Tech Support Forum - View Single Post

**Angelfire777** · 01-22-2008, 03:21 AM

Hi,

Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold.

If you or your system administrator didn't set these policies, fix them.

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close your browsers and all open windows except for HijackThis, then click "Fix checked". Exit HijackThis.
_________

Combofix Deletions

Open notepad.
Copy and paste the text inside the code box below to notepad

Code:

Killall::

File::
C:\Program Files\error.dat
C:\Documents and Settings\Julio F. Sanz\scvhost.exe
C:\Documents and Settings\Julio F. Sanz\wn852.exe
C:\WINDOWS\system32\dllcache\svchost.exe.tmp
C:\WINDOWS\windisk.exe
C:\Documents and Settings\Julio F. Sanz\Julio F. Sanz.exe
C:\Documents and Settings\All Users\All Users.exe
C:\WINDOWS\system32\osqznsmOkZ.dll
C:\WINDOWS\system32\kcopt.dll
C:\DOCUME~1\JULIOF~1.SAN\LOCALS~1\Temp\wda2.exe
C:\DOCUME~1\JULIOF~1.SAN\LOCALS~1\Temp\wdc1.exe
C:\windows\system32\drivers\Qwc40.sys
C:\windows\system32\drivers\Rwc40.sys
C:\windows\system32\Qwc40.sys
C:\windows\system32\Rwc40.sys
C:\WINDOWS\TEMP\46698609.exe

Folder::
C:\Documents and Settings\Julio F. Sanz\Application Data\EliteProtector
C:\Program Files\orepqrkl
C:\WINDOWS\rgspjnbm
C:\Program Files\Gnpitnkz
C:\Program Files\Cvwgqyez

Rootkit::
C:\WINDOWS\system32\svchost.exe.tmp

Driver::
RasMan

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender Monitor"=-
"Windows Defender Updater"=-
"Windows Defender"=-
"Windows Defender Adds"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=-
"Windows Defender Adds"=-
"Windows Defender Monitor"=-
"Windows Defender Updater"=-
"KernelDrv.exe"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Qwc40.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Rwc40.sys]

Dirlook::
C:\Documents and Settings\Administrator.FERNANDO.000\WINDOWS

Save and Name it as "CFScript"
Drag and drop CFScript.txt to your copy of combofix.
You can take a look at the image below if you're unsure on how to do it.
Combofix wil restart your machine then it will produce a log afterwards.
Please post the contents of that log along with a fresh HijackThis log.

________

I would like you to scan a file for me.

Please go HERE. Copy and paste the following file path in to the box.

C:\CMA\bin\BHODownload.dll

Then click submit.

Please post the results to your next reply.

If Jotti is too busy, you can go HERE and do the same as above.
________

Please do an online scan with Kaspersky WebScanner

Warning: If you had kaspersky online scanner installed before 10-5-2007, please uninstall it as kaspersky released a new version. Previous version had a serious flaw which could result in a buffer overflow.

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Extended (if available otherwise Standard)
- Scan Options:
- Scan Archives
  Scan Mail Bases
Click OK
Now under select a target to scan:
- Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
_________

Your Java is out of date....
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.

Click Start > Control Panel
Click Add/Remove Programs
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download Java Runtime Environment 6u4, and install it to your computer.

On your next reply, please include a

Fresh HijackThis log.
kaspersky scan log
combofix log
jotti scan log

01-22-2008, 03:21 AM	#7 (permalink)
Angelfire777 Moderator/Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Oct 2006 Posts: 4,580 OS: Vista	Re: Restrictions on my computer please help! Hi, Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold. If you or your system administrator didn't set these policies, fix them. O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present Close your browsers and all open windows except for HijackThis, then click "Fix checked". Exit HijackThis. _________ Combofix Deletions Open notepad. Copy and paste the text inside the code box below to notepad Code: Killall:: File:: C:\Program Files\error.dat C:\Documents and Settings\Julio F. Sanz\scvhost.exe C:\Documents and Settings\Julio F. Sanz\wn852.exe C:\WINDOWS\system32\dllcache\svchost.exe.tmp C:\WINDOWS\windisk.exe C:\Documents and Settings\Julio F. Sanz\Julio F. Sanz.exe C:\Documents and Settings\All Users\All Users.exe C:\WINDOWS\system32\osqznsmOkZ.dll C:\WINDOWS\system32\kcopt.dll C:\DOCUME~1\JULIOF~1.SAN\LOCALS~1\Temp\wda2.exe C:\DOCUME~1\JULIOF~1.SAN\LOCALS~1\Temp\wdc1.exe C:\windows\system32\drivers\Qwc40.sys C:\windows\system32\drivers\Rwc40.sys C:\windows\system32\Qwc40.sys C:\windows\system32\Rwc40.sys C:\WINDOWS\TEMP\46698609.exe Folder:: C:\Documents and Settings\Julio F. Sanz\Application Data\EliteProtector C:\Program Files\orepqrkl C:\WINDOWS\rgspjnbm C:\Program Files\Gnpitnkz C:\Program Files\Cvwgqyez Rootkit:: C:\WINDOWS\system32\svchost.exe.tmp Driver:: RasMan Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender Monitor"=- "Windows Defender Updater"=- "Windows Defender"=- "Windows Defender Adds"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=- "Windows Defender Adds"=- "Windows Defender Monitor"=- "Windows Defender Updater"=- "KernelDrv.exe"=- [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Qwc40.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Rwc40.sys] Dirlook:: C:\Documents and Settings\Administrator.FERNANDO.000\WINDOWS Save and Name it as "CFScript" Drag and drop CFScript.txt to your copy of combofix. You can take a look at the image below if you're unsure on how to do it. Combofix wil restart your machine then it will produce a log afterwards. Please post the contents of that log along with a fresh HijackThis log. ________ I would like you to scan a file for me. Please go HERE. Copy and paste the following file path in to the box. C:\CMA\bin\BHODownload.dll Then click submit. Please post the results to your next reply. If Jotti is too busy, you can go HERE and do the same as above. ________ Please do an online scan with Kaspersky WebScanner Warning: If you had kaspersky online scanner installed before 10-5-2007, please uninstall it as kaspersky released a new version. Previous version had a serious flaw which could result in a buffer overflow. You will be promted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. Copy and paste that information in your next post. Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. _________ Your Java is out of date.... Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components. Click Start > Control Panel Click Add/Remove Programs Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove button. Repeat as many times as necessary to remove all versions of Java. Reboot your computer once all Java components are removed. Then download Java Runtime Environment 6u4, and install it to your computer. On your next reply, please include a Fresh HijackThis log. kaspersky scan log combofix log jotti scan log __________________ UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it.