Advertisement
Advertisement
 Search | |
| |
26-Feb-2011, 01:53 PM
#1 | ||||||
| Search Timeout in every browser on google msn and yahoo I am posting this here because I believe it it is malware related. It is the boyfriends computer, Windows Vista, primary browser is Firefox. He did get hijacked. We ran Malwarebytes and fixed some issues. For quite some time now he has not been able to log into his gmail. He was getting a page time out error. Beginning yesterday he is getting that error if he tries to go to google at all or search using yahoo or msn. I am typing this on his computer. Most pages if you know the url and type it in the address bar you can go without issue. I tried turning off all firewalls and increasing time out rates in the registry. Ping www.google.com gives me 100% loss. I do not know enough about the registry to determine what is causing the problem. *** Results from hijackthis *** Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 12:33:32 PM, on 2/26/2011 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18565) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\mobsync.exe C:\Users\Dagoth\Desktop\HijackThis.exe C:\Windows\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\plugin-container.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:25426 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51- 7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F- 0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user') O15 - Trusted Zone: http://www.gmail.com O17 - HKLM\System\CCS\Services\Tcpip\..\{1C1301AE-F989-4B0D-9520- 58BC11746ABD}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS2\Services\Tcpip\..\{1C1301AE-F989-4B0D-9520- 58BC11746ABD}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS3\Services\Tcpip\..\{1C1301AE-F989-4B0D-9520- 58BC11746ABD}: NameServer = 8.8.8.8,8.8.4.4 O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O20 - AppInit_DLLs: c:\progra~1\google\google~2\goec62~1.dll O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32 \browseui.dll -- End of file - 3206 bytes **** results from dds.txt file *** attach.txt in post attachments **** DDS (Ver_10-12-12.02) - NTFSx86 Run by Dagoth at 12:38:48.01 on Sat 02/26/2011 Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_21 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3069.1963 [GMT -5:00] SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\alg.exe C:\Windows\System32\mobsync.exe C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\notepad.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\vssvc.exe C:\Windows\System32\svchost.exe -k swprv C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Dagoth\Downloads\dds.scr ============== Pseudo HJT Report =============== uWindow Title = Internet Explorer provided by Dell uStart Page = hxxp://www.yahoo.com/ uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4080924 mStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4080924 mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4080924 uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = http=127.0.0.1:25426 BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll uPolicies-explorer: DisallowRun = 1 (0x1) mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) Trusted Zone: gmail.com\www TCP: {1C1301AE-F989-4B0D-9520-58BC11746ABD} = 8.8.8.8,8.8.4.4 Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll AppInit_DLLs: c:\progra~1\google\google~2\goec62~1.dll IFEO: image file execution options - Hosts: 74.125.45.100 4-open-davinci.com Hosts: 74.125.45.100 securitysoftwarepayments.com Hosts: 74.125.45.100 privatesecuredpayments.com Hosts: 74.125.45.100 secure.privatesecuredpayments.com Hosts: 74.125.45.100 getantivirusplusnow.com Note: multiple HOSTS entries found. Please refer to Attach.txt ================= FIREFOX =================== FF - ProfilePath - c:\users\dagoth\appdata\roaming\mozilla\firefox\profiles\wtt5yz39.default\ FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 25426 FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\program files\common files\oberon media\ncadapter\1.0.0.7\npapicomadapter.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\users\dagoth\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dl l FF - plugin: c:\users\dagoth\appdata\local\yahoo!\browserplus\2.9.8\plugins\npybrowserpl us_2.9.8.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-7-27 64288] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-12-22 217032] R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt60.sys [2008-9-24 27648] S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2008-12-11 599040] S3 pmxmouse;PMXMOUSE;c:\windows\system32\drivers\pmxmouse.sys [2008-9-24 18432] S3 pmxusblf;PMXUSBLF;c:\windows\system32\drivers\pmxusblf.sys [2008-9-24 19008] S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2007-6-28 1310720] S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\zune\WMZuneComm.exe [2010-9-24 268528] S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\firebird\firebird_2_1\bin\fbguard.exe -s defaultinstance --> c:\program files\firebird\firebird_2_1\bin\fbguard.exe -s DefaultInstance [?] S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_2_1\bin\fbserver.exe -s defaultinstance --> c:\program files\firebird\firebird_2_1\bin\fbserver.exe -s DefaultInstance [?] S4 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-9-24 30192] =============== Created Last 30 ================ 2011-02-26 15:24:46 5943120 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{ebd9b482-7747-4aa2-9c18-4361123c1c65}\mpengine.dll 2011-02-19 20:39:22 -------- d-----w- c:\users\dagoth\appdata\local\Yahoo! 2011-02-18 19:36:26 -------- d-----w- c:\program files\Phoenix Viewer 2011-02-06 14:13:52 -------- d-----w- c:\program files\Bonjour 2011-02-06 14:05:00 -------- d-----w- c:\program files\common files\Macrovision Shared 2011-02-06 13:40:16 -------- d-----w- C:\AdobeTemp 2011-02-04 09:25:58 -------- d-----w- c:\users\dagoth\appdata\local\lptmp3898 ==================== Find3M ==================== 2011-02-02 22:11:20 222080 ------w- c:\windows\system32\MpSigStub.exe 2011-01-08 07:50:00 34304 ----a-w- c:\windows\system32\atmlib.dll 2011-01-08 05:57:10 292352 ----a-w- c:\windows\system32\atmfd.dll 2010-12-31 13:25:17 2038784 ----a-w- c:\windows\system32\win32k.sys 2010-12-28 14:57:35 409600 ----a-w- c:\windows\system32\odbc32.dll 2010-12-25 13:24:26 107888 ----a-w- c:\windows\system32\CmdLineExt.dll 2010-12-20 15:40:24 833024 ----a-w- c:\windows\system32\wininet.dll 2010-12-20 15:37:57 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-12-20 14:12:59 389632 ----a-w- c:\windows\system32\html.iec 2010-12-20 13:51:45 1383424 ----a-w- c:\windows\system32\mshtml.tlb 2010-12-14 15:49:30 1169408 ----a-w- c:\windows\system32\sdclt.exe 2010-11-29 22:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2010-11-29 22:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts ============= FINISH: 12:39:03.96 =============== **** ark.txt file **** GMER 1.0.15.15530 - http://www.gmer.net Rootkit scan 2011-02-26 13:32:04 Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3320620AS rev.3.ADJ Running: s70u33bd.exe; Driver: C:\Users\Dagoth\AppData\Local\Temp\fwryrpog.sys ---- Kernel code sections - GMER 1.0.15 ---- ? C:\Users\Dagoth\AppData\Local\Temp\mbr.sys The system cannot find the file specified. ! ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Mozilla Firefox\firefox.exe[1772] ntdll.dll! LdrLoadDll 772079B3 5 Bytes JMP 012313F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3624] USER32.dll!TrackPopupMenu 76051417 5 Bytes JMP 6A7F2342 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\MSIVXserv.sys@start 1 Reg HKLM\SYSTEM\ControlSet001\Services\MSIVXserv.sys@type 1 Reg HKLM\SYSTEM\ControlSet001 \Services\MSIVXserv.sys@imagepath \systemroot\system32 \drivers\MSIVXosiwuvsybyqdcbkrwipeyoffptdrwire.sys Reg HKLM\SYSTEM\ControlSet001 \Services\MSIVXserv.sys@group file system ---- EOF - GMER 1.0.15 ----  no idea what to look for in these. Any help is appreciated. Thank you! |
26-Feb-2011, 06:02 PM
#2 | |||||||
| Hiya spiritedblaize, We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: Combofix Don`t forget Combofix must be saved to your desktop, do not save to or run from anywhere else. <--Very important Before saving Combofix to the Desktop re-name to Gotcha.exe as below:  Ensure you have disabledyour Firewall and all anti virus and anti malware programs so they do not interfere with the running of ComboFix. <---Very important Please include the C:\ComboFix.txt in your next reply for further review. Examples of how to disable realtime protection available at the following link :- Disable realtime protection Note: Do not click combofix's window with your mouse while it's running. That action may cause it to stall. *EXTRA NOTES*
Post the log in your reply, Kevin |
26-Feb-2011, 08:58 PM
#3 | ||||||
| |
26-Feb-2011, 09:31 PM
#4 | |||||||
| Hiya spiritedblaize, Proceed as follows :- Step 1 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the Codebox below into it: Code:
KillAll::
DirLook::
c:\users\Dagoth\AppData\Local\lptmp3898
DDS::
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:25426
Firefox::
FF - ProfilePath - c:\users\Dagoth\AppData\Roaming\Mozilla\Firefox\Profiles\wtt5yz39.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 25426
RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000   Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Step 2 Please download OTM by OldTimer. Alternative Mirror Save it to your desktop. Double click OTM.exe to start the tool. Vista or Windows 7 users right click and select Run as Administrator
If the machine reboots, the Results log can be found here: c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log Where mmddyyyy_hhmmss is the date of the tool run. Step 3 Run ESET Online Scan
Frequently asked questions available Here Please read them before running the scan. Also be aware this scan can take between one and several hours to complete depending on the size of your system. What i`d like in your reply :-
Kevin |
27-Feb-2011, 07:09 AM
#5 | ||||||
| |
27-Feb-2011, 11:48 AM
#6 | |||||||
| Yep starting to look a lot better, continue as follows please :- Step 1 Double click OTM.exe to start the tool. Vista or Windows 7 users right click and select Run as Administrator
If the machine reboots, the Results log can be found here: c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log Where mmddyyyy_hhmmss is the date of the tool run. Step 2 Download Security Check by screen317 from HERE or HERE. Save it to your Desktop. Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked. A Notepad document should open automatically called checkup.txt; please post the contents of that document Post the two logs in your reply, also let me know if there are any remaining issues. Kevin |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
button.
button.
to download the ESET Smart Installer. Save it to your desktop.
icon on your desktop.
button.
, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
button.