|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-12-2007, 07:56 PM
|
#1 (permalink) | |
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Malware has taken over! Hijackthis logfile follows..
OK, about 48hrs ago, my PC was taken over by a storm of malware. Spybot removed hundreds of programs, but the lingering effects are:
1. Locked out "by System Administrator" of my Control Panel and all System-oriented functions. 2. Massive amounts of CPU (>70%) being used even when I'm not doing anything. 3. Keystrokes are slow, missing letters if I type too fast. Help? Quote:
|
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-13-2007, 04:00 PM
|
#4 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Hello,
Are you going to stick with me until the end? Seems you abandoned your last thread started.... http://www.techsupportforum.com/secu...opping-up.html If you have the intent to stick with it until the end then please following the below instructions -------------------------------------------------------------- Please subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription. -------------------------------------------------------------- Please download SmitfraudFix (by S!Ri) to your Desktop. Double-click smitfraudfix.exe to start the tool. Select option #1 - Search by typing 1 and press "Enter" and a text file will appear which lists infected files (if present). Please copy/paste the content of that report into your next reply. Do not run option #2 unless instructed to!! -------------------------------------------------------------- Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
-------------------------------------------------------------- Please include the following in your next reply: SmitfraudFix Report C:\Deckard\System Scanner\main.txt C:\Deckard\System Scanner\extra.txt - Attached please
__________________
 Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum Last edited by forhockey; 10-13-2007 at 04:05 PM. |
|
|
|
|
10-13-2007, 05:38 PM
|
#5 (permalink) | ||
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
Thanks.
Smitfraud logfile: Quote:
Quote:
Last edited by CamwynF; 10-13-2007 at 06:08 PM. |
||
|
|
|
|
10-13-2007, 09:36 PM
|
#7 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Hi CamwynF,
Before beginning the proposed fix, read this post completely. Any questions should be kindly asked before proceeding. Ensure that there are no open browsers when carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------
--------------------------------------------------------------
-------------------------------------------------------------- Delete your old copy of ComboFix and download a new copy.
Please download HijackThis. This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Install" button. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Double click on HijackThis.exe to run the program. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. -------------------------------------------------------------- Please reply back with the following logs: C:\rapport.txt C:\ComboFix.txt HiJackThis log
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
10-14-2007, 08:19 AM
|
#8 (permalink) | |
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
Here's the logs:
Quote:
|
|
|
|
|
|
10-14-2007, 11:51 AM
|
#9 (permalink) | |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Hi CamwynF,
Before beginning the proposed fix, read this post completely. Any questions should be kindly asked before proceeding. Ensure that there are no open browsers when carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. -------------------------------------------------------------- Please go to: VirusTotal
If VirusTotal is busy, try the same at Jotti --------------------------------------------------------------
-------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall -------------------------------------------------------------- How is your system behaving now? -------------------------------------------------------------- Please reply back with the following logs: Virus Total Results C:\rapport.txt C:\ComboFix.txt Update on system behaviour?
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
|
10-15-2007, 10:25 AM
|
#10 (permalink) | ||
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
The script:
Quote:
No visible improvement in system performance. VirusTotal Report: Quote:
|
||
|
|
|
|
10-15-2007, 06:08 PM
|
#11 (permalink) | |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Hi CamwynF,
Could you please stop attaching the logs, as it is making it is making the transition difficult for reading all the logs, thanks. -------------------------------------------------------------- Before beginning the proposed fix, read this post completely. Any questions should be kindly asked before proceeding. Ensure that there are no open browsers when carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. -------------------------------------------------------------- Disable S& D Spybot's Tea Timer While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
-------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below: (don't forget to copy and paste REGEDIT4) Quote:
It should look like this:  Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. -------------------------------------------------------------- Open My Computer. Select the View menu and click Folder Options. Select the View Tab then select Show all files in the Hidden files section. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK. -------------------------------------------------------------- Delete the following File indicated in RED and Folder indicated in BLUE if they still exist. C:\Program Files\ComPlus Applications C:\WINDOWS\tsitra11.exe Note: If you have trouble deleting the above entries, then boot into Safe Mode to delete them. -------------------------------------------------------------- Do you recognize this folder? Please open the folder and tell me what files and folders are within. C:\From the Earth to the Moon -------------------------------------------------------------- Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs: Java 2 Runtime Environment, SE v1.4.2_13 <- Known to be vulnerable to current infections out there K-Lite Mega Codec Pack 1.53 <- Known to contain malware -------------------------------------------------------------- Restart your computer for the changes to take in effect. -------------------------------------------------------------- Updating Java:
-------------------------------------------------------------- Perform an online scan with Internet Explorer with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan -------------------------------------------------------------- Please run HiJackThis again, and post the resulting log. -------------------------------------------------------------- Please reply back with the following logs: Inquiry about C:\From the Earth to the Moon Panda Online Scan Results New HiJackThis Log
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
|
10-18-2007, 07:28 PM
|
#12 (permalink) | |
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
Sorry it took so long to reply, been having Internet troubles in my area.
Couldn't get Pandascan to work. It starts off well, but closes itself after completing ~25% of the scan. C:\From the Earth to the Moon was an empty folder. Deleted. Hijackthis Log follows: Quote:
|
|
|
|
|
|
10-18-2007, 10:22 PM
|
#13 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Lets try another online scan from Kaspersky. By the way, how is your system behaving now?
Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
10-19-2007, 10:09 AM
|
#14 (permalink) | |
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
No visible improvement in performance.
Kapersky Log: Quote:
|
|
|
|
|
|
10-19-2007, 07:30 PM
|
#15 (permalink) | |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Please download ATF Cleaner - http://www.atribune.org/ccount/click.php?id=1
ATF Cleaner * Double-click ATF-Cleaner.exe to run the program. * Click Select All found at the bottom of the list. * Click the Empty Selected button. If you use Firefox browser, do this also: * Click Firefox at the top and choose Select All from the list. * Click the Empty Selected button. * NOTE : If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser, do this also: * Click Opera at the top and choose Select All from the list. * Click the Empty Selected button. * NOTE : If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. -------------------------------------------------------------- Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFScript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall -------------------------------------------------------------- Please do an online virus scan with BitDefender: http://www.bitdefender.com/scan8/ie.html
-------------------------------------------------------------- Please reply back with the following logs: C:\ComboFix.txt Bit Defender
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
|
10-27-2007, 07:32 PM
|
#16 (permalink) | |
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
Sorry it took so long, internet was down due to the local flooding.
BitDefender's ActiveX prog would not install (it could not copy a file). No improvement after Combofix process. Combofix log: Quote:
|
|
|
|
|
|
10-28-2007, 10:29 AM
|
#17 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Please do an online virus scan with BitDefender:
http://www.bitdefender.com/scan8/ie.html
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
11-03-2007, 12:43 PM
|
#18 (permalink) | ||
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
Quote:
Quote:
|
||
|
|
|
|
11-03-2007, 09:42 PM
|
#19 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,940
OS: Windows 7 Ultimate
|
Re: Malware has taken over! Hijackthis logfile follows..
Hi CamwynF,
I'm only seeing a few entries in your logs. Can you navigate to the following folder and tell me if exists and what is in it? C:\Documents and Settings\Michael Magee\Start Menu\Programs\Startup\New Folder -------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O16 - DPF: {CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA} (Java Plug-in 1.4.2_13) - Please remember to close all other windows, including browsers then click Fix checked.
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
11-06-2007, 06:34 PM
|
#20 (permalink) | |
|
Registered User
Join Date: Sep 2007
Posts: 16
OS: XP
|
Re: Malware has taken over! Hijackthis logfile follows..
C:\Documents and Settings\Michael Magee\Start Menu\Programs\Startup\New Folder
It exists and is empty. It also pops up every time I restart my pc. Quote:
|
|
|
|
|
| Thread Tools | |
|
|
located at the bottom of the page.
then click 
08 135,168 ----a-w C:\WINDOWS\catchme.exe
