Scanning weirdness?

bobdog · Aug 9, 2006

I had some weirdness running the scans, so I hope someone can please look over the logs.

I <edit>HAD a taskbar icon that blinks and alternated displaying as a "NO" symbol with a white question mark in a white circle on a blue background. Every so often a small popup appears "Your computer is infected! Critical system error! System detected virus activities..followed by a gloom-and-doom paragraph" A couple of icons were also placed on my desktop.

I ran Security Task Manager, and it showed a process cycling in sync with the icons so I killed it. I found something in my program list relating to the desktop icons, so I deleted it and removed the icons.

So far so good. I decided to go ahead and run through the procedure here and see what was left. As I was removing quarantine files, I think I hit restore instead of delete in security task manager. Anyway the taskbar icons (but not the desktop icons) reappeared.

I ran your old procedure over several days with no luck, and I couldnt run the online scans in safe mode, so I decided to try later. When I came back, the procedure had changed. I ran the new procedure up to the online scans in one night, the online scans the next in safe mode. One of the scans (I forget which, I think it was BitDefender) reported a Security Task Manager file as a problem. When I tried to delete STM in add/remove programs, it's own uninstaller came up. I cancelled the delete on the
assumption the uninstaller could bury things deeper and continued with the scans.

**** when I ran Pandascan, abt 70% of the way through it and IE were closed down. ****

The in-process screen said there were 12 spyware infections and a dialer. No viruses.
When I repeated the scan it only found three spyware infections. Still no viruses. None detected anyway.

I have no clue if this is related to STM. The Panda log is attached, along with the others. The blinkies are gone, but I noticed in writing this in wordpad that my right-click menu paste command didnt execute, but it was fine on reboot. FYI, an update ran on the shutdown to reboot.

Logs:

bobdog · Aug 8, 2006

Re: Scanning weirdness? more logs

Btw, all scans were performed in safe mode.

bobdog · Aug 9, 2006

All scans were run from C:\programs or other C:\folder. If you need other logs, please let me know.

chaslang · Aug 9, 2006

Welcome to Majorgeeks!

Is the below toolbar something you installed and use?
O3 - Toolbar: Groowe - {1F326B8F-CE7F-4C98-96A1-AC7A2B61D742} - C:\WINDOWS\system32\GrooweToolbar.dll
O3 - Toolbar: &Groowe 2 - {D52EE69D-ADC2-4AE7-BC19-4AEEC1890C76} - C:\PROGRA~1\Groowe\Toolbar2\GrooweToolbar2.dll

They appear in Add/Remove programs as:
Groowe Search Toolbar v2.0
Groowe Toolbar

At this point, I'm not saying they are malware. I'm just trying to find out if you installed them and what they really are.

You need to install the current version of FireFox from: Mozilla Firefox
You also need to get the new version from here: Sun Java Runtime Environment and install it.

Afterwards, go to Add/Remove Programs and uninstall the below old versions of Sun Java and FireFox:
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_09
Mozilla Firefox (1.5.0.4)

Now let's work on malware removal!

Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach that log in your next reply.

Note: process.exe ( which is used my SmitFraudFIx ) is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. The below is a link to what process.exe is.

http://www.beyondlogic.org/consulting/proc...processutil.htm

IMPORTANT: Do NOT run any other options until you are asked to do so!

bobdog · Aug 9, 2006

Thanks for replying, I'll get to running the tools after dinner.

Groowe is a toolbar/search gateway that lets you move beween many search engines more conveniently to take advantage of the different relevance algorithms they use. I havent updated it in a while, they may have added a metasearch to it too.

anyway, have a good whatever and I'll post my results later tonight

Bob

chaslang · Aug 9, 2006

Okay I'll be looking for the log !

bobdog · Aug 10, 2006

Ok, sorry it's so late, but here are the logs. I ran smitfraud fix in normal boot mode and it only took about two seconds, so I booted in safe mode same result.

Looks like it found something though, spyquake and a couple URL's?

Oh, should I delete that securitytaskmanager program I mentioned earlier? Through add/remove, and in normal or safe boot?

Thanks

Bob

bobdog · Aug 10, 2006

I almost forgot...

My MacAfee on-access scan was disabled on one of my recent reboots, I re-enabled it, but does that sound familiar to you? It has happened a couple times before.

Thanks again

Bob

chaslang · Aug 10, 2006

PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting.

Please print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. Again, if there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer into Safe Mode per the safe directions in the READ & RUN ME.

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach this log along in your next reply.

Now attach new logs from Hijackthis.

Also attach a new log from GetRunKey and also from ShowNew!

Also tell me how things are working.

bobdog · Aug 10, 2006

um, do you want HJT run in safemode or normal boot? I ran it in normal boot before.

thx

bob

chaslang · Aug 11, 2006

HJT logs are always to be from normal boot mode unless specifically requested otherwise.

bobdog · Aug 11, 2006

Re: Scanning weirdness? - new(est) logs

Here y'go

chaslang · Aug 12, 2006

Re: Scanning weirdness? - new(est) logs

You forgot to post the report from SmitFraudFix. Please attach it.

Goto Add/Remove Programs and uninstall the below:
Internet Security Add-On

Steps to delete a file in the Downloaded Program Files folder :
- Click Start, Run, and enter cmd in the box and click OK. This opens a command prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\Downloaded Program Files\
attrib -r -h -s gdnUS2218.exe
del gdnUS2218.exe
exit

Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8082
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKCU\..\Run: [b80ae7f9.exe] C:\Documents and Settings\Bob\Local Settings\Application Data\b80ae7f9.exe
O16 - DPF: {DE4735F3-7532-4895-93DC-911111111173} - http://afris.biz/ex.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Documents and Settings\Bob\Local Settings\Application Data\b80ae7f9.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.

Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

bobdog · Aug 13, 2006

Re: Scanning weirdness? - new(est) logs

chaslang said:

You forgot to post the report from SmitFraudFix. Please attach it.

oops, here you go.
Click to expand...

chaslang · Aug 13, 2006

Re: Scanning weirdness? - new(est) logs

Okay thanks! Now what about the rest of message # 13?

bobdog · Aug 13, 2006

Hey, I'm getting there!

Eh,>> Goto Add/Remove Programs and uninstall the below:
Internet Security Add-On

add/remove said the program had already been removed.

>>Boot into safe mode and use Windows Explorer to delete:
C:\Documents and Settings\Bob\Local Settings\Application Data\b80ae7f9.exe

no such file visible, and I checked my folder settings to be sure.

I have no clue where those went, but did the rest as directed. I'm going to delete that security task mgr program unless you think there's a good reason not to. I'll take suggestions on other startup settings to nuke on the basis of improving performance.

?? Display of my typing just started lagging behind my keyboard for a minute or two there, seems ok now.

Thanks,

Bob

bobdog · Aug 13, 2006

<bump>

chaslang · Aug 14, 2006

Are you having any other malware issues?

bobdog said:

I'm going to delete that security task mgr program unless you think there's a good reason not to. I'll take suggestions on other startup settings to nuke on the basis of improving performance.
Click to expand...

Unless you purchase STM, it will be of no use to you after the trial ends.

If you are serious about improving performance, the first thing to go would be McAfee. There are some unnecessary programs loading at startup too. Like:

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide <---- why do you need this to always run
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet <---- do you always need this!
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl <---- do you always need AIM to load at startup! Do you always want it running?
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart <---- is this really needed

And then your should install the programs mentioned in the below link. You should complete all of the below too if you are not having any othe malware problems:

Go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

chaslang · Aug 14, 2006

bobdog said:

<bump>
Click to expand...

By the way! This cost you 18 hours of wait time. You lost you place in the queue when you did this. Threads are answered from oldest to newest. Bumping makes your thread newer! Thus, you lost the 18 hrs of wait time you had already waited.

bobdog · Aug 14, 2006

Macafee is what the local Uni uses, and we got updates while we worked there. And it was free. I was told to avoid Norton because of some registry/uninstall issues. If there is a better alternative to Macafee and it's firewall, I'm all ears.

An STM file showed up in one of the scan logfiles as the scan was running.

I used to spend a lot of time on IM for both work and personal use, They were usually on anyway I suppose it's time to update settings.

Anyway, thanks for all the help Ive been recommending your site to pretty much everyone who understands what cut and paste means

*wanders off through the link*

chaslang · Aug 15, 2006

bobdog said:

Macafee is what the local Uni uses, and we got updates while we worked there. And it was free. I was told to avoid Norton because of some registry/uninstall issues. If there is a better alternative to Macafee and it's firewall, I'm all ears.
Click to expand...

Didn't you work thru the link at the end of message # 18???

Scanning weirdness?

bobdog Private E-2

Attached Files:

bobdog Private E-2

Attached Files:

bobdog Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

Attached Files:

bobdog Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

Attached Files:

bobdog Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bobdog Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member