Need Help Please!

[Komeiji]

So I was browsing youtube when this popup comes up. (I normally don't get popups)

but it was running this scan on my computer, clearly fake so I tried to exit out.

Prompts kept the stupid thing open with questions like

ARE YOU SURE? YOUR COMPUTER WILL GO UNPROTECTED

WOULD YOU LIKE TO PURCHASE OUR SOFTWARE?

I got the stupid thing closed but my firefox was unaccesable from a proxy or something from that point

so I ran a malwarebytes scan afraid I was infected with something.

5 Infections came up, I didn't save the log but it said they were all removed successfully.

and I was prompted to restart my computer.

When I restarted windows said it couldnt start up properly so it had to run a repair.

after the repair ran i got to my desktop where my anti-virus was now updating in the corner.

I feared I did not get whatever was there out of the system properly as many updates started going

I ran another malwarebytes scan and got no results as follows below....

Even though my computer detects no viruses, I do not trust that.

Can you guys help me sniff out anything that might still be here?

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4313

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18999

1/31/2011 8:23:30 PM

mbam-log-2011-01-31 (20-23-30).txt

Scan type: Quick scan

Objects scanned: 129134

Time elapsed: 16 minute(s), 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Maniac]

Hello Komeiji! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Your program and database version of Malwarebytes' Anti-Malware are very old. You need to update it before scan:

Step 1

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "-Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Step 2

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
     
  2. Attach.txt
     

  [*]Save both reports to your desktop. Post them back to your topic.

In your next reply, please include these log(s):

1. Malwarebytes' Anti-Malware log
   
2. DDS log with Attach.txt
   

[Komeiji]

Hello Borislav, I request that you inform me of any findings in the following logs, even if there are none.

I appreciate your help.

---

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 5655

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18999

2/1/2011 2:19:47 PM

mbam-log-2011-02-01 (14-19-47).txt

Scan type: Quick scan

Objects scanned: 151898

Time elapsed: 11 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-12-12.02) - NTFSx86

Run by Andrew at 14:12:30.40 on Tue 02/01/2011

Internet Explorer: 8.0.6001.18999 BrowserJavaVersion: 1.6.0_23

Microsoft

Attach.zip

[Maniac]

I request that you inform me of any findings in the following logs, even if there are none.

For now - no, everything seems to be okay.

Step 1

Going over your logs I noticed that you have BitTorrent and BitTorrentBar Toolbar installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  
• They are a security risk which can make your computer susceptible to a smorgasbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
  

It is pretty much certain that if you continue to use P2P programs, you will get infected again.

I would recommend that you uninstall BitTorrent and BitTorrentBar Toolbar, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Step 2

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go here then click on:
  
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Now click on Advanced Settings and select the following:
  

• • Remove found threats
    
  • Scan archives
    
  • Scan for potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth Technology
    

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

[Komeiji]

C:\HP\HPQWare\aim_icq\triton_de_de\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

C:\HP\HPQWare\aim_icq\triton_en_gb\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

C:\HP\HPQWare\aim_icq\triton_es_es\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

C:\HP\HPQWare\aim_icq\triton_fr_fr\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

C:\HP\HPQWare\aim_icq\triton_it_it\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

C:\HP\HPQWare\aim_icq\triton_nl_nl\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

C:\Users\Andrew\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\6bafd9a6-34764530 probably a variant of Win32/Agent.FPEXZHL trojan deleted - quarantined

C:\Users\Andrew\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\472eb3f0-44e9f8b1 multiple threats deleted - quarantined

C:\Users\Andrew\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\481ee53d-63d5b693 probably a variant of Win32/Agent.HRYTTOE trojan deleted - quarantined

and heres the log....

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6419

# api_version=3.0.2

# EOSSerial=18b34776c9f3564b87b3f1427fefed84

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-02-02 02:59:36

# local_time=2011-02-01 08:59:36 (-0600, Central Standard Time)

# country="United States"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1032 16777213 100 95 0 39659616 0 0

# compatibility_mode=5892 16776574 100 100 23554116 133211044 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=315313

# found=9

# cleaned=9

# scan_time=12105

C:\HP\HPQWare\aim_icq\triton_de_de\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\HP\HPQWare\aim_icq\triton_en_gb\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\HP\HPQWare\aim_icq\triton_es_es\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\HP\HPQWare\aim_icq\triton_fr_fr\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\HP\HPQWare\aim_icq\triton_it_it\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\HP\HPQWare\aim_icq\triton_nl_nl\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Andrew\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\6bafd9a6-34764530 probably a variant of Win32/Agent.FPEXZHL trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Users\Andrew\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\472eb3f0-44e9f8b1 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Users\Andrew\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\481ee53d-63d5b693 probably a variant of Win32/Agent.HRYTTOE trojan (deleted - quarantined) 00000000000000000000000000000000 C

[Maniac]

Perform a full system scan with your AVG and let me know.

There is nothing special here.

[Komeiji]

Nothing came up in the AVG scan

I take it we're all done?

[Maniac]

Yes, I think so.

Step 1

Please uninstall ESET Online Scanner.

Step 2

Please manually delete DDS.

Step 3

Keep your software up-to-date:

www.bleepingcomputer.com/tutorials/tutorial174.html

Some malware preventions:

http://forums.malwarebytes.org/index.php?showtopic=9365

Safe surfing!

[Komeiji]

awesome, thanks for your help!

as for your tip about bittorrent

I don't even use it really, so I guess I might as well part with it.

[Maniac]

Good decision!

You're welcome!

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.