urgent help with trojans and worms on Google search

milkybars

SmitFraudFix v2.375
Scan done at 23:01:32.95, 16/11/2008
Run from C:\Documents and Settings\name deleted.PC249391530321\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix
HKLM\SYSTEM\CS3\Services\Tcpip\..\!!7D282106-0D27-4B1F-A0A9-F08886A65504}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix
HKLM\SYSTEM\CS3\Services\Tcpip\..\!!7D282106-0D27-4B1F-A0A9-F08886A65504}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1

milkybars

After resetting the router, I managed to connect to the network. However, everypage I tried to open on my laptop went to the "page can not be displayed" message of doom.

On the advice of a friend, I did the following:
Tools, Internet Options, Connections, LAN settings and unchecked Use Proxy Server for your LAN. Their theory behind this was that my laptop was still using the "tinyproxy" that was the problem in the first place.

I can now access webpages fine. My original problems of partial code and redirecting are not happening.

I still have a few questions though:
Is my laptop cured and safe to go putting in passwords to trusted websites?
What should the "Use proxy server" setting be? Was unchecking it just a quick fix not a long term solution, whereby the original issue is still present somewhere lurking in my laptop?
Have any other settings been altered in the fixing processes that I need to change back?

Cheers for all help, especially the particularly patient Reluctant_Spender.

Reluctant_spender

Glad you are sorted -

To be on the safe side, and I appreciate that this may be considered overkill but I would run Kaspersky online scan and re run an updated version of malwarebytes - hit the update tab within the programme.

If those two come back clean then I am as sure as I can be.

milkybars

Overkill is good, better safe than sorry.

Do you have a link for Kaspersky scan please?

Updated malwarebytes report:


Malwarebytes' Anti-Malware 1.30
Database version: 1404
Windows 5.1.2600 Service Pack 3
17/11/2008 16:51:11
mbam-log-2008-11-17 (16-51-05).txt
Scan type: Full Scan (C:\|D:\|F:\|)
Objects scanned: 170851
Time elapsed: 55 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> No action taken.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\fmark2.dat (Malware.Trace) -> No action taken.

Reluctant_spender

You need to remove the items that malwarebytes find;

I will post the canned speech for malwarebytes to refresh your memory;
Malware Bytes

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.


KASPERSKY;

Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
• After the files have been downloaded on the left side of the page in the Scan section select My Computer
• This will start the program and scan your system.
• The scan will take a while, so be patient and let it run.
• Once the scan is complete, click on View scan report
• Now, click on the Save Report as button.
• Save the file to your desktop.
• Copy and paste that information in your next post.

milkybars

Malwarebytes' Anti-Malware 1.30
Database version: 1404
Windows 5.1.2600 Service Pack 3
17/11/2008 19:28:37
mbam-log-2008-11-17 (19-28-37).txt
Scan type: Quick Scan
Objects scanned: 73813
Time elapsed: 11 minute(s), 18 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Reluctant_spender

That's clean

milkybars

Kapersky still downloading... fingers crosed for the all clear on that scan.

Reluctant_spender

I'm with you on that one

milkybars

Uh-oh... it's not looking good. Scan not finished yet but already showing 2 threat names and 6 infected objects.