Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: infected again  (Read 6224 times)

0 Members and 1 Guest are viewing this topic.

puffins

    Topic Starter


    Rookie

    • Experience: Beginner
    • OS: Unknown
    infected again
    « on: April 08, 2012, 07:53:24 AM »
    something was downloaded and it has caused my computer to freeze and at times not to work at all .I have just gone through your READ THIS BEFORE REQUESTING REMOVAL so i have the requested logs  should i copy and paste them here ? thank you

    Allan

    • Moderator

    • Mastermind
    • Thanked: 1260
    • Experience: Guru
    • OS: Windows 10
    Re: infected again
    « Reply #1 on: April 08, 2012, 07:56:07 AM »
    yes

    puffins

      Topic Starter


      Rookie

      • Experience: Beginner
      • OS: Unknown
      Re: infected again
      « Reply #2 on: April 08, 2012, 08:54:28 AM »
      these are the logs

      [year+ old attachment deleted by admin]

      Allan

      • Moderator

      • Mastermind
      • Thanked: 1260
      • Experience: Guru
      • OS: Windows 10
      Re: infected again
      « Reply #3 on: April 08, 2012, 09:19:52 AM »
      You asked if you should copy and paste the logs and I said yes. Please do that instead of uploading the logs. Thank you.

      puffins

        Topic Starter


        Rookie

        • Experience: Beginner
        • OS: Unknown
        Re: infected again
        « Reply #4 on: April 08, 2012, 11:33:04 AM »
        .
        DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
        Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 1.6.0_31
        Run by Administrator at 9:35:39 on 2012-04-08
        Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1023.660 [GMT -4:00]
        .
        AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
        FW: Online Armor Firewall *Enabled*
        .
        ============== Running Processes ===============
        .
        C:\WINDOWS\system32\svchost.exe -k DcomLaunch
        svchost.exe
        C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
        C:\WINDOWS\system32\svchost.exe -k netsvcs
        svchost.exe
        svchost.exe
        C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\Mozilla Firefox\plugin-container.exe
        .
        ============== Pseudo HJT Report ===============
        .
        BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
        BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
        BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
        BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
        BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
        uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
        mRun: [@OnlineArmor GUI] "c:\program files\online armor\oaui.exe"
        mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
        mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
        mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
        mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
        mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe"  -osboot
        mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
        mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
        mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
        mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
        IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
        IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
        LSP: mswsock.dll
        DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1312836601906
        DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
        DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
        DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
        DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
        DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        TCP: DhcpNameServer = 192.168.1.1
        TCP: Interfaces\{4E57D591-7714-4071-84F5-FF3A5EFD29C9} : DhcpNameServer = 192.168.1.1
        Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
        SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
        SEH: OA Shell Helper: {4f07da45-8170-4859-9b5f-037ef2970034} - c:\progra~1\online~2\oaevent.dll
        SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
        .
        ================= FIREFOX ===================
        .
        FF - ProfilePath - c:\documents and settings\administrator.rebuilt-8c81cd7\application data\mozilla\firefox\profiles\hgdex544.default\
        FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
        FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
        FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
        FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
        FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
        FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
        .
        ============= SERVICES / DRIVERS ===============
        .
        R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2011-7-30 25192]
        R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2011-7-30 29464]
        R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
        S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
        S1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2011-7-30 205864]
        S1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [2011-7-30 39048]
        S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
        S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
        S2 OAcat;Online Armor Helper Service;c:\program files\online armor\oacat.exe [2011-7-30 381512]
        S2 SvcOnlineArmor;Online Armor;c:\program files\online armor\oasrv.exe [2011-7-30 4326472]
        S2 Updater Service for StartNow Toolbar;Updater Service for StartNow Toolbar;c:\program files\startnow toolbar\toolbarupdaterservice.exe --> c:\program files\startnow toolbar\ToolbarUpdaterService.exe [?]
        S3 s3m;s3m;c:\windows\system32\drivers\s3m.sys [2011-9-27 166720]
        .
        =============== Created Last 30 ================
        .
        2012-04-08 12:40:03   --------   d-----w-   c:\documents and settings\all users.windows\application data\Malwarebytes
        2012-04-08 12:40:02   20464   ----a-w-   c:\windows\system32\drivers\mbam.sys
        2012-04-08 12:40:02   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
        2012-04-08 07:29:22   6582328   ----a-w-   c:\documents and settings\all users.windows\application data\microsoft\microsoft antimalware\definition updates\{45d3fe52-daac-46b5-add6-6b8d2dcb5d9f}\mpengine.dll
        2012-04-06 11:20:12   --------   d-----w-   c:\documents and settings\administrator.rebuilt-8c81cd7\local settings\application data\Mozilla
        2012-04-06 03:37:34   0   --sha-w-   c:\windows\system32\dds_trash_log.cmd
        2012-04-06 03:33:54   --------   d-----w-   c:\windows\system32\wbem\repository\FS
        2012-04-06 03:33:54   --------   d-----w-   c:\windows\system32\wbem\Repository
        .
        ==================== Find3M  ====================
        .
        2012-02-29 00:15:34   73728   ----a-w-   c:\windows\system32\javacpl.cpl
        2012-02-29 00:15:32   472808   ----a-w-   c:\windows\system32\deployJava1.dll
        2012-02-03 09:22:18   1860096   ----a-w-   c:\windows\system32\win32k.sys
        2012-01-31 12:44:05   237072   ------w-   c:\windows\system32\MpSigStub.exe
        2012-01-11 19:06:47   3072   ------w-   c:\windows\system32\iacenc.dll
        2012-01-09 16:20:25   139784   ----a-w-   c:\windows\system32\drivers\rdpwd.sys
        2011-08-03 21:31:26   9830   ----a-w-   c:\program files\exefix.reg
        .
        ============= FINISH:  9:37:14.12 ===============


        [year+ old attachment deleted by admin]

        puffins

          Topic Starter


          Rookie

          • Experience: Beginner
          • OS: Unknown
          Re: infected again
          « Reply #5 on: April 08, 2012, 11:41:42 AM »
          <img src=http://www.filedropper.com/download_button.png width=127 height=145 border=0/>
          <div style=font-size:9px;font-family:Arial, Helvetica, sans-serif;width:127px;font-color:#44a854;> <a href=http://www.filedropper.com >file storage online[/url]</div>

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 1020
          • Certifications: List
          • Experience: Expert
          • OS: Windows 10
          Re: infected again
          « Reply #6 on: April 08, 2012, 12:11:00 PM »
          Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

          1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
          2. The fixes are specific to your problem and should only be used for this issue on this machine.
          3. If you don't know or understand something, please don't hesitate to ask.
          4. Please DO NOT run any other tools or scans while I am helping you.
          5. It is important that you reply to this thread. Do not start a new topic.
          6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
          7. Absence of symptoms does not mean that everything is clear.

          If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
          *************************************************************************
          One or more of the identified infections is a backdoor trojan.

          This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

          Read this article: Danger: Remote Access Trojans.

          If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

          I would counsel you to disconnect this PC from the Internet immediately.

          Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

          How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

          When Should I Format, How Should I Reinstall?

          We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

          Should you have any questions, please feel free to ask.

          Please let us know what you have decided to do in your next post
          Windows 8 and Windows 10 dual boot with two SSD's

          puffins

            Topic Starter


            Rookie

            • Experience: Beginner
            • OS: Unknown
            Re: infected again
            « Reply #7 on: April 08, 2012, 06:15:03 PM »
            Thanks Dave, I am going to dump my computer and start using another one,I did use this for banking and I will contact my companies to check on ID Theft. This one is my wife's how can I be sure it is secure? 

            SuperDave

            • Malware Removal Specialist


            • Genius
            • Thanked: 1020
            • Certifications: List
            • Experience: Expert
            • OS: Windows 10
            Re: infected again
            « Reply #8 on: April 09, 2012, 12:31:20 PM »
            Quote
            Thanks Dave, I am going to dump my computer and start using another one,I did use this for banking and I will contact my companies to check on ID Theft. This one is my wife's how can I be sure it is secure? 
            Make sure that your AV is kept up-to-date and install a good third-party firewall and it should keep you safe. I'm using Comodo and I can't even go to the bathroom without getting permission from it. LOL. It's a pain but it's the price one must pay for security.

            Remember only install ONE firewall

            1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
            2) Online Armor
            3) Agnitum Outpost
            4) PC Tools Firewall Plus

            If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

            You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.
            Windows 8 and Windows 10 dual boot with two SSD's