Avast WEBforum
Other => Viruses and worms => Topic started by: Tentimes on June 06, 2012, 03:05:48 PM
-
Hi
I appear to be infected by some browser virus that redirects me to the above site (havent actually clicked on anything on that site).
I tried running avast full scan, but it came up clean.
Anyone here got experience with this thing? I did find some information searching on google, but all sollutions require downloading too(s that I am not too sure I should be trusting.
Any help is appreciated.
Cheers in advance.
Thomas
-
Please read this thread http://forum.avast.com/index.php?topic=53253.0
All tools and links are safe, If you could attach the OTL logs to this post I will look at them
-
Malwarebytes Anti-Malware (Prøveversion) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.06.06.04
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
TH :: XXX [administrator]
Beskyttelse: Slået til
06-06-2012 15:39:50
mbam-log-2012-06-06 (15-39-50).txt
Skanningstype: Hurtig skanning
Skanningsmuligheder valgt: Hukommelse | Opstart | Registreringsdatabasen | Filsystem | Heuristics/Ekstra | Heuristics/Shuriken | PUP | PUM
Skanningsmuligheder som er deaktiverede: P2P
Objekter skannet: 208873
Tid gået: 6 minut(ter), 1 sekund(er)
Hukommelses Processorer Inficeret: 0
(Ingen skadelige objekter blev fundet)
Hukommelses Moduler Inficeret: 0
(Ingen skadelige objekter blev fundet)
Registreringsdatabasenøgler Inficeret: 0
(Ingen skadelige objekter blev fundet)
Registreringsdatabaseværdier Inficeret: 0
(Ingen skadelige objekter blev fundet)
Registreringsdatabasedata Objekter Inficeret: 0
(Ingen skadelige objekter blev fundet)
Inficerede Mapper: 0
(Ingen skadelige objekter blev fundet)
Inficerede Filer: 0
(Ingen skadelige objekter blev fundet)
(færdig)
------------------------------
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-06 16:06:48
-----------------------------
16:06:48.859 OS Version: Windows 5.1.2600 Service Pack 3
16:06:48.859 Number of processors: 2 586 0x2302
16:06:48.859 ComputerName: XXX UserName: TH
16:06:50.140 Initialize success
16:06:51.234 AVAST engine defs: 12060601
16:07:55.000 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvgts2Port1Path0Target0Lun0
16:07:55.000 Disk 0 Vendor: ST325082 3.03 Size: 238475MB BusType: 3
16:07:55.015 Disk 0 MBR read successfully
16:07:55.015 Disk 0 MBR scan
16:07:55.062 Disk 0 Windows XP default MBR code
16:07:55.062 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 114996 MB offset 63
16:07:55.078 Disk 0 Partition - 00 0F Extended LBA 123468 MB offset 235512900
16:07:55.093 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 123468 MB offset 235512963
16:07:55.093 Disk 0 scanning sectors +488376000
16:07:55.187 Disk 0 scanning C:\WINDOWS\system32\drivers
16:08:05.500 Service scanning
16:08:17.109 Modules scanning
16:08:23.562 Disk 0 trace - called modules:
16:08:23.578 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvgts.sys
16:08:23.578 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ac06a70]
16:08:23.578 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\00000069[0x8acbe870]
16:08:23.578 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\Scsi\nvgts2Port1Path0Target0Lun0[0x8acbe988]
16:08:24.328 AVAST engine scan C:\WINDOWS
16:08:31.578 AVAST engine scan C:\WINDOWS\system32
16:10:22.609 AVAST engine scan C:\WINDOWS\system32\drivers
16:10:35.875 AVAST engine scan C:\Documents and Settings\TH
16:25:19.500 AVAST engine scan C:\Documents and Settings\All Users
16:26:13.328 Scan finished successfully
16:27:40.968 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\TH\Skrivebord\MBR.dat"
16:27:40.984 The log file has been saved successfully to "C:\Documents and Settings\TH\Skrivebord\aswMBR.txt"
-------------------------
Thank you for helping! ;)
I hope I didnt miss anything I had to do.
As far as I could see nothing was found.
It had installed a "toolbar" in my browser, which I removed as you would normally through "remove a program", but it still constantly changes my startpage to searchya etc.
I did a file search for searchya and it comes up with a "searchyasrv.exe-051d8966.pf in C:windows\prefetch "PF" file as well as a file called "user" in C:\ which is a "jscript scipt" file.
-
Let me know if this kills it
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL
(http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg)
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
DRV - [2012-04-16 20:36:01 | 000,006,656 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\TH\Lokale indstillinger\Temp\49c58316-2f78-4d21-a2d1-23bf43705d03 -- (speccy)
IE - HKU\S-1-5-21-1454471165-854245398-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchya.com/?chnl=dcom-100&s=0&cr=686058353&cd=2XzutAtN2Y1L1QzutN0D0TzutBtDtCtBtDyCtDyC
IE - HKU\S-1-5-21-1454471165-854245398-725345543-1003\..\SearchScopes,DefaultScope = {D1001AAA-863D-4852-80C3-CBA12E7939B5}
IE - HKU\S-1-5-21-1454471165-854245398-725345543-1003\..\SearchScopes\{D1001AAA-863D-4852-80C3-CBA12E7939B5}: "URL" = http://searchya.com/?chnl=dcom-100&s=1&cr=686058353&cd=2XzutAtN2Y1L1QzutN0D0TzutBtDtCtBtDyCtDyC&q={searchTerms}
[2012-06-06 12:33:16 | 000,000,000 | ---D | M] (searchya.com) -- C:\Documents and Settings\TH\Application Data\Mozilla\Firefox\Profiles\jtshiogb.default\extensions\ffxtlbr@searchya.com
[2012-06-06 09:20:42 | 000,001,464 | ---- | M] () -- C:\Documents and Settings\TH\Application Data\Mozilla\Firefox\Profiles\jtshiogb.default\searchplugins\searchya.xml
[2012-06-06 09:20:49 | 000,000,058 | ---- | M] () -- C:\user.js
:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
(not sure if you want this OTL quick scan to be with the custom scan lines as well, this scan is without that)
Not sure that it is gone - it doesnt reset my startpage anymore though, but searching for it I still find that searchyasrv.exe- etc file (as well as a bunch of new files in the _otl\movedfiles folder.
Once again: Thank you for your time! :)
-
The OTL moved files are a quarantine
I cannot see the searchyasrv file on my logs, are you able to manually delete it ?
-
Yes - it could be deleted just fine it seems.
Tried rebooting and it hasnt re-appeared, just the quarantined files.
It also gave a hit in the most recent OTL log @ this line: "FF - prefs.js..browser.search.selectedEngine: "SearchYa!", but not sure if that means anything, ther than firefox somehow still has it set as prefered search engine?
-
You will need to reset that within firefox I do not use FF myself but I believe it is within the tools section
-
Yea it is, found a fix for it.
Ran another OTL scan and it is changed.
Heres to hoping it is all gone 8)
Thank you very much for your help - very awesome indeed! :)
-
No problem - Is the computer running normally ?
-
Yes as far as I can tell.
The only real noticeable thing I experienced before though was the constant changing my startingpage/searchengine to that site in both chrome and FF.
Did get a bit scared when googling it though, as it hinted at keyloggers etc.
-
If all is OK tomorrow let me know and I will remove my tools
-
Still seems fine 8)
-
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL- Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands
[resethosts]
[emptytemp]
[CLEARALLRESTOREPOINTS]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab.
- Under the Hidden files and folders heading select Do not show hidden files and folders.
- Click Yes to confirm.
- Click OK.
(http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif) Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
Upgrading Java:- Go to this site (http://java.com/en/) and click Do I have Java
- It will check your current version and then offer to update to the latest version
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif) Malwarebytes (http://www.malwarebytes.org/mbam-download.php).
Update and run weekly to keep your system clean
Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit - Microsoft Windows Update (http://windowsupdate.microsoft.com)
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)Keep safe :wave:
-
Done.
Cheers mate - as I've said earlier awesome help indeed! :)
-
;D