January 23rd, 2010, 12:32 AM
#1
I was surfing the web with Firefox the other day when a warning from Avast popped up. I closed the offending tab immediately, but from that point on, I started getting popup ads showing up randomly. I decided to run the usual gamut of tests, but that's when things got complicated.
Last edited by shazbot; January 23rd, 2010 at 01:11 AM .
January 23rd, 2010, 02:14 AM
#2
Download DDS from the following location:DDS Tool dds.scr to the desktopDDS.scr icon to start the program. If you did not disable a script-blocker that may be part of your antimalware program, you may receive a warning from your antimalware product asking if you would like DDS.scr to run. Please allow it to do so. DDS . If no warning appeared, then you should just continue. DDS will now display a small black window providing information as to what DDS is doing on your computer.DDS will now start scanning your computer and compiling a variety of information about what programs are starting on your computer, what files have been recently created, and the general configuration of your computer. When DDS has finished scanning, all of this information will be compiled and be displayed in two Notepad windows named dds.txt and attach.txt .DDS.txt window and click on the File menu and then select Save As ... menu option.DDS.txt to the desktop. Now click on the Attach.txt Notepad window and save that to the desktop also.DDS.txt log and paste it into your reply here.attach.txt log with your reply using Reply to Thread button, then the Manage Attachments button.
January 23rd, 2010, 05:31 AM
#3
DDS (Ver_09-12-01.01) - NTFSx86
January 23rd, 2010, 09:34 AM
#4
Ok. You have some infections still there.download ComboFix by sUBs from HERE HERE You must download it to and run it from your Desktop Physically disconnect from the internet. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix. Double click combofix.exe & follow the prompts. When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log Re-enable all the programs that were disabled during the running of ComboFix.. Note: Do not mouse-click combofix's window while it is running. That may cause it to stall. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine. Run Combofix ONCE only!!
January 23rd, 2010, 03:23 PM
#5
ComboFix 10-01-23.02 - John Bower 01/23/2010 10:54:15.9.2 - x86http://www.gmer.net http://www.gmer.net
January 23rd, 2010, 03:24 PM
#6
Logfile of Trend Micro HijackThis v2.0.2http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://housecall65.trendmicro.com/ho...vex/hcImpl.cab http://acs.pandasoftware.com/actives.../as2stubie.cab http://www.fileplanet.com/fpdlmgr/ca..._2.3.9.113.cab http://download.bitdefender.com/reso...an8/oscan8.cab http://update.microsoft.com/windowsu...?1236324225929
January 23rd, 2010, 08:06 PM
#7
Combofix's log is telling me it has been run 9 times now, which means I have no idea if it removed anything. There will be no log either as any logs older than the 5th one, are overwritten.
January 24th, 2010, 04:07 AM
#8
The last time I had a problem and had to use Combofix, Broni said the very same thing to me. I assure you I have not been using the program without being explicitly told to. The very first time I had to run it was back in May of '09, and since then, I have had to run it a total of nine times (again, all on the advice of people on the boards). Also, I swear that after doing so each time, I was instructed on how to uninstall it, and I did exactly what was listed in the steps for uninstalling it (i.e., run -> combofix /uninstall). I put that in, and Combofix uninstalled itself, its desktop icon disappearing.
January 24th, 2010, 04:40 AM
#9
There should only be 5 logs unless you physically saved them all to another directory. Click START then RUN Now copy/paste the following bolded text into the Run box and click OK:ComboFix /Uninstall in the runbox and click OK . Note the space between the X and the / , it needs to be there.
January 24th, 2010, 09:45 PM
#10
Looks like it didn't take. Since I uninstalled combofix, I've only been to a handful of different websites, and these were all sites I had been visiting for years, long before I starting having trouble last May.
January 25th, 2010, 12:22 AM
#11
It is messing up computers again, so do not run it unless asked.Internet Explorer browser (or FireFox with IETab), and do an online scan with Kaspersky Online Scanner Note .. for Internet Explorer 7 Accept " button of the license, click on the "Zoom " tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100% . )Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Scan Options: Click OK and, under select a target to scan, select My Computer Scan is completed Save Report As (above - red blinking arrow)Save as Save in Desktop File name Save as type Text file [*.txt] Save Kaspersky Online Scanner Report
January 25th, 2010, 12:03 PM
#12
--------------------------------------------------------------------------------
January 25th, 2010, 09:34 PM
#13
You need to delete all those found by Kaspersky.Download and Run ATF Cleaner ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. ATF Cleaner.exe to open it. Main choose: Windows Temp Empty Selected button. Firefox: Firefox at the top and choose: Select All Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Opera: Opera at the top and choose: Select All Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Exit on the Main menu to close the program.
January 26th, 2010, 01:20 AM
#14
I've run ATF Cleaner.
January 26th, 2010, 02:33 AM
#15
Only if you need to. How is the pc? Did you manage to delete those files?
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
Forum Rules
[RESOLVED] Unknown trojan, Malwarebytes executable deleted
Reply With Quote
.
