Malware or Spyware infection in my PC, please help....

Hi Everyone,

I'm a new member in this forum and I'm not really sure if the one that infected my machine is a malware, adware, or a spyware. This kind of strange because even if after I have reformat my partition C: drive and re-install winxp the spyware was still there. It pop ups on random on the website that I've accessed. It is a domain sponsor website the exact url is like "https://domaindiscount24.net". Sometimes when I access a site it will display this webpage with a message that "this url domain is block". It drives me nuts because I have reformat my machine, run and scan my pc using various anti spyware apps such as spybot, Ad aware, malware bytes, via ssafe mode and it still there.

I have attached the screen shots of the persisten spyware website. Any advice for this issue will be greatly appreciated. Thank you very much in advanced.

Bench Boy

 

http://www.majorgeeks.com/images/grenade.gifWelcome! to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif

Please follow the instructions in the READ & RUN ME FIRST link given further down and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
  • TDSSserv Non-Plug & Play Driver Disable
• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide


Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in Safe Mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. To avoid additional delay in getting a response, it is advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!
4. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

 

Hi There,

I'm still having a problem, the persistent spyware webpage that I have attached in my post is still there. It recurs when I go to mozilla firefox website, sometimes "us.imdb" website and sometimes to Microsoft sites. It's kind of strange that when accessing gaming sites such as "gamespot" it did not interfere with my browsing not even once. I have followed all your instructions and attached the logs.

Thank you very much for the continued assistance in my issue. hoping for your reply again for our next step. Thanks again.


Sending another reply for the last remaining log file attachment....

 

Hi there,

Here's the last remaining log attachment. Thank you.

 

Hi There,

One more thing do I need to disable my anti-virus in all the scanning procedures? My anti-virus is Mcafee Viruscan Enterprise 8.5i. I have only disabled it on the ComboFix because it was defined in the instruction to disable your anti-virus and any firewall. Please advice. Thank you.

 

Other than than the minor items below your logs are clean.

Step 1:

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.​

Step 2:

Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's "grey" then it's already at the default level.​

Step 3:

Please download ATF-Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF-Cleaner menu to close the program.​

Step 5:
Finally, let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi There,

The problem still persist when I tried to access "us.imdb.com" or the mozilla home page. The persistent webpage still appears on a random basis, please refer to the screen shot which I've attached in my first post. I also apologized if this issue is reallyl persistent and I'm very thankful for your continued assistance.

Bench Boy.

 

If you formatted and it still does it then it's the website.

Can you elaborate a little more on the problem?

 

Hi There,

I've only reformatted by C: drive partition. Is it possible that the spyware resides somewhere in my D: drive partition? As far as I've remembered I have encountered this issue when I'm accessing some blogspot then and then all of a sudden I have encountered an unstoppable popups, and there is nothing that I could do but to re-start my machine, then after that that's all this started this domaindiscount, domain sponsor website keeps on interfering my browsing. It's favorite target is the "us.imdb.com" website, sometimes microsoft website, sometimes other sites on random. Sometimes it will just prevent that site from being access just like the screen shot that I have attached in my first post. Then sometimes it will kind of morph itself in the website. Thank you.

 

If I understand you correctly, just surfing the internet you get random popups and to get out of them you have to restart the system, correct?

 

Hi There,

Yes, I have just re-started my machine to stop the random pop-ups. Actually the unstoppable popups already stopped in re-occuring in my machine. The only problem left is the domain service website, which is very persistent.... Thank you.

 

Domain Service Website? Can you elaborate a little? Are you talking about the website is re-directing you?

 

Hi There,

Yes, that was exactly is happening a domain sponsor/service website is redirecting my browsing to that site on a random basis... The exact url of the website is this "https://www.domaindiscount24.net" or sometimes "
ndparking.com". You may refer to the attached screen shot of the persistent spyware in my first post. Thank you.

 

Have you tried it with IE or just Firefox? If it does it on both browsers it's the website. If it only does it on Firefox, then I would suggest defaulting the settings for Firefox.

 

Hi there,

I think the problem was gone or solved.... It's kinda strange when I boot up my pc this morning... It goes to chckdisk state sort of thing, it's fast so I didn't get all the info of what's happening.. Its sort of cleaning my boot sector and then exit and continue booting up to windows. I tried to re-start again my pc but it don't show up anymore. The only latest thing that I'd do my machine is to install the "Ad aware Anniversary Edition". And now it almost hours of surfing and the persistent spyware re-directing my browsing no longer occurs... Any ideas of what was happen? I'm not really celebrating yet, I'm still observing it coz it may re occur again... Thank you.

 

Weird! Well, let us know if it happens again.

 

Hi There,

Well it happens again, its redirecting my browsing again..... whew! its same for both IE and Firefox... any ideas? Thanks.

 

See the thread below and attach a log.

Running GMER to detect rootkits

 

Hi there,

Please refer to the attached log file of GMER. Thanks a lot for your continued support.