Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Worm.Rebhip


  • This topic is locked This topic is locked

#1
jollyr

jollyr

    Member

  • Member
  • PipPipPip
  • 128 posts
I periodically run Malwarebytes Antimalware (MWB) to check the stataus of my PC in addition to having NIS installed and running. The subject popped up about a month ago and it looked like it was removed. It recently showed-up again after running MWB but now it comes back when I subsequently logon again. (Perhaps it was never removed in the first place). It seems to be isolated to my User Account; I have set up a separate Admin Account that I use when needed and have all the other User Account profiles setup as Standard Users.

Another and possibly related issue is that I recently installed Google Chrome browser and set it as default for my profile. I installed a bunch of extensions, including a download accellerator that required installation of Internet Download Accellerator (IDA) from Westbyte. It did not seem to improve my download speed so I uninstalled the Chrome extension as well as the application. After that, when I tried to download a file, my browser was hijacked to the Westbyte site telling me to download IDA. Re-installing then uninstalling the program seemed to work but the problem remanifested itself the next time I logged on to my Account.

Sorry about the lengthy post but I am trying to provide all the details I think may be significant.

OTL scan log follows (had to run it as an Admin from my Account but checked Scan All Profiles because the problem seems to be isolated to my Account)

Thanks for your help and I look forward to your reply.

JR

-+--------------------+--+--------------------+--+--------------------+--+--------------------+-

OTL Logfile removed 060511 by JR

< End of report >

Edited by jollyr, 05 June 2011 - 08:50 PM.

  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there is a miscreant running from a user account

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpr...3-C84E9278F3A7}
    IE - HKU\S-1-5-21-2183331008-2673382216-1578165354-1001\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\Temp File Cleaner DB Toolbar\tbhelper.dll ()
    IE - HKU\S-1-5-21-2183331008-2673382216-1578165354-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpr...3-C84E9278F3A7}
    IE - HKU\S-1-5-21-2183331008-2673382216-1578165354-1008\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\Temp File Cleaner DB Toolbar\tbhelper.dll ()
    O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Temp File Cleaner DB Toolbar\tbcore3.dll ()
    O3 - HKLM\..\Toolbar: (Temp File Cleaner DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Temp File Cleaner DB Toolbar\tbcore3.dll ()
    O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
    O3 - HKU\S-1-5-21-2183331008-2673382216-1578165354-1001\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
    O3 - HKU\S-1-5-21-2183331008-2673382216-1578165354-1008\..\Toolbar\WebBrowser: (Temp File Cleaner DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Temp File Cleaner DB Toolbar\tbcore3.dll ()
    O4 - HKU\S-1-5-21-2183331008-2673382216-1578165354-1001..\Run: [BIOS Backup] C:\Users\BJ\AppData\Roaming\DAGFOpH53I6N.exe ()
    O4 - HKU\S-1-5-21-2183331008-2673382216-1578165354-1001..\Run: [HKCU] C:\Users\BJ\AppData\Roaming\install\winup32.exe ()



    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

  • 0

#3
jollyr

jollyr

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 128 posts
Ran custom scan as instructed. Two reports are pasted below:


First one is report that appeared after rebooting and restarting OTL; and

Second one is report after running Quick Scan after rebooting.

Both Reports deleted 060511 by JR

< End of report >

Edited by jollyr, 05 June 2011 - 08:51 PM.

  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you now update and run Malwarebytes please and post the resultant log
  • 0

#5
jollyr

jollyr

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 128 posts
Log of scan follows (used updated program and definitions) Looks clean.

-+------------------------------------+
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database
version: 6750

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

6/4/2011 5:35:44 PM
mbam-log-2011-06-04 (17-35-44).txt

Scan type: Quick scan
Objects scanned: 155152
Time elapsed: 3 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Are you experiencing any further problems ?
  • 0

#7
jollyr

jollyr

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 128 posts
None right now. Will drive system for a day or so and report back. Thanks in advance for your help. Hope it sticks!

Best ,
JR
  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Once you are happy then do the following please

Subject to no further problems :yes:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :)

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [resethosts]
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Posted Image Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
  • Go to this site and click Do I have Java
  • It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

  • Go to Control Panel and select System
  • Select System
  • On the left select System Protection and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create

Now we can purge the infected ones

  • GoStart > All programs > Accessories > system tools page
  • Select Performance Information and Tools
  • Right click Disc cleanup an select run as administrator
  • Select Your main drive and accept the warning if you get one
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe :unsure:
  • 0

#9
jollyr

jollyr

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 128 posts
Essexboy,

My PC looks clear now, thanks to your help. I followed all steps you recommended in your most recent post.

I have a question about whether the problem can be considered a backdoor trojan? (you used the term miscreant on your original reply to my post) If so, will the cleanup performed prevent the backdoor from being used from here on? I have hear they are notoriously difficult to eradicate and to be safe a complete reinstall is needed.

Am curious to hear your thoughts on this matter.

Thanks again for all your help.

Best,
JR

Edited by jollyr, 05 June 2011 - 09:23 PM.

  • 0

#10
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
This one appears to be gone, the main task of the file was to download other malware and this it was not allowed to do - so all should be OK. But, as I say run for a day or so to ensure that all is clear
  • 0

#11
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP