Browser redirect and search redirect

[deltalima]

Hi arpigeo,

Everything seems to be running fine

Great!

I wonder about the Kaspsky Scan results....could the scan be wrong about them?

Let's check,

Upload a File to Virustotal

Please go to Virustotal

Copy/paste this file and path into the white box at the top:

C:\Program Files\VstPlugins\Dualism Demo\CK_LINE_DROP.SEP

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

[arpigeo]

Here's what it came up with


File CK_LINE_DROP.SEP received on 2010.07.02 18:05:06 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 1/41 (2.44%)
Loading server information...
Your file is queued in position: 22.
Estimated start time is between 3 and 5 minutes.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 5.0.0.31 2010.07.02 -
AhnLab-V3 2010.07.02.04 2010.07.02 -
AntiVir 8.2.4.2 2010.07.02 -
Antiy-AVL 2.0.3.7 2010.07.02 -
Authentium 5.2.0.5 2010.07.02 -
Avast 4.8.1351.0 2010.07.02 -
Avast5 5.0.332.0 2010.07.02 -
AVG 9.0.0.836 2010.07.02 -
BitDefender 7.2 2010.07.02 -
CAT-QuickHeal 11.00 2010.06.30 -
ClamAV 0.96.0.3-git 2010.07.02 -
Comodo 5291 2010.07.02 -
DrWeb 5.0.2.03300 2010.07.02 -
eSafe 7.0.17.0 2010.06.30 -
eTrust-Vet 36.1.7681 2010.07.02 -
F-Prot 4.6.1.107 2010.07.02 -
F-Secure 9.0.15370.0 2010.07.02 -
Fortinet 4.1.133.0 2010.07.02 -
GData 21 2010.07.02 -
Ikarus T3.1.1.84.0 2010.07.02 -
Jiangmin 13.0.900 2010.07.01 -
Kaspersky 7.0.0.125 2010.07.02 Trojan-PSW.Win32.QQPass.utp
McAfee 5.400.0.1158 2010.07.02 -
McAfee-GW-Edition 2010.1 2010.07.02 -
Microsoft 1.5902 2010.07.02 -
NOD32 5246 2010.07.02 -
Norman 6.05.10 2010.07.02 -
nProtect 2010-07-02.01 2010.07.02 -
Panda 10.0.2.7 2010.07.02 -
PCTools 7.0.3.5 2010.07.02 -
Prevx 3.0 2010.07.02 -
Rising 22.54.04.04 2010.07.02 -
Sophos 4.54.0 2010.07.02 -
Sunbelt 6536 2010.07.02 -
Symantec 20101.1.0.89 2010.07.02 -
TheHacker 6.5.2.1.307 2010.07.01 -
TrendMicro 9.120.0.1004 2010.07.02 -
TrendMicro-HouseCall 9.120.0.1004 2010.07.02 -
VBA32 3.12.12.5 2010.07.02 -
ViRobot 2010.6.29.3912 2010.07.02 -
VirusBuster 5.0.27.0 2010.07.02 -
Additional information
File size: 57344 bytes
MD5...: 4561fdbcc60e7fb2afa9e15bc035ec87
SHA1..: d63d845b443a7d985130084e027394030d620ccf
SHA256: 5576aa9f7fcd0d0457064617301ae0092078a1e9f6e174705776c889b0f2cf54
ssdeep: 1536:biRDhF3RvebS1T8SR5sIteqsgNvmwS5JadtTqGFGMG8:biR3RSQNshymxJu
X3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x43cb209c (Mon Jan 16 04:27:08 2006)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xa000 0x9200 6.51 ae70a86b980e4160f9bf9f97517f3b48
.data 0xb000 0x4000 0x3200 4.86 c2e5fd7c126cc9c576b07cc3e87cf50e
.tls 0xf000 0x1000 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.idata 0x10000 0x1000 0x600 3.79 59ca400b1cbda4a362a637e71847f3dd
.edata 0x11000 0x1000 0x200 1.43 50e71ddef03202dd82d3d27d65d8c2fe
.rsrc 0x12000 0x1000 0x200 0.92 a956e472e114828bc49866c7d068797e
.reloc 0x13000 0x1000 0xa00 6.60 614f09d0008f6951ea4c30681be43349

( 2 imports )
> KERNEL32.DLL: CloseHandle, CreateFileA, ExitProcess, FreeEnvironmentStringsA, GetACP, GetCPInfo, GetCurrentThreadId, GetEnvironmentStrings, GetFileType, GetLastError, GetLocalTime, GetModuleFileNameA, GetModuleHandleA, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, GetStringTypeW, GetVersion, GetVersionExA, GlobalMemoryStatus, HeapAlloc, HeapFree, LoadLibraryA, RaiseException, RtlUnwind, SetConsoleCtrlHandler, SetFilePointer, SetHandleCount, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, WriteFile
> USER32.DLL: EnumThreadWindows, MessageBoxA, wsprintfA

( 3 exports )
___CPPdebugHook, getModuleProperties, makeModule
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Dynamic Link Library - Borland C/C++ (91.6%)
Win32 Executable Generic (3.5%)
Win32 Dynamic Link Library (generic) (3.1%)
Generic Win/DOS Executable (0.8%)
DOS Executable Generic (0.8%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

[deltalima]

Hi arpigeo,

Result: 1/41

You were right, it's a false positive so not a problem.

You are well behind on some of your updates.

You have Internet Explorer version 6 and XP SP2, these URGENTLY need to be updated to IE8 and XP SP3 as they are no longer supported by Microsoft.

Please visit the Microsoft Update site and install all updates, keep doing so until everything is up to date.

You should Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 9.3 are vulnerable.

• Go HERE, UNCHECK any Free Add-Ons, and click Download to install the latest version of Adobe Acrobat Reader.
• After it completes the Installation, close the Download Manager.

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 20.

• Download the latest version of Java Runtime Environment (JRE) 6 Here
• Scroll down to where it says "JDK 6 Update 20 (JDK or JRE)"
• Click the orange Download JRE button to the right
• Select the Windows platform from the dropdown menu
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
• Click on the link to download Windows Offline Installation & save the file to your desktop
• Close any programs you may have running - especially your web browser
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions
• Reboot your computer once all Java components are removed
• Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version

Please let me know when complete and I will give you instructions to clean up the tools we have used and keep your computer more secure in the future.

[arpigeo]

Ok ...I'll take care of this today and get back with you ....One question.....I'm using Firefox as a browser ...is it necessary to update IE 6 or would I be better to uninstall?

[deltalima]

I would update IE6 to IE8, just let Microsoft Update update everything.

[arpigeo]

Sorry to be long in my reply ......I've got everything updated as you requested

[deltalima]

Hi arpigeo,

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure

Remove GMER

Delete the GMER icon from your desktop, it will be named 6046ii0v.exe


Clean up with OTL

• Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Create a new, clean System Restore point which you can use in case of future system problems:

• Press Start >> All Programs >> Accessories >>System Tools >> System Restore
• Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
• Now remove old, infected System Restore points:
• Next click Start >> Run and type cleanmgr in the box and press OK
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
• Press OK and Yes to confirm

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.[/list]Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!

[arpigeo]

Many , Many thanks Deltalima . Can't express how appreciated your selfless help is.I'll definitely be making a donation to express my appreciation for all the assistance that this site and all the fine people that are involved in it provide . Sure wish you a happy future and all good karma ahead .
take care
arpigeo

[arpigeo]

One last thing ......
Was this supposed to be a link as well ....
[/list]Follow this list and your potential for being infected again will reduce dramatically. .....it doesn't appear in the message if so .....
thanks
arpigeo

[deltalima]

Hi arpigeo,

Was this supposed to be a link as well ....
[/list]Follow this list and your potential for being infected

Sorry, my mistake with formatting, The list should not have been there.

Many , Many thanks Deltalima . Can't express how appreciated your selfless help

You're most welcome! Glad we could help.

[jmw3]

As your problems appear to have been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.