#1
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
[Resolved] Bloodhound.SONAR.1 & Trojan Horses - [HJT Log included]
Hi all, I found this board through a google search on Bloodhound.SONAR.1 and saw that you had resolved a few other cases similar to mine so I figured I'd give it a shot since I have no idea how to get rid of this problem.[Resolved] bloodhound.sonar.1 , I have been getting pop ups on my Internet Explorer, even though I only use Firefox now. I also will randomly hear audio clips that sound like they're ads, such as "Congratulations, you just won an IPOD," although there will be no correlating pop up. On top of that, my computer has also since been running abnormally slow.Ad -Aware 2008, both of which continue to find a lot of trojans/bloodhound.SONAR.1 and spyware.Ad -Aware programs have started to act a little wonky, in that they'll randomly say that their virus definitions are not on my computer anymore or they'll just crash, all together. Luckily, I've been able to get them to work again but they're still acting up.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware\aawservice.exehttp://www.clubbox.co.kr/neo.fld/NowStarter.cab http://update.microsoft.com/microsof...?1178227824718 http://update.microsoft.com/microsof...?1178227804078 http://vram9c.vcu.edu/dwa7W.cab http://download.mcafee.com/molbin/is...64/mcfscan.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Welcome to WindowsBBS ginsta here , saving the file to your desktop . Important! ComboFix.exe must be on your desktop! this link for your applicable programs.Close all open programs and windows Click Start>Run and type or paste the following command."%userprofile%\desktop\combofix.exe" /skipfix
ComboFix will run ..... follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
Hi Noah, Here's my ComboFix log: WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! PCI Card V2.7 Driver;C:\WINDOWS\system32\DRIVERS\WMP11V27.sys [2002-07-30 05:22]js - STARTUP.HOMEPAGE - hxxp://www.google.com/ighttp://www.gmer.net And here's my new HJT log: HJT log, just so you know, in case that makes a difference as to why it's not listed in the HJT log.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.clubbox.co.kr/neo.fld/NowStarter.cab http://update.microsoft.com/microsof...?1178227824718 http://update.microsoft.com/microsof...?1178227804078 http://vram9c.vcu.edu/dwa7W.cab http://download.mcafee.com/molbin/is...64/mcfscan.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
Extra::
File::
C:\WINDOWS\system32\7EI8XBm1.exe
C:\WINDOWS\system32\7EI8XBm1.exe.a_a
C:\WINDOWS\system32\Mf3I17rt.exe
C:\WINDOWS\system32\Mf3I17rt.exe.a_a Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall. RegSearch.zip and extract the contents of the zip file to it's own folder.7EI8XBm1.exe on the top line, Mf3I17rt.exe on the next line and click OK. After completion, notepad will be opened with all the found instances, if any. Please post that log here.
#5
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
I did as you asked. Here's the new ComboFix log:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! www.broadcaster.com www.broadcaster.com www.broadcaster.com\settings.sol PCI Card V2.7 Driver;C:\WINDOWS\system32\DRIVERS\WMP11V27.sys [2002-07-30 05:22]js - STARTUP.HOMEPAGE - hxxp://www.google.com/ighttp://www.gmer.net
Last edited by ginsta; 25th August 2008 at 00:26 .
#6
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
So, I did as you asked but the RegSearch program froze at a certain point and stopped responding. Even so, the log still popped up afterwards even after the program had stopped responding. So, I'm not sure if that affected anything. Hopefully not.
#7
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Looks good. Lets see if there's anything else lurking about. Download ATF Cleaner by Atribune and save it to your Desktop.Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of: Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
Recycle bin
The rest are optional - if you want it to remove everything check "Select All".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK
Recommend you also click the Firefox link on the menu and cleanup that profile as well.
Exit ATF Cleaner when complete.
Reboot Kaspersky Online Scanner Accept , when prompted to download and install the program files and database of malware definitions.Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note** Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
#8
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
Haven't done those steps yet but I just wanted to mention that I just realized that my sound isn't working now.HJT log.
#9
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Quote:
Originally Posted by
ginsta
and there's a little "Ok" button, which I ignored and just kept [X]ing out of the window, which popped up again a few more times.
I guess I would question why you X'd it off instead of clicking OK
#10
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
Well, after awhile I did start clicking "Ok," however after rebooting, the little window message is no longer popping up and my sound seems to be working just fine again!
#11
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
And here's my new HJT log:SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware\aawservice.exehttp://www.clubbox.co.kr/neo.fld/NowStarter.cab http://update.microsoft.com/microsof...?1178227824718 http://update.microsoft.com/microsof...?1178227804078 http://vram9c.vcu.edu/dwa7W.cab http://download.mcafee.com/molbin/is...64/mcfscan.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#12
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Great! Glad to hear you got Java updated too. You should go to Add/Remove programs and uninstall all old version as well. They are exploitable if left installed.ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. You can delete any logs that were created/saved too.P2P - I see you have P2P software (uTorrent ) installed on your machine. I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. This page here , here and here .cpu cycles and bandwidth.
#13
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
Ok, had a minor issue w/ using that command for uninstalling ComboFix but I just run cmd and then cd desktop and did it from there and it was ok.
Last edited by ginsta; 26th August 2008 at 06:51 .
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Use this command instead."%userprofile%\desktop\combofix.exe" /u
#15
Member
Profile: Join Date: Aug 2008
Posts: 11
Computer Experience:
Ok, I just ran ATF cleaner and cleaned out Firefox, as well.
All times are GMT +1. The time now is 01:36 .
