[RESOLVED] Possible spyware/webpage redirection in Yahoo mail

Printable View

Show 40 post(s) from this thread on one page

January 15th, 2011, 10:15 PM
zachary720

I called the help desk for my DSL...Thank God they are 24/7. He gave me the correct Static DNS settings. Now you don't think I need to run the OTL again? Just scared with having the wrong settings in there.

Windows IP Configuration

Host Name . . . . . . . . . . . . : sandy

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : ltis.net

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : ltis.net

Description . . . . . . . . . . . : CNet PRO200 PCI Fast Ethernet Adapter

Physical Address. . . . . . . . . : 00-08-A1-89-F7-DC

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 192.168.1.100

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

DHCP Server . . . . . . . . . . . : 192.168.1.1

DNS Servers . . . . . . . . . . . : 213.109.64.146

213.109.77.21

1.1.1.1

Lease Obtained. . . . . . . . . . : Saturday, January 15, 2011 7:54:52 PM

Lease Expires . . . . . . . . . . : Sunday, January 16, 2011 7:54:52 PM
January 15th, 2011, 10:25 PM
Broni
That looks good :)

Since you ran Eset yesterday, try this one.
It should be faster.

Please run a BitDefender Online Scan
- Disable your antivirus program.
- Click Start Scanner button.
- Click Free scan now button
- Allow browser plug-in to be installed when prompted.
- Click I Agree to agree to the EULA.
- Please refrain from using the computer until the scan is finished.
- When the scan is finished, click on View report.
- Notepad will open with scan results.
- Save the report to your desktop and post its content in your next reply.
January 15th, 2011, 10:30 PM
zachary720

Think i ran that one also...LOL Did so many scans I can't remember. I will run Bitdefender again.
January 15th, 2011, 10:31 PM
Broni

Just for a peace of mind :)
January 15th, 2011, 11:21 PM
zachary720

QuickScan Beta 32-bit v0.9.9.52
-------------------------------
Scan date: Sat Jan 15 21:51:35 2011
Machine ID: 482E80A0

No infection found.
-------------------

Processes
---------
(verified) avast! Antivirus 1176 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(verified) avast! Antivirus 1736 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(verified) Firefox 3128 C:\Program Files\Mozilla Firefox\firefox.exe
(verified) Firefox 3540 C:\Program Files\Mozilla Firefox\plugin-container.exe
(verified) Java(TM) Platform SE 6 U23 820 C:\Program Files\Java\jre6\bin\jqs.exe
(verified) Microsoft® Visual Studio .NET 864 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(verified) Microsoft® Windows® Operating System 1684 C:\WINDOWS\explorer.exe
(verified) Microsoft® Windows® Operating System 2404 C:\WINDOWS\system32\alg.exe
(verified) Microsoft® Windows® Operating System 488 C:\WINDOWS\system32\csrss.exe
(verified) Microsoft® Windows® Operating System 568 C:\WINDOWS\system32\lsass.exe
(verified) Microsoft® Windows® Operating System 556 C:\WINDOWS\system32\services.exe
(verified) Microsoft® Windows® Operating System 432 C:\WINDOWS\system32\smss.exe
(verified) Microsoft® Windows® Operating System 1580 C:\WINDOWS\system32\spoolsv.exe
(verified) Microsoft® Windows® Operating System 372 C:\WINDOWS\system32\svchost.exe
(verified) Microsoft® Windows® Operating System 720 C:\WINDOWS\system32\svchost.exe
(verified) Microsoft® Windows® Operating System 768 C:\WINDOWS\system32\svchost.exe
(verified) Microsoft® Windows® Operating System 908 C:\WINDOWS\system32\svchost.exe
(verified) Microsoft® Windows® Operating System 972 C:\WINDOWS\system32\svchost.exe
(verified) Microsoft® Windows® Operating System 1060 C:\WINDOWS\system32\svchost.exe
(verified) Microsoft® Windows® Operating System 512 C:\WINDOWS\system32\winlogon.exe
(verified) Microsoft® Windows® Operating System 3372 C:\WINDOWS\system32\wscntfy.exe
(verified) Windows Defender 848 C:\Program Files\Windows Defender\MsMpEng.exe

Network activity
----------------
Process firefox.exe (3128) connected on port 80 (HTTP) --> 204.2.228.147
Process firefox.exe (3128) connected on port 80 (HTTP) --> 204.2.228.147
Process firefox.exe (3128) connected on port 443 (HTTP over SSL) --> 64.233.169.95
Process firefox.exe (3128) connected on port 80 (HTTP) --> 204.2.228.147
Process firefox.exe (3128) connected on port 80 (HTTP) --> 66.220.149.18

Process svchost.exe (768) listens on ports: 135 (RPC)

Autoruns and critical files
---------------------------
(verified) avast! Antivirus C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\browseui.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\crypt32.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\cscdll.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\dimsntfy.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\logonui.exe
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\sclgntfy.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\shell32.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\stobject.dll
(verified) Microsoft® Windows® Operating System c:\windows\system32\userinit.exe
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\wlnotify.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\WPDShServiceObj.dll
(verified) Windows Defender C:\Program Files\Windows Defender\MpCmdRun.exe
(verified) Windows Defender c:\program files\windows defender\mpshhook.dll
(verified) Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll

Browser plugins
---------------
(unsigned) Java(TM) Platform SE 6 U23 C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

(verified) BitDefender QuickScan C:\Documents and Settings\Sandra\Application Data\Mozilla\Firefox\Profiles\hfcr2zbk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
(verified) BitDefender QuickScan C:\Documents and Settings\Sandra\Application Data\Mozilla\Firefox\Profiles\hfcr2zbk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
(verified) BitDefender QuickScan C:\Documents and Settings\Sandra\Application Data\Mozilla\Firefox\Profiles\hfcr2zbk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll (deleted)
(verified) Java Deployment Toolkit 6.0.230.5 C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
(verified) Java(TM) Platform SE 6 U23 c:\program files\java\jre6\bin\jp2ssv.dll
(verified) Java(TM) Platform SE 6 U23 c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
(verified) Messenger C:\Program Files\Messenger\msmsgs.exe
(verified) Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\mswsock.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\rsvpsp.dll
(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll
(verified) Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
(verified) NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
(verified) PokerStars C:\Program Files\PokerStars.TEST\PokerStarsUpdate.exe
(verified) sdhelper.dll c:\program files\spybot - search & destroy\sdhelper.dll
(verified) Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll

Missing files
-------------
File not found: C:\DOCUME~1\Sandra\LOCALS~1\Temp\catchme.sys
--> HKLM\System\ControlSet001\services\catchme\"ImagePath"

File not found: C:\WINDOWS\System32\appmgmts.dll
--> HKLM\System\ControlSet001\services\AppMgmt\Parameters\"ServiceDll"

File not found: C:\WINDOWS\System32\hidserv.dll
--> HKLM\System\ControlSet001\services\HidServ\Parameters\"ServiceDll"

File not found: system32\DRIVERS\TMPassthru.sys
--> HKLM\System\ControlSet001\services\TMPassthruMP\"ImagePath"

Scan
----
(unsigned) MD5: ee59670184fb23059efabc2613495ce6 C:\Program Files\Alwil Software\Avast5\defs\11011401\algo.dll
(unsigned) MD5: ea8fcf30d2961369435c84ce3b3063f1 C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
(unsigned) MD5: e72b70c57c4229d339fe110951932392 C:\Program Files\Mozilla Firefox\freebl3.dll
(unsigned) MD5: 3d07aceebe516a561767117c43088f2c C:\Program Files\Mozilla Firefox\nssdbm3.dll
(unsigned) MD5: 2935447938967fdd07dd9118dfb4afb2 C:\Program Files\Mozilla Firefox\softokn3.dll
(unsigned) MD5: 2bc650257fb0867abd54fd460ec2bafc C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
(unsigned) MD5: 16d7ddf3b659f7cf1cb9f4dcff4219f0 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll

No file uploaded.

Scan finished - communication took 30 sec
Total traffic - 0.03 MB sent, 635.25 KB recvd
Scanned 858 files and modules - 114 seconds

==============================================================================
January 15th, 2011, 11:25 PM
Broni
Your computer is clean https://discussions.virtualdr.com/

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:

:OTL :Commands [purity] [emptytemp] [EMPTYFLASH] [CLEARALLRESTOREPOINTS] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how your computer is doing.
January 16th, 2011, 02:00 PM
zachary720

Shut down PC last night and needed a break from it. So doing this all today.

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 3116 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Sandra
->Temp folder emptied: 393 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 38203690 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 1246 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3018 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 110216 bytes

Total Files Cleaned = 37.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Sandra
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.20.2 log created on 01162011_124733

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...
January 16th, 2011, 02:05 PM
Broni

Quote:

12. Please, let me know, how your computer is doing.

Whenever ready....
January 16th, 2011, 02:18 PM
zachary720

Am running cleanup with OTL....it has been stuck for the past 10 min or so

processing (deleteself)

Is that normal?
January 16th, 2011, 02:19 PM
Broni

It may be.
Give it little bit more time...
January 16th, 2011, 02:21 PM
zachary720

OK
January 16th, 2011, 02:59 PM
zachary720

Ok it finished.

Have been to a few websites and no redirection. So I am hoping it is done.
I want to Thank You again for your help.

I dled mywot and Secunia.
January 16th, 2011, 03:00 PM
Broni

Way to go!! https://discussions.virtualdr.com/
Good luck and stay safe :)

Show 40 post(s) from this thread on one page