[Resolved] Ads popping up in new tabs in my browser

[zachL]

Also, just started the combofix removal processes-- but got warning about the anti-virus that we installed in a earlier step.  Should I turn that all off again?

Thanks,

Zach

[kevinf80]

If you cannot accept the alert, turn off the security. Not had that problem with MSSE before

[zachL]

Hi Kevin,

Ok, all good to Step 4-- updating Java.  The link you have there, doesn't have options for JDK or JRE.  For windows downloads, I get the choice between "Online" and "Offline"

Thanks,

Zach

[kevinf80]

Use offline, should be right one. Thanks for info i`ll have to amend speech

[kevinf80]

No, just run as Combofix /Uninstall

[zachL]

Hi Kevin,

Ok, all good!  Uninstalled CF and did all the steps above, including the CC clean.  Ready to put the final polish on the baby!

Best,

Zach

[kevinf80]

Hiya Zach,

How to install SP3 and Internet Explorer 8 safely, courtesy of PCBruiser

Please go to the following link and download the full installer for SP3: Here

Save the installer to your Desktop.

Do not install it yet

Next, Download IE8 installer from HERE Save it to your Desktop.

Do not install it yet


Next, copy all the text in the code box that follows to Notepad.  Make sure you click on Notepad's Format menu and uncheck Word Wrap first.

Code: [Select]

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\BITS]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\WUAUSERV]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\BITS]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\WUAUSERV]
@="Service"

Save the file to your desktop in a file called safemode.txt.  Next, right click on the file, choose Rename from the context menu, highlight the file's extension, and change the file's extension from txt to reg.  Click anywhere on your desktop.  The file should now be named safemode.reg.  Double click on the file.  You will get a warning, permit the merge, and then you will get a merged message.

Now, boot the system to Safe Mode.  Once you are in Safe Mode, install SP3.

Re-boot into Safemode again and install IE8.

Finally reboot into regular Windows and let's see if things are working now.

If they are, do a Windows Update.  After that completes, reboot, and do Windows Update again, and so on, until there are no more to do, since even the updates have updates and updates of updates.

Next read and implement the suggestions in the following article:
How to Safely Compact, Backup and Defragment your Registry

If this all goes well please do another scan with HJT and save the log file, paste the log into your reply. Also let me know how your system is running.

Kevin

[zachL]

Hi Kevin,

Ok, I guess we're a ways away from the polish....  I'lll do these thing and keep you posted!

Best,

Zach

[zachL]

Hi Kevin,

Having problems with this step --->

Save the file to your desktop in a file called safemode.txt.  Next, right click on the file, choose Rename from the context menu, highlight the file's extension, and change the file's extension from txt to reg.  Click anywhere on your desktop.  The file should now be named safemode.reg.  Double click on the file.  You will get a warning, permit the merge, and then you will get a merged message.

When I right click on the file name and rename it, the name on the desktop appears to be safemode.reg but it is still a .txt file.  So when I hover the cursor over it the icon, I can see that the new name is actually safemode.reg.txt .  How do I remove that final .txt .  It never appeared under icon when I first saved the file (ie-- the file appeared as safemode, rather than safemode.txt).

Thanks,

Zach

[kevinf80]

Hiya Zach,

Just miss that part out and continue with the updates to SP3 and IE8 as instructed. I`m going away on business shortly and will not be until about 3pm on Sunday UK time.

Kevin

[zachL]

Hi Kevin,

I hope you had a good business trip!  I've gone through all the last steps.  The only thing I missed (aside from the safemode.reg start) was in the defrag link, I downloaded and ran ERUNT but it wasn't clear to me if NTREGOPT also ran.  The link seemed to suggest that NTREGOPT was included as part of ERUNT but I didn't see anything happening that indicated if it ran or not.  When ERUNT ran, it was very brief...

I still went ahead and ran HJT.  The log for that is below.  In general, it seems the system is running fine.  The only thing I would say a couple of times I noticed it taking a little bit longer than usual to start firefox and then once I when I quit firefox and tried to restart it, I got an error message saying that firefox was already running and I needed to close it first, but there were no tabs or windows open with firefox.  That was before the last steps of defrag, etc... so I don't know if that solved that all yet...

Thanks again, best,

Zach

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:41:56 PM, on 10/31/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
C:\Program Files\eFax Messenger 4.0\J2GTray.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Iomega Drive Icons] "C:\Program Files\Iomega\DriveIcons\ImgIcon.exe"
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\System32\igfxtray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\System32\hkcmd.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Deskup] "C:\Program Files\Iomega\DriveIcons\deskup.exe" /IMGSTART
O4 - HKLM\..\Run: [Ask and Record FLV Service] "C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [ADUserMon] "C:\Program Files\Iomega\AutoDisk\ADUserMon.exe"
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v44/scrabblecubes/scrabblecubes.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 7939 bytes

[kevinf80]

Hiya Zach,

NTREGOPT is a separate d/l from http://www.larshederer.homepage.t-online.de/erunt/ if I recall correctly. Your HJT log looks OK, just one entry to fix, as follows:

Please re-open HiJackThis and scan only.  Check the boxes next to all the entries listed below.

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)

Now close all windows other than HiJackThis, then click Fix Checked.  Close HiJackThis.  Reboot

Your latest logs are clean and you say that your system is running well, it would be an excellent idea to keep it that way. The following advice will go along way to keeping you secure so that you can enjoy safe and happy surfing.

Here are some tips to reduce the potential for malware infection in the future; I strongly recommend  that you read them and take them to heart so that you don't have to endure the process of cleaning your computer again.

Make proper use of your antivirus and firewall

Antivirus and Firewall programs are integral to your computer security. However, just having them installed isn't enough. The definitions of these programs are frequently updated to detect the latest malware, if you don't keep up with these updates then you'll be vulnerable to infection. Many antivirus and firewall programs have automatic update features, make use of those if you can. If your program doesn't, then get in the habit of routinely performing manual updates, because it's important.

You should keep your antivirus and firewall guard enabled at all times, NEVER turn them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your antivirus program is a good idea to make sure you're system remains clean. Once a week should be adequate. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

You will have several programs installed, these maybe outdated and vulnerable to exploits also. To be certain, please run the free online scan by Secunia, available Here   Before clicking the Start scan  button, please check the box for the option Enable thorough system inspection. Just below the "Scan Options:" section, you'll see the status of what's currently processing....
...when the scan completes, the message "Detection completed successfully" will appear in the Programs/Result section. For each problem detected, Secunia will offer a "Solution" option. Please follow those instructions to download updated versions of the programs as recommended by Secunia.


Use a safer web browser

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a few good free alternatives:
 
Firefox,

Opera, and

Chrome.
 
All of these are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial HERE which will help you to make IE MUCH safer.

These browser add-ons will help to make your browser safer:

Web of Trust warns you about risky websites that try to scam visitors, deliver malware or send spam. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous ones:

Available for Firefox and Internet Explorer.

Green to go,
Yellow for caution, and
Red to stop.


Available for Firefox only. NoScript helps to block malicious scripts and in general gives you much better control over what types of things webpages can do to your computer while you're browsing.

These are just a couple of the most popular add-ons, if you're interested in more, take a look at THIS article.

Here a couple of links by two security experts that will give some excellent tips and advice.
So how did I get infected in the first place by Tony Klein
How to prevent Malware by Miekiemoes
Finally this link HERE will give a comprehensive upto date list of free Security programs. To include - Antivirus, Antispyware, Firewall, Antimalware, Online scanners and rescue CD`s.

Please reply so I know you have read this, its been a pleasure to work with you.

Take care,

Kevin

[zachL]

Hi Kevin,

Great, thanks.  I have run the fix on the one item you mentioned in the HJT log.

I've read over the other material you linked to and if it's allright had some questions---

This may be too basic or long to answer easily, but I wondered if you could give me a brief understanding of the difference between virus and spyware protection and the two do or don't interact or replicate eachother?

From our work together, we installed Microsoft Security Essentials.  Is that enough protection?  Do I need something else as well?

Also, we had turned off Windows Defender?  Do I want to turn that back on?  Or does that interfere with proper running of Security Essentials.

Right now, when I go to Security Center tab in the control panel, it comes up with green checkmarks for Virus Protection, Auto-updates, and Firewall, though I'm not sure I understand that firewall is different from the Windows Defender firewall (which I think must be turned off if the whole program of Windows Defender is turned off)

Also, just to confirm-- the programs I still have on the computer from our session are:

CCleaner
ERUNT
NTREGOPT
HJT
Security Check

Thanks again for all your hard work and help with this.  It is really great to know that there are sites (and people!) out there that can help with these things!

Many thanks again,

Zach

[kevinf80]

Hiya Zach,

You can uninstall HJT from Add/Remove Programs, Security Check can be deleted by dragging to the recycle bin or right click and select delete. Keep CCleaner, ERUNT & NTREGOPT and use as instructed.

Microsoft Security Essentials is a combination package that wraps antivirus and antispyware engines, rootkit and Trojan protection with real-time detection, This combined with the Windows Firewall is a formidable security system. As MSSE has the Defender definitions included you can uninstall Windows Defender. The Firewall is a separate entity.

Regarding your other question about antivirus/antispyware programs, have a read Here for an easy to understand explanation.

One other program I recommend you install is Malwarebytes, I personally use the paid for version, this gives realtime protection and runs well with MSSE, there is a free version but this does not afford realtime protection. It can still be used as a stand alone scanner, A quick scan is all that is required always remember to update first. Available Here The paid for version costs $24.95 for a lifetime subscription, this is real value for money.

Dont forget the best form of defense is common sense,

If you have no other issues is it OK to close out this thread,

Kevin.

[zachL]

Thanks and all good to close out thread, Kevin.  I wish you all the best as you head off onto your next case.  It's a nasty web out there, and we all owe you a debt of gratitude for being to willing to take your gloves off and wade deep into it.  Your work makes this whole wide community feel a little smaller and a lot safer.  Thank you again-- and keep giving 'em buggers hell!