Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Annyoing malware, spyware

Started by Emperor606 , Jun 01 2011 12:54 PM

This topic is locked

#1
Emperor606

Posted 01 June 2011 - 12:54 PM

Member

Member
31 posts

Hello, I'm having annoying bug when I click somewhere on mozzila tabs it redirects me to this site

http://www.informani...x.php/databases , I think if you open it you will get malware too so don't open it

Spoiler

Thanks for help.

EDIT: Close this thread to help me fix this http://www.geekstogo...-deaths-for-xp/ and then I will ask one of moderators to open this one thanks

Edited by Emperor606, 01 June 2011 - 01:53 PM.

#2
rshaffer61

Posted 01 June 2011 - 02:10 PM

Moderator

Moderator
34,114 posts

Closed per OP 6-1-11
Reopened per OP 6-2-11

Edited by rshaffer61, 02 June 2011 - 06:47 PM.
Reopemed topic after finishing tech side assistance

#3
SweetTech

Posted 02 June 2011 - 08:32 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :unsure:

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Rootkit UnHooker (RkU)
Please download Rootkit Unhooker from one of the following links and save it to your desktop.
Link 1 (.exe file)
Link 2 (zipped file)
Link 3 (.rar file)In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

Double-click on RKUnhookerLE.exe to start the program.
Vista/Windows 7 users right-click and select Run As Administrator.
Click the Report tab, then click Scan.
Check Drivers, Stealth Code, and uncheck the rest.
Click OK.
Wait until it's finished and then go to File > Save Report.
Save the report to your Desktop.
Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

NEXT:

What issues are you currently experiencing with your computer?

#4
Emperor606

Posted 02 June 2011 - 10:24 PM

Member

Topic Starter
Member
31 posts

Hello, and thanks for your time, here is the report you were asking for

Spoiler

Well, like I said in first post I'm experiencing weird 'thing' when I click on new tab or randomly click anything in firefox it redirects me to this link hxxp://www.informanize.com/index.php/databases not always but like 1/10 times, and I think that's a malware or a virus or spyware , I don't know difference between them

And I can notice that my windows starts up kinda slow(?), and my computer is kinda slow too
( I don't know is it related to this part of forum but , you have asked me what issues is my computer dealing with )

Edited by SweetTech, 03 June 2011 - 08:26 AM.
disabled live links.--ST

#5
SweetTech

Posted 03 June 2011 - 08:30 AM

Sir SpamAlot

Retired Staff
7,671 posts

Hi!

Do you recognize these files?

[2011/06/01 10:37:21 | 001,486,292 | ---- | M] () -- C:\Documents and Settings\Name\Desktop\4774231_FEARZ_vs_OK_Nv_.w3g
[2011/06/01 10:28:46 | 001,039,634 | ---- | M] () -- C:\Documents and Settings\Name\Desktop\4774423_ok_fearz3(1).w3g
[2011/06/01 10:23:16 | 001,061,948 | ---- | M] () -- C:\Documents and Settings\Name\Desktop\4774375_FEARZ_vs_OK_Nv_.w3g
[2011/05/30 18:17:20 | 000,549,329 | ---- | M] () -- C:\Documents and Settings\Name\Desktop\4770198_Moscow_Five_vs_.w3g
[2011/05/13 11:08:38 | 000,070,196 | ---- | M] () -- C:\Documents and Settings\Name\My Documents\Za vreme trajanja.mdi

____________________________________________________

OTL Fix

We need to run an OTL Fix

Please reopen on your desktop.

Copy and Paste the following code into the Posted Image

textbox.

:Services
:OTL
IE - HKCU\..\URLSearchHook: {F08555B0-9CC3-11D2-AA8E-000000000567} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - No CLSID value found.
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.23.192.9 217.23.192.14
O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\Name\cbzvl.exe) - C:\Documents and Settings\Name\cbzvl.exe ()
O33 - MountPoints2\{14d58fda-7dde-11df-b241-002185338f50}\Shell\AutoRun\command - "" = yedXlE.EXE
O33 - MountPoints2\{14d58fda-7dde-11df-b241-002185338f50}\Shell\OPeN\ComMaND - "" = yedxLE.EXE
O33 - MountPoints2\{9f56c9ff-992c-11db-9842-002185338f50}\Shell\AutoRun\command - "" = E:\ReCyClER\sEtUp.exe
O33 - MountPoints2\{9f56c9ff-992c-11db-9842-002185338f50}\Shell\OpEN\cOMMaND - "" = E:\ReCyClER\sEtUp.exe
O33 - MountPoints2\{c71fe3e2-7119-11df-b219-002185338f50}\Shell - "" = AutoRun
O33 - MountPoints2\{c71fe3e2-7119-11df-b219-002185338f50}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c71fe3e2-7119-11df-b219-002185338f50}\Shell\AutoRun\command - "" = F:\RunGame.exe
[2011/05/19 13:25:34 | 000,204,288 | RHS- | M] () -- C:\Documents and Settings\Name\cbzvl.exe

:Reg

:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]

Push
OTL may ask to reboot the machine. Please do so if asked.
Click the OK button.
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

#6
Emperor606

Posted 03 June 2011 - 11:11 AM

Member

Topic Starter
Member
31 posts

Yes, I recognize those files ,those are replays from warcraft .w3g file and .mdi is scanned text,

Also weird thing happen , when I double clicked OTL.exe it disappeared , and after I tried to download it again , all mirrors were dead so I will wait until that gets fixed , or can you upload your OTL on mega upload or whatever so I download it

#7
SweetTech

Posted 03 June 2011 - 11:19 AM

Sir SpamAlot

Retired Staff
7,671 posts

Can you please try downloading it from this link here?

#8
Emperor606

Posted 03 June 2011 - 11:54 AM

Member

Topic Starter
Member
31 posts

I still can't it says 'problem loading page'

#9
SweetTech

Posted 03 June 2011 - 12:19 PM

Sir SpamAlot

Retired Staff
7,671 posts

Please try proceeding with the ComboFix instructions.

#10
Emperor606

Posted 03 June 2011 - 02:30 PM

Member

Topic Starter
Member
31 posts

Okay I'm done, should I attach log too? because 'Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.'
ok I will paste it you can say if I need to attach it in next post.

Spoiler

#11
SweetTech

Posted 03 June 2011 - 04:29 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hi!

The way you're posting the logs is fine.

Lets see what these scans find:

Scanning with MalwareBytes' Anti-Malware

Please download Malwarebytes' Anti-Malware (v1.51.0.1200) and save it to your desktop.
Download Link 1
Download Link 2Malwarebytes' may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Make sure you are connected to the Internet and double-click on mbam-setup.exe to install the application.
For instructions with screenshots, please refer to this Guide.
When the installation begins, follow the prompts and do not make any changes to default settings.
Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
If an update is found, the program will automatically update itself. Press the OK button and continue.
If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
Click on the Scan button.
When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
Make sure that everything is checked and then click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
Exit Malwarebytes' when done.

Note: If Malwarebytes' encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes' from removing all the malware.

NEXT:

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
Check
Click the button.
Accept any security warnings from your browser.
Check
Make sure that the option "Remove found threats" is Unchecked
When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
- Enable Anti-Stealth technology
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push , and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the button.
Push

NEXT:

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

#12
Emperor606

Posted 03 June 2011 - 05:18 PM

Member

Topic Starter
Member
31 posts

I tried and I managed to download OTL, probably something was wrong with server, do you still need me to do that task with OTL?

Okay so after I OTL asked for restart it again disappeared and I can't dl it again, so I went to search for log and I found this one
OTL:

Spoiler

MB:

Spoiler

ESET:

Spoiler

Security check:

Spoiler

Edited by Emperor606, 03 June 2011 - 06:44 PM.

#13
SweetTech

Posted 03 June 2011 - 05:52 PM

Sir SpamAlot

Retired Staff
7,671 posts

If you were able to download OTL to your computer, then yes, please proceed with running that previous fix, and then proceed with the Online Virus scanner followed by the SecurityCheck scan.

#14
Emperor606

Posted 04 June 2011 - 12:38 PM

Member

Topic Starter
Member
31 posts

I can notice, I don't have that site pooping up anymore

#15
SweetTech

Posted 04 June 2011 - 12:50 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hi!

I just saw that you had edited your previous post to include those logs.

These two threats are currently in Quarantine/System Restore and will be dealt with once we clean-up our tools later.

C:\Qoobox\Quarantine\C\Documents and Settings\Name\cbzvl.exe.vir probably a variant of Win32/Bflient.AN worm
C:\System Volume Information\_restore{E1D2E2CE-6FE2-4573-8999-B45667A36403}\RP83\A0034541.exe probably a variant of Win32/Bflient.AN worm

You should remove Registry Easy by going to Add/Remove Programs in the Control Panel

____________________________________________________

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

Go to Start > Control Panel > Add/Remove Programs
Remove ALL instances of Adobe Reader
Re-boot your computer as required.
Once ALL versions of Adobe Reader have been uninstalled, visit: <<here>> and download the latest version of Adobe Reader

Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

NEXT:

Java Outdated
Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "Java Platform, Standard Edition".
Click the "Download JRE" button to the right.
Read the License Agreement, and then check the box that says: "Accept License Agreement".
From the list, select your OS and Platform.
- 32-bit Select: Windows x86 Offline.
- 64-bit Select: Windows x64.
If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to

> Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u25-windows-i586.exe to install the newest version.
If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:

Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.

NEXT

OTL Fix

We need to run an OTL Fix

Please reopen on your desktop.

Copy and Paste the following code into the Posted Image

textbox.

:Services
:OTL

:Reg

:Files
C:\Documents and Settings\Name\Desktop\PROGRAMI\Svi setupi\Ostalo\Keygen.exe
C:\Program Files\Registry Easy\Recoveryer.dll
C:\Program Files\Registry Easy\RegEasyCleaner.exe
C:\Program Files\Registry Easy\RegEasyCleanerUpdate.exe
C:\Program Files\Warcraft III\dev-ft-keygen.exe
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]

Push
OTL may ask to reboot the machine. Please do so if asked.
Click the OK button.
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

OTL Custom Scan

We need to run an OTL Custom Scan

Please reopen on your desktop.
Copy and Paste the following code into the textbox.

netsvcs
drivers32
hklm\software\clients\startmenuinternet|command /rs
%USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Push the button.
A report will open. Copy and Paste that report in your next reply.