Security Cleanup FAQ | DSLReports.com, ISP Information

Noteworthy Comments About Compromised Computers

Malware Removal: When to Flatten and Reinstall Windows

So, you didn’t protect the system and it got hacked. What to do? Well, let’s see:

• You can’t clean a compromised system by patching it. Patching only removes the vulnerability. Upon getting into your system, the attacker probably ensured that there were several other ways to get back in.

•You can’t clean a compromised system by removing the back doors. You can never guarantee that you found all the back doors the attacker put in. The fact that you can’t find any more may only mean you don’t know where to look, or that the system is so compromised that what you are seeing is not actually what is there.

•You can’t clean a compromised system by using some “vulnerability remover.” Let’s say you had a system hit by Blaster. A number of vendors (including Microsoft) published vulnerability removers for Blaster. Can you trust a system that had Blaster after the tool is run? I wouldn’t. If the system was vulnerable to Blaster, it was also vulnerable to a number of other attacks. Can you guarantee that none of those have been run against it? I didn’t think so.

•You can’t clean a compromised system by using a virus scanner. To tell you the truth, a fully compromised system can’t be trusted. Even virus scanners must at some level rely on the system to not lie to them. If they ask whether a particular file is present, the attacker may simply have a tool in place that lies about it. Note that if you can guarantee that the only thing that compromised the system was a particular virus or worm and you know that this virus has no back doors associated with it, and the vulnerability used by the virus was not available remotely, then a virus scanner can be used to clean the system. For example, the vast majority of e-mail worms rely on a user opening an attachment. In this particular case, it is possible that the only infection on the system is the one that came from the attachment containing the worm. However, if the vulnerability used by the worm was available remotely without user action, then you can’t guarantee that the worm was the only thing that used that vulnerability. It is entirely possible that something else used the same vulnerability. In this case, you can’t just patch the system.

•You can’t clean a compromised system by reinstalling the operating system over the existing installation. Again, the attacker may very well have tools in place that tell the installer lies. If that happens, the installer may not actually remove the compromised files. In addition, the attacker may also have put back doors in non-operating system components.

•You can’t trust any data copied from a compromised system. Once an attacker gets into a system, all the data on it may be modified. In the best-case scenario, copying data off a compromised system and putting it on a clean system will give you potentially untrustworthy data. In the worst-case scenario, you may actually have copied a back door hidden in the data.

•You can’t trust the event logs on a compromised system. Upon gaining full access to a system, it is simple for an attacker to modify the event logs on that system to cover any tracks. If you rely on the event logs to tell you what has been done to your system, you may just be reading what the attacker wants you to read.

•You may not be able to trust your latest backup. How can you tell when the original attack took place? The event logs cannot be trusted to tell you. Without that knowledge, your latest backup is useless. It may be a backup that includes all the back doors currently on the system.

•The only way to clean a compromised system is to flatten and rebuild. That’s right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).

The above quote taken from this page:
�www.microsoft.com/technet/commun��504.mspx

Not having the original install disk and/or backups prior to the compromise makes this option pretty much impossible. However, continuing to use this PC on the internet as a trusted machine is a risk for future use. It might be time for a new computer and retire this one.

I can tell you that I would not use it after this serious a breach. Give your friend this link if they do not understand what happens when your computer is wide open and under control of a remote access trojan:
Invasion of the Computer Snatchers
�www.washingtonpost.com/wp-dyn/co��342.html

That is the reality of what we are dealing with here. This PC has been so seriously compromised that I do not want to mislead you into thinking that this "cleaning" will reverse the potential of the damage already done. The fact that it was hosting Multiple rootkits and backdoor trojans makes the breach pretty much a worst case scenerio, with many of these problems you have seen thus far trying to "clean" the system.
Security Management - July 2004
Help: I Got Hacked. Now What Do I Do? Part II
�www.microsoft.com/technet/commun��704.mspx

quote:
with a rootkit on the system that makes the system no longer trustworthy. Windows Explorer and the command line will no longer show you the files that are actually on the system. The registry editor is now lying. Account manager tools will not show you all the users. At this stage of an intrusion, you can no longer trust the system to tell you about itself. That’s where you get into a flatten and rebuild (some people call it "nuke and pave") scenario. The system is now completely compromised.

From original post by DSLR's CalamityJane. Used with permission.
Article Source: »Re: [Virus] Virus's and spyware!

How to Install, Reinstall, or Upgrade Windows

Windows 7, Vista, Windows XP
»windows.microsoft.com/en-us/wind···ninstall

Mandatory Steps Before Requesting Assistance

You must follow these steps for posting to the Clean-up forum! No shortcuts!
Threads will be removed/closed unless you follow these instructions first.
Scroll down and view all

We want to help, really!
**Do not make any changes to your system, or add/remove programs unless directed by your helper**

These instructions will tell you what we need run to pre-clean your computer, and what required logs to attach to your post.

This forum is for cleanup of symptomatic infections. It is not to diagnose operating system applications, debate security issues or analyze for the sake of analyzing. Please DO NOT post logs to the main Security Forum, as they will not be reviewed there.

Follow the below outlined requirements so we may better assist you.

DO NOT RUN COMBOFIX OR OTHER 'TOOLS' UNLESS ASKED

Those not following this carefully before posting, will find their topic closed, moved or removed.

Some malware will try to block programs. If you are unable to get an application to run, try renaming the executable file to a random file name (such as somefile.exe, somefile.scr, etc) then try to see if it will run.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

First make a copy (or print out) these instructions so you have them handy. Alternate: »Site FAQ »How can I print an FAQ?

Pre-Cleaning Steps:

• If you are using Firefox, and have the add-on Linkification installed, please open the extension "General" options, and make sure to uncheck "Enable Auto-Linkification" (figure left).

• You can also set for the DSLReports and/or BroadbandReports domain only in preferences, if you choose to (figure right). See Screenshots below:

(a) If you have Spybot S&D or AdAware installed do the following:

If Spybot is installed

See »aumha.net/viewtopic.php?t=32409

If Ad-Aware is installed and Ad-Watch is enabled: Before proceeding, disable Ad-Watch and leave it disabled until we're done here.
See »aumha.net/viewtopic.php?f=43&t=38668

NB: If you don't fully understand what Tea Timer and/or Ad-Watch does and how it does it, best to leave it permanently disabled.

Special Note for Vista and Windows 7: In all that follows, and subsequent sessions, you need to run these utilties "As Administrator" in most cases. Right click the program executable and choose "Run as Administrator". If you do not do this, some of these utilities will fail to work, or fail to work properly. If you have any problems with any of the utilities you are asked to run, check that you ran the application as an Administrator. Some of these utilties will not give you a UAC prompt, they will simply exit without doing anything at all or showing an error message.

(b) Enable Show Hidden Files and Folders

Windows XP:

www.bleepingcomputer.com/tutoria···windows/

Windows Vista:

www.bleepingcomputer.com/tutoria···s-vista/

Windows 7:

www.bleepingcomputer.com/tutoria···ndows-7/

Windows 8:

www.bleepingcomputer.com/tutoria···ndows-8/

Open Notepad;
Click on Format;
Uncheck Word wrap, if checked.

(d) Disable Windows Defender

Open Windows Defender by clicking the 'Start' button
Click 'All Programs', then click 'Windows Defender'
Click Tools', then click 'Options'
Under 'Administrator options', select or clear the 'Use Windows Defender' check box
click 'Save'

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

(e) Please disable the real-time protection on your AntiVirus program: »Security Cleanup FAQ »AntiVirus Programs - How to disable

(f) If you have CCleaner 2.3.6 or later installed:

Please make sure not to run CCleaner until we're done here, unless the following is unchecked
See screenshot:

Cleaning Steps:

1. Download TFC - Temp File Cleaner, saving it to your desktop:

If you're experiencing symptoms like missing files, folders, a blank Desktop, or an empty Start Menu, please skip this step and go on to Step 2.

»oldtimer.geekstogo.com/TFC.exe
»www.itxassociates.com/OT-Tools/TFC.exe

Save it to your Desktop.

Close any open windows, save your work,

Double click the TFC icon to run the program,

TFC will close all open programs itself in order to run,

Click the Start button to begin the process,

Allow TFC to run uninterrupted,

The program should not take long to finish it's job,

Once it's finished, click OK to reboot.

2. Download Malwarebytes Anti-Malware, saving it to your desktop.

»www.malwarebytes.org/mbam-download.php

Make sure you are connected to the Internet.
Double-click on Download_mbam-setup.exe to install the application. (If using Windows Vista, be sure to "Run As Administrator")
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

»data.mbamupdates.com/tools/mbam-rules.exe
On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.

The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.

The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.

Make sure that everything is checked, and click Remove Selected.

When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

Copy and paste the contents of that report in your next reply and exit MBAM.

Note 1:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Note 2:
Some malware will try to block Malwarebytes' Anti-Malware. If you are unable to get Malwarebytes' Anti-Malware to run, rename the executable file (normally C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe) to a random file name (such as somefile.exe, somefile.scr, etc) and double-click the file to see if it will run.

3. Download AdwCleaner by Xplode, saving it to your desktop:

»general-changelog-team.fr/fr/dow···wcleaner

Operating Systems: Windows XP/Vista/Windows 7/Windows 8 - 32bit & 64bit

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Follow the prompts to reboot the computer. A text file will open after the restart.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

Note: If you use Antivir antivirus please see the information on the following webpage: »www.bleepingcomputer.com/downloa···cleaner/

4. Download OTL, saving it to your desktop:

»oldtimer.geekstogo.com/OTL.exe
»www.itxassociates.com/OT-Tools/OTL.exe

Close all open windows on the Task Bar. Click the OTL icon (for Vista, right click the icon and Run as Administrator) to start the program.

In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".

Now click Run Scan at Top left and let the program run uninterrupted. The scan may take 5-10 minutes.

Do not TOUCH your keyboard until the scan completes!

It will produce two (2) logs on your desktop, one will pop up called OTL.txt; the other will be named Extras.txt.

Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!

Exit OTL by clicking the X at top right.

5. Download Security Check, saving it to your Desktop:

»screen317.spywareinfoforum.org/S···heck.exe
»screen317.changelog.fr/SecurityCheck.exe

Double-click on SecurityCheck.exe and follow the on-screen instructions inside the black box.

A Notepad document named checkup.txt should then open automatically; close Notepad, saving the file to your desktop. We will need this log, too.

If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

6. Online AV Scan

This is an important step to do even if you ran your resident AV program, as some malware can disable the program currently installed on your PC. The online AV scanners can sometimes reveal infections your present AV can not. An online scanner can't be "fooled" or damaged by malware. The online scan will not interfere with your currently installed AV program. The logs in your post are a required step.

Only do one of following scans. Try ESET first, and if you have any problems, then try the bitDefender scan. If neither scan works, skip this step but be sure to let us know both failed.

ESET Online Scan:

ESET Online Scanner works with x32 and x64 (AMD64 and EMT64) versions of Microsoft Windows - it does not work with Itanium (IA64) versions of Microsoft Windows.
The ESET Online Scanner is a 32-bit application, which means it must be run through in the 32-bit version of Internet Explorer, and as an Administrator. To do so, right-click on the Internet Explorer (32-bit) icon in the Start Menu and select "Run as administrator" from the context menu.

Go here: »www.eset.com/onlinescan to run an online scannner from ESET.

Note: If IE doesn't work, try an alternate browser. Firefox & Opera are now supported w/ a downloadable tool.

You will find the Firefox/Opera tool here:

»/r0/download/1···.exe.zip

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
---or for 64bit Windows: C:\Program Files\ESET Online Scanner\log.txt
Copy and paste that log as a reply to your topic, along with a description of any remaining problems

bitDefender Online Scan:

Go here: »quickscan.bitdefender.com/ to run an online scannner from bitDefender.

Start the BitDefender online scan by pressing the 'Start Scan' button.

You will need to allow an ActiveX control or plugin to install for the scan to run.

Leave the scanning options at default and press "click here to scan"

When finished scanning, click on "click here to export the scan report"

Save it to your desktop, at "file name" type in "bdscan" then click save.

Please post the contents of the log in your next reply.

6. Post the generated logs into a new thread in the Clean-Up Forum:

Copy/paste the following into your post (in order):

the contents of the MBAM log (Step 2)
the contents of the AdwCleaner log (Step 3)
the contents of OTL.txt (Step 4)
the contents of Extras.txt (Step 4)
the contents of checkup.txt (Step 5)
the contents of the Online AntiVirus Scan log(Step 6)

If you follow the above steps, it will accomplish three things:

Providing us the information we need in order to help you efficiently and effectively will avoid delaying the cleaning process.

Screenshots of Desktop Hijack

The following is a collection of screen shots of desktop hijackings, scams, fake alerts, and web based scare messages. These are indicative of a Vundo or Smitfraud infection. Please see these FAQ's for removal:

•Trojan Vundo/Virtumonde/Winfixer Removal

•SpywareQuake/SpyFalcon/Smitfraud Removal

If you still are having problems, refer to the instructions here

*Click on thumbnails to enlarge:

Credit to originating site: Webhelper's CWS Diaries

Newer variants added Nov 17 2006

April 25, 2007 - New screenshots of Antivirus Golden (Video AX Object variant)

AproposRootkit Removal

Symptoms

Unexplained Popups even after all steps in the following FAQ come up "clean"
»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

No apparent signs in a HijackThis log.

No entries visibile under "Device Manager" or "Network Places"

This pest is adware that is hidden by a rootkit. It produces various popups from a number of advertisers, all generating from adchannel.contextplus.net

The best way to tell if you've got it is to run this diagnostic tool:
Download Rootkit Revealer (free tool)
»technet.microsoft.com/en-us/sysi···445.aspx

Unzip it to your desktop.
Open the rootkitrevealer folder and double-click rootkitrevealer.exe
Click the Scan button (bottom right)
It may take a while to scan (don't do anything while it's running)
When it's done, go up to File > Save. Choose to save it to your desktop.
We may need to request a copy of it later.

If you see 200-300 or so entries that are similar to the following, you can try running the AproposFix posted further down.

Sample entries in the RootkitRevealer log showing Apropos infections have a random named folder in the Programs Folder and some of the highlighted file names see below for example. The ace.dll file is frequently seen as well.

quote:
C:\Program Files\Holt_old Note: Random Named Folder in Program Files 13/11/2005 17:37 0 bytes Hidden from Windows API.
C:\Program Files\Holt_old\ace.dll 26/10/2005 15:46 568.00 KB Hidden from Windows API.
C:\Program Files\Holt_old\AI_07-11-2005.log 07/11/2005 00:00 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\AI_08-11-2005.log 08/11/2005 00:00 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\AI_09-11-2005.log 09/11/2005 00:00 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\AI_10-11-2005.log 10/11/2005 00:00 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\AI_11-11-2005.log 11/11/2005 00:05 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\AI_12-11-2005.log 12/11/2005 00:00 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\AI_13-11-2005.log 13/11/2005 00:00 3 bytes Hidden from Windows API.
C:\Program Files\Holt_old\Cache 13/11/2005 17:58 0 bytes Hidden from Windows API.
C:\Program Files\Holt_old\Cache\0000001c_436ee411_0000b71b 07/11/2005 00:20 3.81 KB Hidden from Windows API.
C:\Program Files\Holt_old\Cache\0000001c_436fd078_000ec82e 07/11/2005 17:08 5.38 KB Hidden from Windows API.
C:\Program Files\Holt_old\Cache\00000029_435febb3_0007270e 26/10/2005 15:48 2 bytes Hidden from Windows API.
C:\Program Files\Holt_old\Cache\00000029_435fed33_0002dc6c 13/11/2005 19:07 3.54 KB Hidden from Windows API.
quote:
etc. The log itself will be very long with lots of entries similar to the above)

The Fix

Please download AproposFix from here:

»Security Cleanup FAQ »Security Clean-Up Approved White List

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post the entire contents of the log.txt file in the aproposfix folder into a New Topic.

Thanks to Swandog46 for developing this fix tool :)

1/6/07 --- fixed broken link to RootkitRevealer ~lil~

Aurora / Nail Removal

Aurora/Nail fix
By racooper w/SwanDog46 & miekiemoes

PLEASE READ AND FOLLOW THESE INSTRUCTIONS CAREFULLY; YOU MAY WANT TO PRINT OR SAVE THESE INSTRUCTIONS LOCALLY BEFORE STARTING.

1. Please download, install, and update the free version of Ewido AntiMalware:

update

Start update

Download CCleaner and install, but do not run it yet.

2. Please download this revised installer for the Nailfix utility.
DO NOT run it yet.
Alternate download links here:
http://www.spywareedge.net/nf/nailfix.exe
http://www.spywareaid.com/index.php?file=s...22&softtype=exe

3. Reboot to Safe Mode
How to start the computer in Safe mode
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

4. Once in Safe Mode, please double-click on nailfix.exe. Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish". Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

5. Next, run Ewido again.

Scanner

Complete System Scan

6. Then run HijackThis, click Scan, and place a checkmark by the following item (if found):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O4 - HKLM\..\Run: [random] c:\windows\system32\random.exe r

Close all open windows except for HijackThis and click Fix Checked Note that the 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always end in a single letter r.

Locate and delete the following File in BOLD:
c:\windows\system32\random.exe (or whatever the name may have changed to, as noted above).

6. Now, run CCleaner.

Uncheck

If running Firefox:

uncheck

Run Cleaner

Finally, restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

7. Please start a new topic if you need help. Do not post your logs in someone else's threads. Please NOTE: If you have not done so already, follow the Manadory Steps first before post a HijackThis log. The rules are here:
»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

Edited for new version of Nailfix 22Jul2005

E2Give Malware Removal

E2TakeOut version 1.00
by: RubbeR DuckY

This program removes the E2Give and PTech malware. Simply download, unzip, and run the E2TakeOut.exe file. Follow the onscreen directions and be sure to restart your computer when prompted.

Main indicators in a HijackThis log:

O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O20 - AppInit_DLLs: iniwin32.dll
O20 - AppInit_DLLs: inicfg32.dll

How to Use
Please download E2TakeOut by Rubber Ducky from here:

»www.malwarebytes.org/E2TakeOut.zip

* Extract the file to your Desktop
* Double click E2TakeOut.exe
* Click the Begin Removal button
* Wait until the program is finished scanning
* Once done, it will produce a popup stating that the infection has been found and you need to reboot you computer to complete the removal
* Reboot your computer
* Once your computer has rebooted E2TakeOut will open and produce a report
* Please copy/paste that report into your next reply

EliteBar / PokaPoka Removal

LQfix by miekiemoes

(free tool) is used for the latest variants of Elitebar including the pokapoka strains.
You can download it here:

»users.pandora.be/bluepatchy/miek···Qfix.exe

Download it to your desktop

Double-click LQfix.exe and click install.

Leave the default settings. If you change them, the fix will fail.

Make sure 'Launch LQfix' is checked. After clicking finish in the install, the fix will start.

Follow the prompts on the screen. Your system will reboot afterwards.

Your system may take longer than usual to start up this one time; please be patient.
.................
And the free version of Ewido Security Suite can also remove most of the variants of pokapoka and Elitebar safely, including the Qoologic Trojan that often accompanies EliteBar
»www.ewido.net/en/download/

SpyAxe/Spyware Strike Removal

Please see:
»Security Cleanup FAQ »Zlob/Smitfraud Removal

Edit: 16 April 2006 New tool now fixes all Smitfraud variants. FAQ combined into one:
»Security Cleanup FAQ »Zlob/Smitfraud Removal

Zlob/Smitfraud Removal

These removal tools only work for the following operating systems:

1. SmitfraudFix: Windows 2k, 2003 and XP ONLY
2. RogueRemover: Vista

Windows 98/ME users will need to follow the complete pre-cleaning FAQ here:
»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

SpywareQuake and SpyFalcon are just two of many examples of the Zlob/Smitfraud family of desktop hijackers that pop up over the desktop or gives an alert from the taskbar near the clock and displays a warning message that your computer is infected with spyware and telling you to buy/download/install their program. These warnings are fake and try to trick you into buying the commercial version of software. The many versions of this pest can vary with the warning message shown. A list of example screenshots can be seen here:
»Security Cleanup FAQ »Screenshots of Desktop Hijack

Other Zlob/Smitfraud variants include:
AlphaCleaner
AdwarePunisher
AntiVirusGold
AntispywareSoldier
PSGuard
RazeSpyware
Search Maid
Security IGuard
SpyAxe
SpyFalcon
SpySheriff
SpywareStrike
Virtual Maid
VirusBurst
WinHound
{This list of names has become to long to list all of the possibilities)

Zlob/Smitfraud Removal
Note: Not for Vista users. If you are running Windows Vista, please use the RogueRemover tool described in the next section.

The following steps may not clean all of it, but should be a good start and will restore the desktop to default at least so you can proceed with complete removal using various tools.

1. Print out or save to notepad these instructions as we will need to do most steps offline and in SAFE MODE (so you won't have this window open to see the instruction from)

2. {WinXP, 2k only!) Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop.
How to extract (decompress) zipped or compressed files
»www.lvsonline.com/tut-compresstu···ex.shtml

A folder named SmitfraudFix will be created on your Desktop.

Note : process.exe is part of the SmitFraudFix tool and is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky, Panda) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

3. Reboot into Safe Mode
How to start the computer in Safe mode:

You can usually do this by restarting your computer and continually tapping F8 until a menu appears. Highlight Safe Mode and hit enter.

4. Once in Safe Mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd

Select option #2 - Clean by typing 2 and press Enter to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter

5. A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.

6. Now please scan with HijackThis to produce a log. Post that log in a new topic along with the Ewido log you saved earlier (or the Adaware log) and the Panda report. We will also need the log from SmitFraudFix called rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your new topic. Logs needed in your post are:

rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed

Fresh HijackThis log
...........................................
VISTA users, please use this tool instead

Please download Rogue Remover from here: [code]
»www.malwarebytes.org/rogueremover.php
[/code] & save it to your desktop.

rr-free-setup.exe

RogueRemover.exe

Check for Updates

Download

.................................................................................................
Additional Instructions

a. How to Post a new Topic in the Security Cleanup Forum
Go to this link:
»Security Cleanup
Start your own thread by pressing the *New Topic* button. Do not interrupt other similar threads with your problem.

b. Instructions for HijackThis:
Please make a new folder to put your HijackThis.exe into. Anywhere on your hard drive is fine other than your Desktop or the Temp folder. We suggest you use something like "C:\Program Files\HijackThis" but feel free to use any name. See here for specific instructions and screen shots to help:
»russelltexas.com/malware/createhjtfolder.htm
This is to ensure it makes the necessary backups for recovery if needed.

Download HijackThis
»www.trendsecure.com/portal/en-US···this.php

Unzip/decompress the file and save the contents (HijackThis.exe) to the new folder you made and doubleclick on HijackThis.exe to open the program. On the Main Menu page, Choose *Do a system scan and save a log*

When the scan finishes, you will get a popup to save the logfile. Please make note of the location you will be saving it to and click *save*. This should save the file and open the log in Notepad. Copy the contents and post the results here.
Most of what it lists will be harmless or even essential, don't fix anything yet. Someone will be along to tell you what steps to take after you post the contents of the scan results.

................................................................................

Edit 01 Sep 2007 by CalamityJane : Added additional instructions for Vista

Edit: 08 Aug 2007 by CalamityJane: Adjusted HJT instruction for new ver. 2.02 by Trend-Micro

16 Oct 2006 by CalamityJane. Removed Ewido and Panda scan instructions as SmitfraudFix can do the whole job.

Edit 16 Jul 2006 by CalamityJane: Adjusted instructions for Ewido new ver 4.0

Edit 16 April 2006 by CalamityJane: Added SmitfraudFix tool to replace SmitRem and roguescanfix tools.

Trojan Vundo/Virtumonde/Winfixer Removal

Vundo/VirtuMonde is an adware program that downloads and displays popup advertisements, often seen as Winfixer. Please see important note at the bottom regarding a vulnerabilty in Sun Java that may have be the source of this infection. It may also hijack the browser to unwanted advertising related sites. If you know that you have the Vundo/Virutumonde trojan and other programs have not been able to remove it, please take the following steps using the free tools below.

VundoFix by Atribune

Please download VundoFix.exe from here:
»www.atribune.org/ccount/click.php?id=4

and save it to your desktop

•Double-click VundoFix.exe to run it.
•Click the Scan for Vundo button.
•Once it's done scanning, click the Remove Vundo button.
•You will receive a prompt asking if you want to remove the files,
click YES
•Once you click yes, your desktop will go blank as it starts removing
Vundo.
•When completed, it will prompt that it will reboot your computer,
click OK.
•Please post the contents of C:\vundofix.txt and a new
HiJackThis log.

•Please post the contents of C:\vundofix.txt into a New Topic in the Security Cleanup Forum
Go to this link:
»Security Cleanup
Start your own thread by pressing the *New Topic* button. Do not interrupt other similar threads with your problem. Include the vundofix.txt contents and a fresh HijackThis log (instructions below) Please put in the Title of your topic: Vundo Removal.

We will also need to see a diagnostic log from the free tool HijackThis

Create a Diagnostic log using HijackThis

• Please make a new folder to put your HijackThis.exe into. Anywhere on your hard drive is fine other than your Desktop or the Temp folder. We suggest you use something like "C:\Program Files\HijackThis" but feel free to use any name. This is to ensure it makes the necessary backups for recovery if needed.
See here for specific instructions and screen shots to help:
»russelltexas.com/malware/createhjtfolder.htm

•Download HijackThis here
»www.trendsecure.com/portal/en-US···this.php

• Unzip the file to the new folder you made and doubleclick on HijackThis.exe to open the program. On the newusers quickstart page, Choose *Do a system scan and save a log*

• When the scan finishes, you will get a popup to Save the logfile. Please make note of the location you will be saving it to and click *save*. This should save the file and open the log in Notepad. Copy the contents and post the results into your New Topic when you are ready to post for help.

Most of what it lists will be harmless or even essential, don't fix anything yet. Someone will be along to tell you what steps to take after you post the contents of the scan results.

...................................................................................

Important Note: Possible Vulnerability in Sun Java versions may be responsible for Vundo/Winfixer infections
Check your installed Sun Java versions
We have noticed a large number of Winfixer/ Vundo / Virutmonde Victims have an older version of Sun Java installed in Add/Remove Programs in the Control Panel. Other older or newer versions may also be installed
Please see this topic:
»Potential Vulnerability with Sun Java auto update

Important Note: Autoupdate of Sun Java does not uninstall previous (vulnerable) versions of the program.
Therefore all users are encouraged to please check in your Control Panel, under Add/Remove programs and uninstall any older versions of Sun Java.

To check your version to see if it is the latest version, Please go to this link to verify your version to get the updates needed:
»www.java.com/en/download/windows···atic.jsp

You'll need to use IE and allow ActiveX for this update. Follow the instructions on that page to verify Your Java software

Or you can get the manual download here:
»www.java.com/en/download/manual.jsp

And in the future, remember to remove older versions of Java when you automatically update to a newer version to avoid exploitation of older versions left on your system.

Update: From the SANS Handler's Diary at the Internet Storm Center posted Handler's Diary January 13th 2006
CERTs warn about java bug being exploited
»isc.sans.org/diary.php?storyid=1039

quote:
According to the bulletins you need at least:

* Version 1.3.1_16 or later
* Version 1.4.2_09 or later
* Version (1.)5 update 4 or later {insert My Note: We are now on update 6 in this version)

to be safe.

AND you still need to manually uninstall old verisons of Sun Java after updating!

quote:
Vince told it's also necessary to remove the old java environments, not just get the new ones as an attacker can target the old environments when they are still present.

Top Ten Do's and Dont's of HijackThis for Helpers

I. HijackThis is not used as often any longer and definitely NOT a stand-alone clean tool. It does not scan the entire system and only certain areas are scanned to help diagnose the presence of undetected malware in some of the telltale places it hides. It is extremely important that you give the infected user a full system scan tool like Adaware or Spybot (or both) for spyware issues and an online AV scan for virus, worm or trojan infections. Preferably the fix should START with those steps and finish the cleanup of strays or undetected items with HJT. It is not unusual to have programs find hundreds of infected files and registry items HJT does not target especially in 64 bit systems. This is why we now use OTL. Additional infected files need to be removed by online AV scans also.
Just because you "fixed" it in HJT doesn't mean it's clean.

Note:
A. Use the Mandatory Steps prerequisite for running apps & posting logs first:
»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

II. Do NOT start your fix by disabling System Restore. This rule applies to any manual fixes and is especially true for spyware removal. That is because disabling System Restore wipes out all restore points. Should a problem arise during the fix you would have NO good working configuration to go back to get the computer up and running. Even if you have to start over removing infections, this is preferable to a dead PC thanks to having System Restore turned off. Clean the restore folder and set a new point AFTER the PC is clean and all programs are working properly.

How to Turn On and Turn Off System Restore in Windows XP
http://support.microsoft.com/default.aspx?...kb;en-us;310405

How to Enable and Disable System Restore in Windows ME
http://support.microsoft.com/default.aspx?...kb;en-us;264887
..........................
III. Please don't delete all the 016 items as a rule. I see this being done and it is very sloppy HJT work as the harmless, even helpful ones, should remain on the user's PC. You can check 016 items in SpywareBlaster's Database by rightclicking on the Database list in the program and choose *find* (you can find by name or by CSLID). Then, if found, you can click on *more information* and find by name to see what that item is and if there are any special instructions needed (Javacool provides information links to many of those items). With the ones that remain, if you are not sure you can check the website if you are using Eric Howe's IESPYAD. If the site shows up in the restricted zone - best to remove it. But I see too many helpers removing perfectly harmless 016 items.
..................................

IV. About (file Missing) and what it means. It doesn't always mean the file is really missing!!

You will see (file missing) in some of the lines in different sections. You can only rely on that to be true in the sections for BHOs and Toolbars (02s & 03s)

When you see (file missing) in other sections, it may really NOT be missing. You will see it in the 09's and the 023s especially. The only time you should fix the (file missing) in those sections is IF AND ONLY IF you see a *bad* file there. Be aware that "fixing" doesn't remove the malware either. It's important to have them manually delete the file as well (plus any other recommended removal methods)

Except for the 02 & 03 Sections, good items listed in other sections with (file missing) should be left alone. Most often they ARE there but HJT doesn't see the file.

.................................
V. Don't begin fixes until you have an updated HJT version and it is located in the proper folder!!

quote:
Please make a new folder to put your HijackThis.exe into. Anywhere on your hard drive is fine other than your Desktop or the Temp folder. We suggest you use something like "C:\Program Files\HijackThis" but feel free to use any name. Use the exe not the beta installer! See here for specific instructions and screen shots to help:
http://russelltexas.com/malware/createhjtfolder.htm
This is to ensure it makes the necessary backups for recovery if needed.

................................
VI. Back up the Registry Don't even think about giving instructions to edit the Registry unless you have them backup the Registry first

How to backup and restore the entire registry:
http://service1.symantec.com/SUPPORT/tsgen...c_nam#_Section2
...........................
VII. Don't wrap up a thread until you have given your user some prevention advice and tools.
»Security Cleanup FAQ »How do I prevent Browser Hijacks and Spyware?

Give a man a fish and he will eat for a day. Teach a man to fish and he will eat for a lifetime

Remember that part of our mission is educating our visitors! Each one should not leave here without some good free antispyware tools and instructions to be able to clean their PC and prevent future infections.
................................
VIII Remember to check for Windows Critical Security Updates Remind your victims to check Windows Update and get all the latest updates recommended for their OS and IE. The first defense against infection is a properly patched system and browser.

http://v5.windowsupdate.microsoft.com/en/default.asp

Encourage them to set their PC for automatic updates so that they won't miss any.
................................
IX DO lookup what type of malware you are dealing with where possible.
Many times, the user might have a nasty that requires extra instruction due to registry changes, lowered security system changes, or other considerations. Especially in the case of a dangerous nasty like a trojan, keylogger, password stealer or RAT. Most of the databases used to lookup HJT items have links for reference to the file names - very useful in these cases :)

In other words, just finding out a file is bad is NOT ENOUGH. you must find out why it is bad and how to clear out the entire infection. plus any cautions your user may need to know about changing passwords, accounts, etc.
...................................
X DO identify unknown files where possible and submit undetected nasties to the AT/AV/AS vendorswhere possible. You can scan single files at one of these:

»Security Cleanup FAQ »Single File Detection Sites

Those sites will submit your file to any vendors they are using at their site that do NOT detect a particular nasty (unless none of them detect it, then you need to submit manually to the Vendors)
Here
Submit Malware

How do I prevent Browser Hijacks and Spyware?

Get the free tool Microsoft Baseline Security Analyzer (MBSA) to analyze your PC security for prevention purposes. MBSA Version 2.2 supports Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows XP, Windows Server 2003, Windows Vista, but MBSA 2.2 is not supported on Windows 8 or Server 2012.

MBSA will scan for missing security updates, rollups and service packs using Microsoft Update technologies. MBSA will also scan for common security misconfigurations (also called Vulnerability Assessment checks) using a known list of less secure settings and configurations for all versions of Windows, Internet Information Server (IIS) 5.0, 6.0 and 6.1, SQL Server 2000 and 2005, Internet Explorer (IE) 5.01 and later, and Office 2000, 2002 and 2003 only.

Get the download here: Microsoft Baseline Security Analyzer.

For Windows users, there is a free tool that does some of the same things called Belarc Advisor. Get the download here: Belarc Advisor.
Belarc Advisor runs on Windows 8, 2012, 7, 2008 R2, Vista, 2008, 2003, XP, 2000, NT 4, Me, 98, and 95. Both 32-bit and 64-bit Windows are supported.

Scan and follow the directions to make the necessary corrections.

The following topic was written by AntiSpyware Expert Tony Klein and has been posted in numerous Security Forums.

Hopefully, these tips and tools will help you understand how to stay safe and prevent any future infections. I have added some additional information at the end.

said by TonyKlein:

SO, HOW DID I GET INFECTED IN THE FIRST PLACE?

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

1) Watch what you download!
Many freeware programs, and P2P programs like Grokster, Imesh, Kazaa and others are amongst the most notorious, come with an enormous amount of bundled spyware that will eat system resources, slow down your system, clash with other installed software, or just plain crash your browser or even Windows itself.

Pre-Scan downloaded files for viruses and malware at one of these multi-engine single file scan sites for free! Each one uses a dozen or more well-known AntiMalware scanners in one quick easy scan with a report of results from all.

Virus Total (10mb limit)
»www.virustotal.com/xhtml/index_en.html

Jotti's Malware Scan (15mb limit)
»virusscan.jotti.org/

2) Go to IE > Tools > Windows Update > Product Updates, and install ALL Security Updates listed.
It's important to always keep current with the latest security fixes from Microsoft.
Install those patches for Internet Explorer, and make sure your installation of Java VM is up-to-date. There are some well known security bugs with Microsoft Java VM which are exploited regularly by browser hijackers.

Windows Update:
http://v4.windowsupdate.microsoft.com/en/default.asp

3) Adjust your security settings for ActiveX

Go to Internet Options/Security/Internet, press 'default level', then OK.

Now press "Custom Level."

In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

Now you will be asked whether you want ActiveX objects to be executed and whether you want software to be installed.
Sites that you know for sure are above suspicion can be moved to the Trusted Zone in Internet Option/security.

So why is activex so dangerous that you have to increase the security for it?
When your browser runs an activex control, it is running an executable program. It's no different from doubleclicking an exe file on your hard drive.
Would you run just any random file downloaded off a web site without knowing what it is and what it does?

And some more advice:

4) Install Javacool's SpywareBlaster.

SpywareBlaster
»www.javacoolsoftware.com/spywareblaster.html

SpywareBlaster will protect you from all spy/foistware in it's database by blocking installation of their ActiveX objects. Download and install, download the latest updates, and you'll see a list of all spyware programs covered by the program (NOTE: this is NOT spyware found on your computer)
Press "select all", then "kill all checked", and you're done.
The spyware that you told Spywareblaster to set the "kill bit" for won't be a hazard to you any longer.
Although it won't protect you from every form of spyware known to man, it is a very potent extra layer of protection.
Don't forget to check for updates every week or so. Let's also not forget that SpyBot Search and Destroy has the Immunize feature which works roughly the same way.
It can't hurt to use both.

5) Another brilliant program by Javacool we recommend is SpywareGuard.
It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

SpywareGuard
»www.javacoolsoftware.com/sgdownload.html

An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware! And you can easily have an anti-virus program running alongside SpywareGuard.
It now also features Download Protection and Browser Hijacking Protection!

6) You can use a customized HOSTS file to block known bad sites. This is accomplished by blocking these sites through the hosts file. For more information and recommended sources see here:
»Security »What is a Hosts file and where can I get it?

said by CalamityJane:
To add to Tony's excellent advice above, you many find the additional programs and Security Sites helpful in malware prevention and removal:

7. These free programs are available to remove spyware from your system:

Windows users (English versions only):
Download, Update and Scan with Windows Defender (free)

Download here:
»www.microsoft.com/athome/securit···ult.mspx

Complete instructions on using Windows Defender can be found here:
Using Windows Defender
»www.microsoft.com/athome/securit···ult.mspx
*Validation of genuine Microsoft Windows Required*

8. Scan for Viruses and common trojans online and free

»Security »What are some web based virus scanners and encyclopedias?

9. If you still have problems and think you are infected after following the various scans and help above...... See: »Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance before posting in our »Security Cleanup forum for assistance:

10. Some Security Sites worth reading and bookmarking for reference and to help you get started in your PC Security.

Security At Home:protect your computer
Spyware

Home Computer Security
http://www.cert.org/homeusers/HomeComputerSecurity/

Protecting Your Home Network
http://www.microsoft.com/windowsxp/pro/usi...tecthomenet.asp

Home Network Security
http://www.cert.org/tech_tips/home_networks.html

Malicious Code Propagation and Antivirus Software Updates
http://www.cert.org/incident_notes/IN-2003-01.html

National Institue of Standards and Technology
Computer Security Resource Center
http://csrc.nist.gov/

Stay Safe Online
http://www.staysafeonline.info/

Protecting Your Privacy & Security on a Home PC
»www.spywarewarrior.com/uiuc/

IE-SPYAD: Restricted Sites List for Internet Explorer
»www.spywarewarrior.com/uiuc/reso···#IESPYAD

»Microsoft Application Tips and Tweaks »Concerning Internet Options Security, what do some of the settings mean

Internet Explorer 9 for Windows is available now
»www.microsoft.com/windows/ie/default.mspx
Internet Explorer works with Windows Defender to help prevent spyware from sneaking onto your computer in common ways, such as part of a larger software download

Beware Fake Codecs - it could be a trojan

»www.lavasoft.de/company/newslett···cks.html

quote:
Beware - Desktop Hijacks on the Rise Again
Security Forums have been deluged with daily cries of help from victims of the "Smitfraud" desktop hijackers that are using fake codec to infect their prey.

Watch out for the Zlob Trojan that poses as a codec needed to view a video, then installs a fake virus and urges its victims to download a rogue anti-spyware program to remove it. Lavasoft has also confirmed that this malware takes advantage of unpatched systems using exploits on web pages. Visit Microsoft Update to ensure that ALL of your critical Windows security pages are updated.

Other victims have been infected by a fake e-card greeting, or even a spoofed e-mail that claims to be Windows Update (Microsoft never sends updates via e-mail). Still more unassuming victims received an e-mail asking them to open a link to see the message (these can be fake e-mails, intended only to infect), or even a link from your 'buddy' in instant messages - but don't trust it if you aren't expecting it. Even your buddy could be infected without his/her knowledge and the virus on their computer is sending you the link with one purpose, and one purpose only - to infect you!

A few of the fake codecs out there include:

braincodec (added 28 Nov2006)
EliteCodec (added 08 Nov 2006)
Emcodec
eMedia Codec
Gold Codec (added 23 Nov 2006)
HQ Codec
iCodecPack
iMediaCodec
iVideoCodec
IntCodec
KeyCodec
Media-Codec
MediaCodec
MMediaCodec
MPCODEC
PCODEC
PerfectCodec (added 15 Nov 2006)
PowerCodec
PornPass Manager
PornMag Pass
QualityCodec (Added 08 Nov 2006)
SilverCodec (added 23 Nov 2006)
SoftCodec
strCodec
Supercodec (added 15 Nov 2006)
TrueCodec
vaxsetup
Vccodec
VideoCompressionCodec
VideoKeyCodec
VideosCodec,
WinMediaCodec
X Password Generator
X Password Manager
ZipCodec

We urge you to be aware and watch out for fake codecs. This is one of the favorite methods used by the authors of malware to lure you into downloading a file that infects your computer. If you receive a link for a video that says you need a certain codec in order to view it, be careful! Today, it could be a fake codec that is actually a Trojan just waiting to infect your system.

New variants are being released daily, even faster than Security Products companies receive new samples for detection. And because it does take time for due diligence on detection for the newer variants, it is important to remember that prevention is the key!

A screen shot of what one of the fake codecs looks like:

Discussion thread is here:
»Beware Fake Codecs - it could be a trojan

Edited for new variants: 23 Nov 2006 by CalamityJane
Last edited for new variants: 15 Nov 2006 by CalamityJane
Edit 08 Nov 2006 by CalamityJane: List of codecs updated for new variants

Last edited for new variants: 15 Nov 2006 by CalamityJane

Installing and Using HiJackThis

1. Download the latest version of HiJackThis (not a BETA version), saving it to your desktop:

»go.trendmicro.com/free-tools/hij···This.exe

Save HJTInstall.exe to your desktop.
Open Notepad > Click on Format > Uncheck Word wrap, if checked.
Double-click on the desktop icon for HJTINstall.exe.
By default it will install to C:\Program Files\Trend Micro\HiJackThis
Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and HijackThis (HJT) will launch.
Close any/all browsers, messenger, mediaplayer, Office and mail client windows and applications.
Click on the 'Scan' button. When the scan is finished, press the 'Save' button. HiJackThis will open a Notepad document with scan in it. Save the log to your Desktop for ease in locating it.
Click on Edit > Select All then click on Edit > Copy to copy the contents of the log to your clipboard.
Come back here to this thread, right click your mouse and select Paste to paste the log in your next reply.
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
Make certain your post shows the entire log, please.

To see a tutorial with screenshots on using HijackThis you can click on the link below

How to use HijackThis to remove Browser Hijackers, Malware, & Spyware

Rootkit Detection Applications

1. Download GMER saving it to your desktop:

»gmer.net/download.php (This link will download a rendomly named file *recommended*)
»gmer.net/gmer.zip (Please extract the contents to it own folder on your Desktop)

Operating Systems: Windows NT/2000/XP/Vista/Windows 7 - 32bit & 64bit
Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

Note: If you encounter any problems, try running GMER in Safe Mode. If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning

2. Download Root Repeal saving it to your desktop:

Primary Links (Downloads an executable file):
»ad13.geekstogo.com/RootRepeal.exe
»download.bleepingcomputer.com/ro···peal.exe
»rootrepeal.psikotick.com/RootRepeal.exe

Secondary Links (Downloads a Zip file):
»rootrepeal.googlepages.com/RootRepeal.zip
»ad13.geekstogo.com/RootRepeal.zip
»rootrepeal.psikotick.com/RootRepeal.zip

Tertiary Links (Downloads a Rar file):
(If you don't know what a *.rar file is, don't use these links)
»ad13.geekstogo.com/RootRepeal.rar
»ad13.geekstogo.com/RootRepeal.rar
»rootrepeal.psikotick.com/RootRepeal.rar

Operating Systems: Windows 2000/XP/Vista/Windows 7 - 32bit only

Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
Open RootRepeal on your desktop.
Click the 'Report' tab.
Click the 'Scan' button.
Check all seven boxes
Push Ok
Check the box for your main system drive (Usually C:), and press Ok.

Allow RootRepeal to run a scan of your system. This may take some time.

Once the scan completes, push the 'Save Report' button.
Save the log to your desktop, using a distinctive name, such as RootRepeal.txt.
Include this report in your next reply

3. Download Sophos Anti-rootkit saving it to your desktop:

»www.sophos.com/products/free-too···kit.html (Primary link)
»www.majorgeeks.com/Sophos_Anti-R···238.html (Secondary link)
Note: If using the vendor's download site you will be asked to register with MySophos so an email containing an activation link can be sent to your email address.

Operating System: Windows XP/2000/2003/Vista/2008/Windows 7 (32-bit, 64-bit)

Be sure to print out and read the Sophos Anti-Rookit User Manual and Release Notes

Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click Accept.
Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now".
Click Yes and allow the driver and its randomly named .tmp file (i.e. F.tmp) to load if asked.
If the scan did not start automatically, make sure the following are checked:
Running processes
Windows Registry
Local Hard Drives
Click Start scan.
Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper panel.
When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK to continue.
Click on the suspicious file to display more information about it in the lower panel which also includes whether the item is recommended for removal.
Files tagged as Removable: No are not marked for removal and cannot be removed.
Files tagged as Removable: Yes (clean up recommended) are marked for removal by default.
Files tagged as Removable: Yes (but clean up not recommended) are not marked for removal because Sophos did not recognize them. These files will require further investigation.
Select only items recommended for removal, then click "Clean up checked items". You will be asked to confirm, click Yes.
A pop up window will appear advising the cleanup will finish when you restart your computer. Click Restart Now.
After reboot, a dialog box displays the files you selected for removal and the action taken.
Click Empty list and then click Continue to re-scan your computer a second time to ensure everything was cleaned.
When done, go to Start > Run and type or copy/paste: %temp%\sarscan.log
This should open the log from the rootkit scan. Please post this log in your next reply. If you have a problem, you can find sarscan.log in C:\Documents and Settings\\Local Settings\Temp\.
Before performing an ARK scan it is recommended to do the following to ensure more accurate results and avoid common issues that may cause false detections.
Disconnect from the Internet or physically unplug you Internet cable connection.
Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
Temporarily disable your anti-virus and real-time anti-spyware protection.
After starting the scan, do not use the computer until the scan has completed.
When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.

4. Download TDSS Rootkit Removing Tool, saving it to your Desktop:

»support.kaspersky.com/5350
Operating System: Windows XP/2000/2003/Vista/2008/Windows 7/Windows 8 (32-bit, 64-bit)

Be sure to print out and follow all instructions for performing a scan or refer to these instructions with screenshots.
The link and instructions for downloading an running TDSKiller can be found in '1. How to disinfect a compromised system'

Double-click on TDSSKiller.exe to run the tool for known TDSS variants.

Vista/Windows 7 users right-click and select Run As Administrator.

When the program opens, click the Start Scan button.

Do not use the computer during the scan

If an infected file is detected, the default action will be Cure, click on Continue

If a suspicious file is detected, the default action will be Skip, click on Continue.

If the scan completes with nothing found, click Close to exit.

If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.

If a reboot is required a log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).

Copy and paste the contents of that file in your next reply.

-- If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.

1.0 Forum Rules

What are the Rules of this Forum?

So...What is this Forum all about?

1.1 Posting Guidelines & Etiquette

What we'd like to see

Site Posting Rules & ToS

How to post for assistance

1.2 SCU Helpers

Our Security CleanUp Helpers

1.3 Noteworthy Commentary

Noteworthy Comments About Compromised Computers

How to Install, Reinstall, or Upgrade Windows

2.0 Help - I'm Infected!

Mandatory Steps Before Requesting Assistance

Screenshots of Desktop Hijack

2.0A Disable Real-Time Protection

AntiMalware Programs - How to disable

AntiVirus Programs - How to disable

2.1 Malware Removal

AproposRootkit Removal

Aurora / Nail Removal

E2Give Malware Removal

EliteBar / PokaPoka Removal

SpyAxe/Spyware Strike Removal

Zlob/Smitfraud Removal

Trojan Vundo/Virtumonde/Winfixer Removal

2.2 White List Fixes

Security Clean-Up Approved White List

3.0 Security Software Tutorials

Top Ten Do's and Dont's of HijackThis for Helpers

4.0 Prevention

How do I prevent Browser Hijacks and Spyware?

Beware Fake Codecs - it could be a trojan

5.0 Additional Resources

Single File Detection Sites

Where can I find additional resources?

When should I reformat? How should I reinstall?

6.0 Helper Requests Additional Steps

Installing and Using HiJackThis

Rootkit Detection Applications

Kaspersky Rescue Disk

HostsXpert

7.0 Revisions to Mandatory Steps

List of Changes

8.0 [Archived] Obsolete Fixes