#1
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
[Resolved] Security Tool
Hi, I had a problem a couple months ago and came to this site and had all my problems resolved, hoping never having to come back, but sadly some sort of bug has got the best of me again.Ad -AwareSP1 (KB953595)SP1 (KB958484)SP1 SP2 (KB954430)SP1 (KB963707)
Didn't find the information you thought to find?Similar Threads
#2
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
2nd part of DDS log is missing...
#3
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
Sorry about that, here are the two logfiles.Ad -Aware\aawservice.exeHJT Report ===============js : browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - hxxp://www.tsn.ca/nhl/js : keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=chrff-brandt_off&type=000120X001US&p=
Last edited by broni; 4 Weeks Ago at 04:45 .
#4
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
Please download ComboFix from Here Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. NOTE. Recovery Console Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** Make sure, you re-enable your security programs, when you're done with Combofix. DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!! HijackThis :http://www.trendsecure.com/portal/en...kthis/download Download HijackThis Installer Do NOT attempt to fix anything! NOTE. If you're using Vista, right click on HijackThis , and click Run as Administrator
#5
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
Things are looking up already! The Security Tool didn't launch when the computer restarted! Seems to be running normally!TCP "= 3724:TCP :Blizzard Downloader: 3724js : browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - hxxp://www.tsn.ca/nhl/js : keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=chrff-brandt_off&type=000120X001US&p=http://www.gmer.net Ad -Aware\aawservice.exeSP3 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#6
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
1. Please open Notepad Click Start , then Run
Type notepad .exe in the Run Box.
copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\stu2.exe
c:\docume~1\Hamill\LOCALS~1\Temp\cusbohcn.sys
c:\windows\Tasks\Norton Security Scan for Hamill.job
Folder::
Driver::
cusbohcn
Registry::
RegLockDel:: Save the above as CFScript.txt drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.http://users.pandora.be/bluepatchy/m...s/CFScript.gif Combofix.txt A new HijackThis log .
#7
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
ComboFix 09-10-19.01 - Hamill 10/19/2009 18:19.4.2 - NTFSx86TCP "= 3724:TCP :Blizzard Downloader: 3724js : browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - hxxp://www.tsn.ca/nhl/js : keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=chrff-brandt_off&type=000120X001US&p=http://www.gmer.net Ad -Aware\aawservice.exeSP3 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#8
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
Uninstall Combofix :Start > Run combofix /u Note the space between the "combofix" and the "/u" Print these instructions out. NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe scanner.exe ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***STEP 1. http://www.superantispyware.com/ http://www.superantispyware.com/definitions.html .)PHYSICALLY DISCONNECT FROM THE INTERNET Restart computer in Safe Mode. To enter Safe Mode , restart computer, and keep tapping F8 key, until menu appears; select Safe Mode ; you'll see "Safe Mode" in all four corners of your screen Scan your Computer... button.Scanning Preferences/Control Center... button.General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.Scanning Control tab.Scanner Options make sure the following are checked (leave all others unchecked):- Close browsers before scanning. Close button to leave the control center screen.C:\Fixed Drive .Perform Complete Scan .Next to start the scan. Please be patient while it scans your computer.Scan Summary box will appear with potentially harmful items that were detected. Click OK .Next .Quarantine and Removal is Complete . Click OK and then click the Finish button to return to the main menu.Yes .- Click Preferences, then click the Statistics/Logs tab. Close to exit the program.Post SUPERAntiSpyware log. RECONNECT TO THE INTERNET RESTART COMPUTER! STEP 2. Malwarebytes' Anti-Malware : http://www.malwarebytes.org/mbam.php to your desktop.(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes) mbam-setup.exe and follow the prompts to install the program.Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish .Perform full scan , then click Scan .Show Results to view the results.Remove Selected .Post the log back here .log-date.txt log-date.txt RESTART COMPUTER! STEP 3. Post fresh HijackThis log. NOTE. If you're using Vista, right click on HijackThis , and click Run as Administrator DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
#9
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
The Superantiapyware scan finished and said nothing was found... It didn't seem to produce a log file though, perhaps because there was nothing there? I checked under the statistics and logs section and nothing was saved there...SP3 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#10
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
Disable TeaTimer , as it'll interfere with the cleaning process:TeaTimer System Tray Icon . Exit Spybot-S&D Resident .Print this post out, since you won't have an access to it, at some point. - R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) - O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun Fix checked button.
#11
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP3 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe
#12
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
Your computer is clean Temp File Cleaner (TFC) TFC.exe to run the program.Start button to begin cleaning process.may ask you to restart computer.Windows XP :Windows Vista :Windows Updates are current.6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately ! WOT (Web OF Trust): http://www.mywot.com/ . It'll warn you (in most cases) about dangerous web sites.How did I get infected?, With steps so it does not happen again! : http://www.bleepingcomputer.com/forums/topic2520.html
#13
Member
Profile: Join Date: Aug 2009
Posts: 20
Computer Experience:
Thank you so much! Again! I said it before and I'll say it again, you people are like virtual saints!
#14
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,708
Computer Experience:
You're welcome
All times are GMT +1. The time now is 05:30 .
