Author Topic: Computer infected with malware (Read 7009 times)

swerang · « **on:** May 16, 2012, 06:55:14 AM »

Hi,
My system has been behaving weirdly in the last few days and seems to have been infected with malware. Whenever I open a webpage in my browser(firefox),
it is being redirected to a different page in the first attempt. When I try opening the page the second time, it mostly goes to the right page. The system crashes and reboots while
running flash videos from time to time. Also, when I open a thumbnail image in the internet, it opens a different image. I hear pings in my system as if some process is executing in the background. When I checked taskmgr, I found some unfamiliar exes running. I tried to kill them, but they kept reappearing.

As advised in your forum, I ran MalwareBytes Anti-Malware, OTL and aswMBR.

MalwareBytes helped clean up some errors(I have attached the logs of it that came up when I ran it the first time).

I am unable to run OTL. The system crashes with a blue screen every time I try to run it. So I skipped running it.

I ran aswMBR and saved the logs. I have attached it here.

Can you please look in the logs and suggest ways to clean up the malware in my system? It would be great if you could.

Looking forward to hearing from you.

Thanks,
Swetha

jeffce · « **Reply #1 on:** May 16, 2012, 01:38:46 PM »

Hi,

Are you able to run OTL in Safe Mode? If so do that and then attach the logs.

swerang · « **Reply #2 on:** May 16, 2012, 07:45:25 PM »

Hi jeffc,
I ran OTL in safe mode and I have attached logs of the same. Please look in to it and let me know.

Thanks

jeffce · « **Reply #3 on:** May 16, 2012, 08:18:49 PM »

I need to ask...is this a business/corporate computer?

swerang · « **Reply #4 on:** May 16, 2012, 08:31:25 PM »

This was a laptop that I purchased from my previous employer when I moved out of my company. It is my personal laptop now and is not a business/corporate laptop.

jeffce · « **Reply #5 on:** May 16, 2012, 09:35:53 PM »

Ok....great!

I am at work right now but will return shortly.

swerang · « **Reply #6 on:** May 16, 2012, 10:06:39 PM »

Sure. Thanks.

jeffce · « **Reply #7 on:** May 17, 2012, 03:05:05 AM »

Hi,

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
----------

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

Code: [Select]

:Services

:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-73586283-299502267-725345543-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-73586283-299502267-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-73586283-299502267-725345543-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678
IE - HKU\S-1-5-21-73586283-299502267-725345543-1003\..\SearchScopes\{F1CA1342-EA47-4F5D-A283-9D556A1AF29D}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=FTB&o=41648106&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=9C&apn_dtid=YYYYYYU8US&apn_uid=C46C247C-E317-493A-BBB7-A2E34C44724B&apn_sauid=5573F6FE-9C76-481E-A76A-3931E4767EE
[2012/04/20 18:18:25 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
O3 - HKU\S-1-5-21-73586283-299502267-725345543-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKU\S-1-5-21-73586283-299502267-725345543-1003..\Run: [QNPlus]  File not found
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Swetha Ranganathan\My Documents\*.tmp files -> C:\Documents and Settings\Swetha Ranganathan\My Documents\*.tmp -> ]
[2011/10/10 12:54:56 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\Swetha Ranganathan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

swerang · « **Reply #8 on:** May 17, 2012, 10:00:48 AM »

Hi jeffce,
Thanks for the prompt response. I ran ERUNT and OTL as you advised. I have attached the logs of OTL after running fix and doing a scan after reboot.

Thanks,
Swetha

jeffce · « **Reply #9 on:** May 17, 2012, 01:44:54 PM »

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
----------

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

Do not use this instance of your browser for anything besides doing this scan
When the scan is complete and the results saved, close that instance of your browser
Open a new one the usual way and post the results in this topic.

[list=1]

Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)[list=1]
Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

Check
Click the Start button.
Accept any security warnings from your browser.
Check
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin

scanning your computer. Please be patient as this can take some time.

When the scan completes, push
Push , and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the Back button.
Push Finish

http://www.eset.com/onlinescan/
----------

In your next reply please post the logs made by Malwarebytes and ESET online scanner.

swerang · « **Reply #10 on:** May 17, 2012, 10:31:08 PM »

I ran MalwareBytes and ESET following your instructions. I have attached logs of both runs. MalwareBytes didn't find any infections whereas ESET did show some trojans. Please look at the logs and let me know the next step.

jeffce · « **Reply #11 on:** May 18, 2012, 12:55:44 AM »

Hi,

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

Code: [Select]

:Services

:Files
C:\Documents and Settings\Swetha Ranganathan\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\14\292386ce-1c59ce8b	
C:\Documents and Settings\Swetha Ranganathan\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\34\26ac7ea2-3c73e2bb	
C:\Documents and Settings\Swetha Ranganathan\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\41\29b4c469-44a4431a	
C:\Documents and Settings\Swetha Ranganathan\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\54\4c4f8d76-39211c4b

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

----------

In your next reply please attach the log made by OTL and let me know how your system is running.

swerang · « **Reply #12 on:** May 18, 2012, 04:02:40 AM »

Hi jeffce,
I ran OTL and have attached the logs of the two runs. Thanks.

jeffce · « **Reply #13 on:** May 18, 2012, 01:44:40 PM »

Hi,

How is your system running now?

swerang · « **Reply #14 on:** May 18, 2012, 08:45:40 PM »

Hi jeffce,
Thanks for those steps. The system seems better, however, webpages are still getting re-directed and videos are freezing from time to time.

Author Topic: Computer infected with malware (Read 7009 times)

swerang

Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware

jeffce

Re: Computer infected with malware

swerang

Re: Computer infected with malware