Infected? Homepage hijack

brunobru · Oct 13, 2008

Hello Geeks and non geeks,

Last month my homepage was being redirected to v11.www.msn.com instead of my usual www.msn.com, and I don't know if it was bad, so ran different scans, and ad-aware quarantined some things, and on startup a window pops up and the bar says autoplay.exe with a searching flashlight but I always close the window before it can finish whatever it's doing. I don't remember (sorry) what all was found, some things were removed. I'm no longer getting redirected but am getting autoplay.exe at almost every startup.

I ran panda online scan and it found virus/trojan:
C:\Program Files\DIGStream\digstream.exe which I tried to unistall but it would not let me.

I noticed during spybot scan that when scanning the registry it is naming the the internet Domain section as EscDomain instead of Domain, which I've never seen before.

Yesterday (and this morning) I followed the Run and Read me first directions, hopefully did it right.
The superAntiSpyware scan came out clean, as did the spybot (but last month Ad-aware found and fixed a few things).

Can you please help with reading my logs?

MGlogs log to follow...

Thanks!!

brunobru · Oct 13, 2008

MGlogs log...

Thanks again for any help!

TimW · Oct 14, 2008

C:\Program Files\DIGStream\digstream.exe

Disney Internet Group Streaming. System Tray background downloading task from ESPN Motion, the online sports channel, MOVIES.COM, or ABC TV (all part of the Disney Group). This task downloads in the background videos that you will watch or are likely to watch when you access, or next access ESPN Motion, Movies.com, or ABC TV. It is through this invisible background downloading that these services achieve their seemingly seamless, no-buffering, and uninterrupted, video streaming when you watch a video.
Click to expand...

False positive by Panda.

Your logs are clean......you may wish to post in the software forum to further pursue those issues.

Now we need to clean up from the scans:
Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_CURRENT_USER\Software\Kazaa]
[-HKEY_LOCAL_MACHINE\SOFTWARE\knight]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-
Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

If you get a success message, then:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

brunobru · Oct 14, 2008

Hello and thank you TimW!

I will try the cleanup as you instructed and will let you know about the 'success' message. It may take me a few days to get this done and get back to you because of my work schedule.

I noticed during spybot scan that when scanning the registry it is naming the the internet Domain section as EscDomain instead of Domain, which I've never seen before.
Click to expand...

Should this be a concern? Did malware change the registry? :confused

Thanks again for checking the logs.

TimW · Oct 14, 2008

You are most welcome......see if this answers your questions:
Internet Security

brunobru · Oct 14, 2008

Hi Tim! I was able to get the cleanup done and it said it was successful, so thanks again for your help...I really appreciate it!

TimW · Oct 15, 2008

You are quite welcome.......

Log in or Sign up

Infected? Homepage hijack

brunobru Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 10-13-2008 - 00-21-20.log

mbam-log-2008-10-13 (01-03-11).txt

ComboFix.txt

brunobru Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

brunobru Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

brunobru Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member