Firefox Crashing and &#34;Perfect Defender 2009 Popup&#34;

http://fpdownload2.macromedia.com/get/s ... wflash.cab

2.Info

Sharagoz Retired Graduate

January 6, 2009, 7:59 PM UTC

You still have an infection somewhere on your computer that is bringing new malware to your computer.
Be sure to let me know if you see anything out of the ordinary when you're using your computer as it may help us towards finding the source of this.
The source may be infected Mp3's. Do you notice anything strange when running some of your mp3's (if you have any)? Any popups requesting the installation of codecs for instance?

1) Create and run a registry script

Press the windows key and the R key at the same time to open the Run dialog box
type notepad and press the enter key

A new notepad document should now open. Copy the content of the code box below into this notepad document

REGEDIT4



[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bcc52f1d-65b7-4908-07a6-3e134502b757}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}]



[-HKEY_CLASSES_ROOT\CLSID\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}]

[-HKEY_CLASSES_ROOT\CLSID\{bcc52f1d-65b7-4908-07a6-3e134502b757}]

[-HKEY_CLASSES_ROOT\CLSID\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}]



[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\\WINDOWS\\system32\\drivers\\svchost.exe"=-

Change the Save as type to All files and then save the file as fix.reg
Right-click on fix.reg and select Merge
Answer Yes at any prompts

2) Delete files
Delete these files:
C:\WINDOWS\system32\cont_adssite-remove.exe
C:\WINDOWS\system32\nsp52.dll
C:\Documents and Settings\Christine\Application Data\Smart-Shopper <-folder
C:\Program Files\Smart-Shopper <-folder

3) Remove uninstall entry with HJT

Launch HiJackThis and click Open the Misc Tools section
Click Open Uninstall Manager
Select the below program:
Contextual Tool Adssite
Click Delete this entry to have it removed

4) Run CCleaner

Launch CCleaner
Click the Run Cleaner button at the bottom right of the window
Click Yes at the prompt and let the cleaner finish

5) Download and run SUPERAntiSpyware

Download SAS from here (use the link 'from authors site'), and install the program using default settings
When prompted about installing updates, click Yes
You can skip email registration and homepage protection
The program should auto-start after the installation. If it doesnt, there's will be a shortcut on your desktop that you can use to launch it manually
In the main window click Preferences to launch the configuration window
Under the General and Startup tab uncheck Start SUPERAntiSpyware when windows starts
Under the Scanning Control tab, uncheck everything except:
o Ignore System Restore/Volume Information on ME/XP
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining
o Scan alternate data streams
Click the Close button and return to the main window
Click the Scan your Computer button
Select Perform complete scan, make sure the necessary drives are selected, and click the Next button
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK
Make sure everything has a checkmark next to it and click Next
A notification will appear saying Quarantine and Removal is Complete.
(if you are prompted about rebooting the machine to finish the removal, let SAS do so)
Now we need to retrieve the log
In the main window, Click Preferences, then click the Statistics/Logs tab
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log
If there are several logs, click the current dated log and press View log. A text file will open in your default text editor
Include this log in your next post

6) Run Kaspersky online scanner
With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
Note:
This is a very thorough scan that takes longer than most other scanners to complete. It will often take 2-6 hrs depending on the number of files on your computer and how powerfull the computer is.
It is recommended to disable onboard antivirus program and antispyware programs while performing the scan to speed up scan time and to make sure there are no conflicts.
If you disable your resident protection, do not go surfing until its enabled again. Its a good idea to simply disconnect the computer from the internet after the scan has started and not connect again until the scan is finished and the resident protection is enabled again.
Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.

Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database:
+ Extended (If available, otherwise use standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
Click OK
Under select a target to scan, select My Computer
The scan will take a while so be patient and let it run.
Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
Click the Save Report As...
In the Save as... prompt, select Desktop
In the File name box, name the file KasScan-ddmmyy (or similar)
In the Save as type prompt, select Text file
Include the report in your next post.

Enable antivirus and antispyware programs if you disabled them before the scan.

7) Get new RSIT log

Delete this folder: C:\rsit
Double click on RSIT.exe (on your desktop) to run RSIT
Select 3 months and click Continue at the disclaimer screen to start the scanner
Once it has finished, two logs will open:
- log.txt will be opened maximized
- info.txt will be opened minimized
Post the contents of both log.txt and info.txt in your next reply

Logs I need:
SUPERAntiSpyware log
Kaspersky log
RSIT logs

wuchris

January 8, 2009, 4:12 PM UTC

I'm afraid I won't be able to perform these steps until tomorrow. I wanted to give you a heads up. Thanks again for all of your time and help!

Sharagoz Retired Graduate

January 8, 2009, 7:59 PM UTC

No worried, thanks for letting me know

wuchris

January 10, 2009, 6:29 AM UTC

I've completed step1, however, I cannot find C:\WINDOWS\system32\nsp52.dll. Should I continue with the process?

Sharagoz Retired Graduate

January 10, 2009, 7:16 PM UTC

The file has probably been renamed since your last log.
Procede with the rest of the steps and we'll get the file later.

wuchris

January 13, 2009, 3:01 PM UTC

I'm sorry this took me so long!
5.SuperAntiSpyware Log

http://www.superantispyware.com

6.Kapersky Log

7a.RSIT log

http://fpdownload2.macromedia.com/get/s ... wflash.cab

7b.RSIT Info

A quick update on computer status--I've never had anything happen when I play my mp3's--given, I never play them often. Something interesting I've noticed--when I opened firefox a popup titled "Contextual Tools Adsite" came up with some advertisement about home insurance. Also, it seems that this new search engine titled "yoog" has manifested itself in both firefox and internet explorer.

Thank you for your patience and time in this. I really appreciate it.

Sharagoz Retired Graduate

January 14, 2009, 9:19 AM UTC

Thanks for hanging in there without complaining!
It doesnt usually take this much effort to clean a system, but you got a tricky infection here.

1) Upload files to VirusTotal

Go to virustotal.com
Click Browse and copy the filepath from the codebox below into the File name box and click Open
```
C:\WINDOWS\system32\termsrv.dll
```
Click the Send file button to start the scan
When the status changes to finished, click the Compact link
Copy everything from the windows that pops up into your next reply
Repeat the process for this file as well:
```
C:\WINDOWS\system32\winlogon.exe
```

Disable Avast before the next step

2) Download and Run ComboFix

Download ComboFix from here and save it to your desktop
Press the windows key and the R key at the same time to open the Run dialog box
Copy the command from the code box below into the Run box and press Enter to execute it.
```
"%userprofile%\Desktop\ComboFix.exe" /SkipFix
```
This will lauch ComboFix
If you are prompted about installing the recovery consolle answer Yes
When ComboFix has finished scanning, a log will open
Include this log in your next reply

Enable Avast again

3) Get new RSIT log

Delete this folder: C:\rsit
Double click on RSIT.exe (on your desktop) to run RSIT
Click Continue at the disclaimer screen to start the scanner
Once it has finished, two logs will open:
- log.txt will be opened maximized
- info.txt will be opened minimized
Post the contents of both log.txt and info.txt in your next reply

Logs I need:
Two logs from VirusTotal
ComboFix log
Two RSIT logs

wuchris

January 14, 2009, 10:48 PM UTC

Really, thank you. I would NEVER have known I had anything like this on my computer, I'm so blissfully oblivious.

1a.termsrv.dll scan

1b.winlogon.exe scan

2.Combofix Scan

0

hxxp://auburn.edu/

http://www.gmer.net

3a.RSIT LOG

http://fpdownload2.macromedia.com/get/s ... wflash.cab

3b.RSIT INFO

Sharagoz Retired Graduate

January 15, 2009, 9:01 PM UTC

Disable Avast before the next step.

1) Run ComboFix with CFScript

Right-click on your desktop, select New -> Text file
Name the file CFScript.txt

Open CFScript.txt and copy the contents of the code box below into it, save and close



KillAll::



File::

c:\program files\mozilla firefox\components\nsadssite.dll



FCopy::

c:\windows\$NtServicePackUninstall$\termsrv.dll | c:\windows\system32\termsrv.dll

Drag CFScript.txt on top of the ComboFix.exe icon and release
ComboFix will start if you did this correctly
When ComboFix has finished scanning, a log will open
Include this log in your next reply

Enable Avast again

2) Fix bad entry using HiJackThis

Launch HiJackThis
(there should be a shortcut on your desktop, if there isnt, find it here: C:\Program Files\Trend Micro\HijackThis\Christine.exe)
Click the Do a system scan only button
Put a checkmark next to the below line if its still listed

O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll
IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
Click the Fix checked button and close HiJackThis

3) Scan file with VirusTotal

Go to virustotal.com
Click Browse and copy the filepath from the codebox below into the File name box and click Open
```
C:\WINDOWS\system32\termsrv.dll
```
Click the Send file button to start the scan
When the status changes to finished, click the Compact link
Copy everything from the windows that pops up into your next reply

4) Get new RSIT log

Delete this folder: C:\rsit
Double click on RSIT.exe (on your desktop) to run RSIT
Click Continue at the disclaimer screen to start the scanner
Once it has finished, two logs will open:
- log.txt will be opened maximized
- info.txt will be opened minimized
Post the contents of both log.txt and info.txt in your next reply

Logs I need:
ComboFix log
Results from VirusTotal scan
RSIT logs

Sharagoz Retired Graduate

January 19, 2009, 2:34 PM UTC

Hi
It's been a while since your last response.
Are you still with us?

wuchris

January 19, 2009, 3:47 PM UTC

I'm sorry for the delay in response, and thank you so much for bearing with me.

1.Combofix Log

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\$NtServicePackUninstall$\winlogon.exe

0

hxxp://auburn.edu/

hxxp://www1.yoog.com/search.php?q=

hxxp://auburn.edu/

hxxp://www1.yoog.com/search.php?q=

http://www.gmer.net

3.Virustotal Log

4a.RSIT Log