fix Complete press ok to open log"
  
• Please post that log in your next reply.
  

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!