Potential Malware Issue - Proxy Server Message

Before we take any steps, what is the below stuff? Did you knowingly install this?

[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-2831931749-3833700357-1592384844-1002\Software\Microsoft\Windows\CurrentVersion\Run | ClickfreeMonitor : c:\programdata\Clickfree\cfagent.exe -> Found
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-2831931749-3833700357-1592384844-1002\Software\Microsoft\Windows\CurrentVersion\Run | SacReminderHDDV2 : C:\ProgramData\Clickfree\HDDV2USB3\reminder\SacReminder.exe -> Found
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-2831931749-3833700357-1592384844-1002\Software\Microsoft\Windows\CurrentVersion\Run | ClickfreeMonitor : c:\programdata\Clickfree\cfagent.exe -> Found
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-2831931749-3833700357-1592384844-1002\Software\Microsoft\Windows\CurrentVersion\Run | SacReminderHDDV2 : C:\ProgramData\Clickfree\HDDV2USB3\reminder\SacReminder.exe -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CFUACProxy_hddv2usb3 ("C:\ProgramData\Clickfree\HDDV2USB3\UACProxy.exe" -s "-pC:\ProgramData\Clickfree\HDDV2USB3") -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CFUACProxy_hddv2usb3 ("C:\ProgramData\Clickfree\HDDV2USB3\UACProxy.exe" -s "-pC:\ProgramData\Clickfree\HDDV2USB3") -> Found

 

Ah I see that Clickfree is some USB drive used for backup! That's a strange way to install software.

Rerun RogueKiller and run a scan. After it finishes the scan, select the Registry tab and then select any of the below that exist and then click the Delete button.

Then immediately reboot your PC.

After reboot, run a new scan with RogueKiller and save a log as in original instructions and attach the new log.

Are you still having problems?

 

Isn't it just! We were just saying the same thing. I had a little look at their website.

 

It is probably not worth the effort in trying to fix them if everything is working okay now. If RogueKiller could not fix those two items than any patch we give you would not work either. Which means you would have to manually edit the registry to change the value of ProxyEnable from 1 to 0. And you will not be able to find both a 64bit and 32bit (x86) location because Microsoft has made it extremely difficult to deal with x64 vs x32 in the registry. You will only find the one entry in the path noted. If you feel comfortable editing the registry you can try changing this value.

 

Let's run the below before getting to final instructions.

Now please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

 

Which proxy server settings in particular do you mean came back?

How do you know? What was showing you this info?

 

What about Firefox?


Please download ( only download right now ) the below OTL program and save it to your Desktop:

OTL by OldTimer


Please do the below for IE:

Reset Internet Explorer 9, 10, and 11 to Defaults

And then do the below for Firefox:

Reset Firefox to Defaults


Now reset your PC and after reset check to see how things are working and now run the below whether the internet works or not.

• Right click on the OTL icon on your desktop and select Run as Administrator to run it.
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the text-field.
  
  Code:

  activex
  netsvcs
  drives
  

• Now click the button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

 

Okay then only reset IE to defaults and leave Firefox alone. But if TrendMicro is not finding an internet connection while Firefox is then your problem may be in TrendMicro and it may need to be uninstalled/reinstalled.

Sorry! Just a basic reboot .

 

So even after resetting IE to defaults you still have the issue with the proxy? If so, it is possibly that Trend Micro is blocking the change.

 

Please run the below.

Now shut down your protection software (antivirus, antispyware...etc) to avoid possible conflicts.

• Double-click OTL.exe to run. (Note: if using Vista, Win7 or Win8 use right-click and select Run as Administrator)
• Copy the text in the code box below and paste it into the text-field.

Code:

:OTL
PRC - [2014/10/21 14:02:50 | 000,305,664 | ---- | M] (Wajam Internet Technologies Inc.) -- C:\Program Files (x86)\WajaIE\WajaIE Internet Enhancer\InternetEnhancerService.exe
SRV - [2014/10/21 14:02:50 | 000,305,664 | ---- | M] (Wajam Internet Technologies Inc.) [Auto | Running] -- C:\Program Files (x86)\WajaIE\WajaIE Internet Enhancer\InternetEnhancerService.exe -- (Internet Enhancer Service)
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{831729C5-C75F-4072-B4EC-F34E1F708862}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKLM\..\SearchScopes\{831729C5-C75F-4072-B4EC-F34E1F708862}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:63615;https=127.0.0.1:63615
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:63615;https=127.0.0.1:63615
IE - HKU\S-1-5-21-2831931749-3833700357-1592384844-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
[2014/10/24 00:18:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WajaIE

:Files
C:\Program Files (x86)\WajaIE
:Commands
[PURITY]
[EMPTYTEMP] 
[EMPTYFLASH]
[REBOOT]

• Now click the button.
• If the fix needed a reboot please do it.
• Click the OK button (upon reboot).
• When OTL is finished, Notepad will open. Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (See: How to attach)

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the log from OTL
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Please uninstall TrendMicro and then reboot. After reboot rerun my whole previous fix and let's see what happens.

 

Well I still see signs of it. I'm starting to wonder if the ClickFree software ( which uses the word proxy ) is the cause or is this just a coincidence.

Keep TrendMicro uninstalled for now because it was like causing us problems and it was broken anyway.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:63615;https=127.0.0.1:63615
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>

After clicking Fix, exit HJT.

Run a new scan with RogueKiller and if you see any of those Proxy items show up, select them and allow RogueKiller to fix them. Then immediately reboot. After reboot run a new scan with both RogueKiller and Hitman and attach the new logs.

Has the problem returned or are things still good?

 

You're welcome. Looks good now.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
9. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
   • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
   • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
   • Then we want you to Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

TrendMicro is okay. If you paid for it and it has not expired there is no reason to drop it. Just reinstall and update. It seemed to be broken before.

MSE is okay but may not be rated as high as TrendMicro. But MSE is free. Avast is another good choice.

You're welcome.

 

You're welcome. Surf safely!