Malware pain

I'm new to this stuff, and reasonably sure I'm in over my head, but thought I'd have a go at fixing what seems like a browser hijacker problem. I have to say, there is a lot of helpful information here. Thanks a lot.

Quick details that my not matter
Dell inspiron 9300, IE webbrowser, McAfee security (though I'm not sure I've been running antivirus protection (hence the problem)).

Problems:
My browser is slow with incessant pop-ups and my mouse seems "sticky", a left click seems to function to highlight text for example and not redirect cursor. I have seen pop-up adds for winantiviruspro...

I've made it through the "read me first" instructions. I was able to run bitdefender and panda in safe mode

CCleaner ran without problems
SpyBot found Fake WGA (removed) and Win32.Keylogger which it could not fix

Other logs below. Thanks for the help.

 

Additional logs

 

Thanks for the reply Tim. I'll get to work.

I did rename HJT, though I simply renamed the .exe file by right clicking and typing in analyse.exe. Perhaps this is not sufficient. I'll double check that step.

Thad

 

I see the error of my ways on the rename instruction, Tim. I renamed the ziped file I downloaded, not the application. Stupid. Sorry if that caused delay. I got it right this time!

Here's what happened:
1. I re-ran HJT and closed all windows including borwsers and disable my wireless connection. I selected the the 4 quotes you mentioned, hit fix and got a message that said

"An unexpected error has occured at procedure: ModBackup_MakeBackup/sItem:020-AppInit_DLLs:C:\windows\system32\perfc000.dat" Error 5". It then asked that I email merijn@spywareinfo.com with details on what I was trying to fix and asked to send a copy of the log.

It seemed that the "fix" continued in some way from there though as there was a second message that flashed quickly before it went back to the initial screen. I couldn't catch the message.

2. I uninstalled the Java runtime environment packages and the viewpoint media player without problem

3. The viewpoint files were not present when I explored the drive

4. I ran combofix twice-the first run resulted in restart, during which a typical windows error message came up saying windowns encountered an error and needed to close, but it didn't, and a log was produced. The second run did not result in restart, but that same error message came up.

Here are the logs

Thanks again

 

ComboFix logs. The quarantined files log was from the first run.

 

Tim,

1. I saved the quote you provided as a .reg file on the desktop and merged it with the registry without apparent problem
2. I ran HJT and fixed the 2 lines you directed (all windows closed, IE connection off)
3. I downloaded avenger and followed instructions to manually fix the quote you provided. Reboot was prompted without issue.
4. I ran HJT again, runkeys again.

Overall it seems that my machine is smoother (dare I say faster) but I was still getting pop-ups as I read your reply with these instruction. No word yet on whether todays steps solved it.

Thanks again.

Logs below.

 

I created the second .reg file and merged it with the regsitry without issue.

I ran HJT and did not find the 3 lines you mentioned to fix. Log attached.

Should I proceed with the next step with avenger?

I should add that I found a "new problem" which is that any google search results in a set of results which is phony. My wife recalls seeing this happen before I began working though these fixes with you. Don't know if that helps.

 

I ran avenger again and deleted the quote you provided.

I deleted the google toolbar files I could find, though when I ran HJT this last time there is still a line that shows 02 BHO googletoolbar. Should I use HJT to delete that? Also, not sure what other add-ons I should be looking for in IE

Here are the new logs.
Thanks

 

Tim,

Thanks for all your help so far. Most of the problems have resolved--no more pop-ups (!), much smoother/faster mouse.

Three issues now remain (or arose from the removal process).

1. I can open all of my usual favorites pages except Google--the browser searches "waiting for a reply" without ever connecting. Every other page that I have tried comes up.

2. When trying to open a page that is secure -- e-mail (hotmail and yahoo) and my bank, for example-- a screen appears stating that the security certificate cannot be verified. There is an option to open anyway though there is a warning about connecting through. I am able to connect, but wonder about the security.

3. There are separate accounts on my computer--my wife, kids, me. I had done all work as "adminstrator" so I figured it would apply to all accounts. True? I'm fearing not, since when my wife opened IE tonight a googletoolbar prompt appeared. I ran HJT in her account and found a line for Google toolbar (hkcu) and one URLsearchhook (R3), both of which I deleted (hope that was okay) and neither of which I recalled seeing in my scans. Our HJT logs now look nearly identical. Is any further scanning needed through her or kids accounts?

I attached her HJT log for good measure

Much appreciated

 

Hi Tim,
Sorry for the later replies-only able to get to this after work hours.

I opened each account and ran HJT scans on each. My wife's appears as it did last night. Both my son and daughter had the same URL searchhook that I described in my wife's account from yesterday. I deleted each. I have posted my daughter's log here. My son's would not come up as a text file. Please let me know if I should run additional scans (counterspy, bitdefender, panda) on these accounts.

Each account still has the same google problem. Today I was able to access google (last night my browser wouldn't connect to it) but the search results are bogus. I inactivated the add-ons that appeared suspicious as you had mentioned.

Also, I read up about security certificates, but still don't understand why these warning messages keep popping up when there was no issue before. These sites can't all have expired certificates. I was, in fact, able to verify with my employer that the company site which is secure has an updated SSL certificate but my machine still won't recongize it, and in fact prevents me from connecting (via Citrix account). Any ideas there?

These are the only problems remaining. There are no further pop-ups and I think my machine is running at expected speed.

We have made great progress and I continue to appreciate your guidance!

 

Sorry, I did run ATF without problem and the logfile from HJT from my daughter's account was after this scan.

 

Tim, sorry for the delay, taking me some time to get through the scans again.

I scanned my wife's account using the basic steps. Spybot found and seemed to remove something from Smitfraud and Counterspy found and removed a keylogger.

Here are the logs from others.

Thad

 

I'm trying to upload additional scans from my wife's account, but I get an error message. I am not trying to upload more than 3. Is there a total limit or something?
Thad

 

Tim,

I located and deleted the 2 files in my wife's account you mentioned, then merged the quote into the registry.

I re-ran HJT and runkeys. I am also attaching her bdscan logfile from yesterday which I was not able to upload for some reason.

I have named all of her account scans with a "J" after the scan type and will number them.

The other accounts will be have an "m" or an "n" after them for my kids.

Quite a process! Thanks again.

 

HJT was not able to fix the checked problems. It says it did but they still are there on the re-run. Here is the log.

I am working through the steps for the other accounts and should have those logs this afternoon.

 

I have no active spyware blocker. I immunized with Spybot. I am not running teatimer--in any account.

I did remove all toolbars, and reviewed the add-ons in her account as well. I re-ran HJT and tried again to remove them to no avail.

 

Here are the scans for my daughter's account.

Spybot found the same Smitfraud C toolbar
Bitdefender found no threats so no logfile was created.

 

more logs from my daughter's account

 

Here are the logs from my daughter's account
(labeled with an "N" and a number for each).

Any ideas about the SSL certificate problem specifically? Would this issue be different with a different browser?

Thanks

 

more logs

 

Merged the quote to the registry from her desktop.
Ran avenger. It appears one file could not be delete.

Here are the logs

 

one more...

 

I deleted the file with avenger. Log attached.

Performace is very good, no pop-ups, but the Google/Yahoo search engine hijack problem persists. All search results are bogus. I am still having the problem with the SSL certificate verification as well.

My plan tonight is to upload Firefox and see if the problem exists in a different browser.

Any other ideas?

Much thanks.

 

I downloaded Firefox. As I was setting up, I got an erro message that said it could not verify the SSL certificate since it would not be active until 12/14/2005. That seemed a bit strange so I checked my computer clock. Sure enough, it had been reset to June 14 2003. I figure this means it couldn't verify an active certificate as of that time. I synched the clock with some government site and the SSL problem with all the secure sites--bank, email-- is now resolved!

The only remaining problem is with this search engine hijacker. Using Firefox browser I still get bogus search results with Google.

That is the only lingering problem.

We're very close!

 

Ok. I ran the rootkit scan program and it came up empty.

Here is the log.

 

Interesting. I can't delete the google toolbar.

In add/remove programs I see "google toolbar for internet explorer" program, I click "remove" and nothing happens.

I searched my C drive for any mention of google. I figure I don't need any file that says "google" to use the search engine. I found something called "google service update.exe." I recall seeing that on the logs from HJT. I deleted it.

I ran CCleaner again.

None of these steps made a difference in the google search results. I get the same bogus results if I search at yahoo. I get correct results at alltheweb and ask.com

Weird.

Next steps?

 

I tried to remove the google toolbar with CCleaner. Again, it is listed as a program, but when I click to uninstall, nothing happens.

I ran HJT logs from my account (labeled with a "T1") in normal mode, then as the administrator (labeled with an "A1") in safe mode off the network, and then get run and show new in safe mode as well.

Here they are.

 

Last log.

 

Sorry, sloppy post. Here are the final 2 show new and get run logs from the admin account in normal mode (labeled T1)

 

Tim,

I am unable to access either web site you put forth to download the FixWareout program. Both Firefox and IE say that the page can't be displayed. I rebooted in safe mode with networking option activated and still can't access either page. I can access all the other websites, though google and yahoo searches are still weird.

In another strange turn of events, my wife told me today that she got an error message while using Firefox that said

"You are connected to a website that is pretending to be Google.com."

This occurred while she was at a different webpage (in fact she hadn't used google all day). This makes me think there is something still running in the background.

The error message suggested that she verify the webpage's security certificate. When she clicked to do so she got a second message stating that the SSL certificate for Google had expired as of June 9, 2007 (which I refuse to believe is true). That must mean that the error function arose due to something in the background since checking the security certificate at the page she was viewing should have taken her to the certificate for a sporting goods store.

The error message went on to say that she should verify that the computer clock was right (that was the problem I finally diagnosed when I had been having so many problems). I have re-checked to be sure that the date/time are still correct (it is).

She noted that in the browser address bar it read "googleadservices.com" I recalled seeing a line in my HJT log about a "googleupdaterservice" so I ran HJT again and tried to fix that line. It seemed to run through, but when I re-ran HJT the logfile shows it was not erased.

I'm hoping to be able to download the FixWareout program from work tomorrow and upload to my desktop via CD. Until then, I have no way of completing the steps you recommended. Sorry.

 

Tim,

I was able to dl using my computer at work, sending as attachment to home where I should be able to get it on my desktop.

It seems as if the malware "knows" that we're trying to wipe it out and is blocking use of the sites where help could be obtained!

I'll post the logs from FixWaremal tonight

 

I was able to get Fixwareout and run it as instructed.

I just checked google and it worked on my account and my wife's account! I'm cautiously optimistic.

Here is the log.