Eliminate Registry Defender and others

[rb-arch]

1.  My laptop has become infested with a persistent nagging ad to buy REGISTRY DEFENDER, because it has found over a hundred dangerous threats.  There is no way to respond other than to give in and buy the software or use the Task Manager to cancel Internet Explorer totally, including anything else running.
2.  I also have repeating ads for "Channelreports.com", "Redeemourprize.com" and other similar web pages styled ads.  As with REGISTRY DEFENDER, the user has limited options to remove the ad and even if successful, it is promptly replaced by another and another...  These "web pages" appear when a desirable site is called, but redirected by the malicious virus.
3.  I have run Avast!, SuperAntiSpyware, Ad-Aware, Registry Mechanic, Malwarebytes Anti-Malware, and Microsoft Security Essentials (or similar name), and I still have the problem.  I have run all of the above in normal Windows XP Pro mode, as well as Safe Mode. The only browser installed is Internet Explorer 8.
4.  I installed Online-Armor Firewall, although after I discovered the problem.

Attached Files:
OTL.txt
Extras.txt

[Pondus]

I have run Avast!, SuperAntiSpyware, Ad-Aware, Registry Mechanic, Malwarebytes Anti-Malware, and Microsoft Security Essentials (or similar name), and I still have the problem.

Is your Malwarebytes program updated ? 

Registry Defender Platinum Removal Guide
http://www.bleepingcomputer.com/virus-removal/registry-defender-removal


Essexboy is notified and will check your log`s when he arrives

[essexboy]

Hi this one will neeed the big boy - did you turn off system restore ?  If so please turn it back on

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• Double click on ComboFix.exe & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.

[rb-arch]

Thanks for the quick response!

1.  Downloaded COMBOFIX.
2.  Disabled anti-virus software that I could.
3.  Ran COMBOFIX software.
4.  Notified there was a Rookit:  TDL3
5.  Because of this, COMBOFIX required a reboot.
6.  Upon rebooting, the disabled firewall enabled itself and blocked COMBOFIX.
7.  Second try.  Disabled firewall for 1 hour.  Repeated above steps 2, 3, 4 and 5.
8.  Third try.  Uninstalled anti-virus and others. Permanently disabled firewall.
9.  Repeated above steps 3, 4, 5.  Rebooted and COMBOFIX completed scan.
10. COMBOFIX.txt log attached.  Sweating bullets!

[rb-arch]

Pondus:

To answer your question, "Yes", I ran all of the mentioned software with the latest version of the software and updated virus definitions.

I am aware and appreciative of the link you included in your post.  I visited the site and looked at the instructions.  However, I felt I should not get involved in this until you guys had a chance to look at the COMBOFIX.txt log I just sent.  I'll wait for your instructions.

For what it's worth, I am logged in and writing this on my desktop computer which is different from my sick laptop.  I say that just in case there might be some computer identification in the logs that doesn't match with the sick computer.

Thanks for your help! 

[essexboy]

Combofix does not appear to have been able to cure the TDL3 - so I will use another tool for that - but first lets clear the renv/vundo

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code: [Select]

MBR::

Renv::
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon .exe
c:\program files\Common Files\InstallShield\UpdateService\issch .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\CyberLink\PowerDVD\DVDLauncher .exe
c:\program files\Google\Google Desktop Search\GoogleDesktop .exe
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
c:\program files\HP\HP Software Update\HPWuSchd2 .exe
c:\program files\Intel\Wireless\Bin\ifrmewrk .exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc .exe
c:\windows\system32\ICO .exe

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below.  This will start ComboFix again.




6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt .

.
THEN

Please read carefully and follow these steps. 

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
   
   
  
   
   
  
• If an infected file is detected, the default action will be Cure, click on Continue.
   
   
  
   
   
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
   
   
  
   
   
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
   
   
  
   
   
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

[rb-arch]

Again, thanks for your quick reply!

1.  Disabled Avast! antivirous and Online-Armor Firewall
2.  Dragged CFScript.txt onto COMBOFIX icon, starting COMBOFIX
3.  Found Rookit:  TDL3, required rebooting.
4.  Although temporarily disabled, anti-virus was enabled by reboot, stopped COMBOFIX
5.  Terminated anti-virus and firewall
6.  Repeated steps: 2, 3.
7.  Successful COMBOFIX run, created log file
8.  Downloaded, installed and ran TDSSKiller
9.  Scanned, found 1 RooKit, selected "cured" option
10. Rebooted
11. Logs attached: COMBOFIX.txt, TDSSKiller.2.4.13.0_13.01.2011_17...

[rb-arch]

Essexboy:

After executing your last instructions, I have been using the laptop for the past 30 minutes or so and have not encountered any of the problems previously experienced.  I am keeping my fingers crossed!  I hope this coincides with your findings in the logs.

Thanks for your help!

[essexboy]

That looks good now, any further problems before I remove my tools ?

[rb-arch]

Again, thanks for the quick reply!

I have been using the laptop for most of the day without any evidence of any of the previous problems.  When infested, the rogue web pages would appear within the first ten minutes of booting up and continue appearing every 5-10 minutes afterward, sometimes one right after another.

I suppose the only remaining questions I have concerns the software installed to combat the problem.  Maybe your comment, "...before I remove my tools" will answer this.

Thanks again!

[essexboy]

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

.
Click Start > Run  and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself.  MBAM can be uninstalled via control panel add/remove.  But it may be a useful tool to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

SPRING CLEAN
 
Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check




Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
 
Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update
  

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?
Keep safe  :wave:

[rb-arch]

Gentlemen:

During the last 24 to 48 hours I have used the laptop as I normally do without any evidence of the problem I was experiencing.  Thanks to your expert help!  I have just completed the tools "clean-up" procedure you described in your last email, without a glitch.  It seems to me the boot-up time is quicker than it formerly was.  I am enjoying my "new" computer.  The only thing remaining is to re-install Malwarebytes anti-virus software, as well as Filehippo Update Checker.

I do have one question.  Maybe I am not remembering correctly, but does a black and white (DOS?) screen always appear upon start-up?  It is titled: "Please select the operating system to start..." or something similar.  It flashes right after the "Dell" startup screen for about 1-2 seconds and certainly not enough time to make a selection.  The screen then closes and XP loads in the normal manner.  I can't remember if that screen has always been in the startup routine, or was changed to run as part of the anti-virus software I ran.  I can't reboot my desktop computer (to see if the screen is the default on that machine too), since I am writing this post on that computer.  I will reboot after I send this post.

Thanks again!  Great job!