Avast WEBforum
Other => Viruses and worms => Topic started by: JPF810 on June 02, 2012, 10:45:29 PM
-
I am having a search bar redirect problem similar to this:
http://forum.avast.com/index.php?topic=81308.msg664582#msg664582
-Redirecting to scour.com like this user was.
-Avast found nothing
-Malwarebytes found nothing
-ran TDSS Killer once, found nothing (and have since removed the program)
-Backed up reg with ERUNT
-Also ran OTL and aswMBR as per "logs to assist cleaning malware" :
http://forum.avast.com/index.php?topic=53253.0
Any help would be GREATLY appreciated...Looks like the genius that goes by ESSEXBOY was able to rout out the problem successfully before by pasting text, but specifically stated, "Warning This fix is only relevant for this system and no other, using on another computer may cause problems." and I will strictly obey that level of computer prowess in fixing this.
Like the previous poster so aptly put, "Mainly, I am just sort of worn down from fighting this dumb thing."
Thanks again in advance, and I will post logs (let me know if I missed something...hope I went about this right...should I post the MBR.dat file?).
-
Hi,
Don't worry about the MBR.dat file...but don't delete it either.
Let me look over the logs and I will return shortly. :)
-
Thanks for the post and the quick reply! Take your time...I appreciate the help!
-
Hi,
I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis
To submit a file to virustotal, please click VirusTotal (https://www.virustotal.com/)
Press Choose File and then browse to the following file: (one at a time if more than one file is listed)
C:\Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll
Once you locate the file select it and press Open now press Scan it!.
Now Copy/Paste the link to the results showing in the web browser bar to your next reply so that I can take a look at the results.
Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.
----------
-
here you go.
https://www.virustotal.com/file/a9080aa18f213e7b67ee3648963eebf4a2af4586045b43ef0cca03828f0eeca2/analysis/
-
I know that you already ran TDSSKiller but please do the following...
Please download TDSSKiller.zip (http://support.kaspersky.com/downloads/utils/tdsskiller.zip)
- Extract it to your desktop
- Double click TDSSKiller.exe
- when the window opens, click on Change Parameters
- under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
- click OK
- Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
- Then click Continue > Reboot now
- Attach the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)
----------
-
Posting TDSS Killer log.
-
Hi,
I see that you have ERUNT already. Please run that and make a backup and then do the following...
Run OTL.exe
- Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:Services
:OTL
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2A DB 11 B7 1A 18 CD 01 [binary data]
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot when it is done
- Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
-
New OTL log
-
Funny, I think that did it searches uninturrupted now...
-
Thank you!! You are super Awesome. Everything seems to work great now. I truly appreciate all the help...Can't thank you enough!
-
Glad that it is working better. Stick with me though. :)
Malwarebytes
I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
----------
Please run a free online scan with the ESET Online Scanner (http://www.eset.com/onlinescan/)
Note: You will need to use Internet Explorer for this scan[/i]- Tick the box next to YES, I accept the Terms of Use
- Click Start
- When asked, allow the ActiveX control to install
- Click Start
- Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
- Click Scan (This scan can take several hours, so please be patient)
- Once the scan is completed, you may close the window
- Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
- Copy and paste that log as a reply to this topic
----------
Attach the logs that are made by Malwarebytes and ESET. :)
-
I'm still with you. Eset got a hit
C:\_OTL\MovedFiles\06022012_173328\C_Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll a variant of Win32/Kryptik.AGFG trojan
moved it to notepad
Eset log doesn't look like there is anything in it...did I do something wrong there?
Anyway here are the logs
-
Hi,
The file that ESET picked up is already quarantined by OTL so that is not a problem.
How is your system running now?
-
I haven't had one redirect or popup redirect. It seems to be running flawlessly. On startup I get a notification of that file (Microsoft Help\xstlvmxf.dll)
being "undetected" or "missing". But closing a window on startup is a small price to pay for being able to run an internet search again.
Again, many thanks!
-
Hi,
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1 (http://jpshortstuff.247fixes.com/SystemLook.exe)
Download Mirror #2 (http://images.malwareremoval.com/jpshortstuff/SystemLook.exe)
- Double-click SystemLook.exe to run it.
- Copy the content of the following codebox into the main textfield:
:filefind
*xstlvmxf.dll
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
-
Here's the log
-
Let's see if we can get file fixed up.
Do you have your Windows disk available if we need it? :)
-
I believe so.
-
Get it out as we may need this during the following steps:
- Click on Start, type cmd in the Start Search bar.
- Right click on Command Prompt at the top of the window and select Run as Administrator.
- In the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.
The scan may take some time, so be patient. Windows will repair any corrupted or missing files that it finds. If information from the installation CD is needed to repair the problem, you may be prompted to insert your Windows 7 CD.
Reboot your system when done and see if that notification pops up again. :)
-
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
-
Rebooting be right back.
-
Still pops up. Window says:
Run Dll (on title of window)
There was a problem starting C:\users\Filip\AppData\Local\Temp\MicrosoftHelp\xstlvmxf.dll
The specified module could not be found (in window)
-
Ok...lets get some updates.
Please download JavaRa (http://raproducts.org/click/click.php?id=1) to your desktop and unzip it to its own
folder- Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
click Remove Older Versions.
- Accept any prompts.
- Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
- Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
Java Runtime Environment (JRE) version for your computer.
----------
Let me know if you have any problems with the instructions above and I will be looking for a solution for the popup you are getting. :)
-
Did everything you said, your instructions were good. Installed new Java runtime environment.
-
Jeff - check this out: http://www.prevx.com/filenames/X45623044934701293-X1/XSTLVMXF.DLL.html (http://www.prevx.com/filenames/X45623044934701293-X1/XSTLVMXF.DLL.html)
I suspect there is an entry for this in startup reg key still exists and that is why OP is getting the missing message at boot time?
-
@ DonZ63 >> Thanks for that. I have been on the ledge with that entry. It's going to go. :)
Hi,
Run a new backup with ERUNT and then do the following...
Run OTL.exe
- Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:Services
:OTL
O4 - HKU\.DEFAULT..\Run: [Microsoft Help] C:\Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [Microsoft Help] C:\Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [Microsoft Help] C:\Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1370244251-421495555-1663435379-1000..\Run: [Microsoft Help] C:\Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll (Microsoft Corporation)
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot when it is done
- Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
In your next reply let me know how your system is running and if there is the popup any longer. Also attach the new OTL log that is made. :)
-
Perfection.
You, good sir, are a genius.
That run Dll error is gone and everything seems to be running smoothly.
Thank you so much for guiding me through all this.
Posting OTL log now. Again, all my thanks!!
-
Hi,
Providing there are no other malware related problems...
IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :D SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :D
This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
----------
Clean up with OTL:
- Right-click and Run as Administrator OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
----------
Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.
Here are some tips to reduce the potential for spyware infection in the future:
1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:- Open Internet Explorer
- Click on Tools > Internet Options
- Press Security tab
- Select Internet zone then place check next to Enable Protected Mode if not already done
- Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
- Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.
3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.
4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here[/color] (http://www.bleepingcomputer.com/forums/tutorial60.html). **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free (http://download.cnet.com/Online-Armor-Free/3000-10435_4-10426782.html)
Agnitum Outpost Firewall Free (http://download.cnet.com/Agnitum-Outpost-Firewall-Free/3000-10435_4-10913746.html)
5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update (http://v4.windowsupdate.microsoft.com/en/default.asp) regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.
6. WOT (http://www.mywot.com/) (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.
7.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place? (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.
-
I am more than satisfied with everything you've done for me here, I truly thank you for everything.
You may mark the problem as resolved. SUPER JOB!!! No other way to say it...YOU ARE AWESOME.
Thanks again!!
-
You are more than welcome. I am glad that I could help. :)
-
Since this issue appears to be resolved ... I will discontinue monitoring. Glad we could be of assistance.
----------