IE Redirected and Action Canceled?

[PopaTom]

Hi Cypher,
I ran both of the program scans that you requested. The first one "JOTTI" did not find any problems. The second one "VIRUSTOTAL" I have pasted the results here. Thank You.

My laptop seems to be working a lot better. Doesnt appear to be redirecting or giving me "action cancelled" mgs. It also seems to be working faster. Thank You so much. I will check back for further instructions.

PS: I think I have lost the mgs at shut down also:) "AND" Please thank everyone and anyone who has helped me!
C U Later, PopaTom
-------------------------------------------------------------------------------------

File 1235700.dll received on 2009.12.09 22:56:18 (UTC)
Current status: finished

Result: 1/41 (2.44%)
Compact Print results
Antivirus Version Last Update Result
a-squared 4.5.0.43 2009.12.09 -
AhnLab-V3 5.0.0.2 2009.12.09 -
AntiVir 7.9.1.102 2009.12.09 -
Antiy-AVL 2.0.3.7 2009.12.09 -
Authentium 5.2.0.5 2009.12.02 -
Avast 4.8.1351.0 2009.12.09 -
AVG 8.5.0.426 2009.12.09 -
BitDefender 7.2 2009.12.09 -
CAT-QuickHeal 10.00 2009.12.09 -
ClamAV 0.94.1 2009.12.09 -
Comodo 3103 2009.12.01 -
DrWeb 5.0.0.12182 2009.12.09 -
eSafe 7.0.17.0 2009.12.09 -
eTrust-Vet 35.1.7167 2009.12.09 -
F-Prot 4.5.1.85 2009.12.09 -
F-Secure 9.0.15370.0 2009.12.07 -
Fortinet 4.0.14.0 2009.12.09 -
GData 19 2009.12.09 -
Ikarus T3.1.1.74.0 2009.12.09 -
Jiangmin 13.0.900 2009.12.02 -
K7AntiVirus 7.10.916 2009.12.09 -
Kaspersky 7.0.0.125 2009.12.09 -
McAfee 5827 2009.12.09 -
McAfee+Artemis 5827 2009.12.09 -
McAfee-GW-Edition 6.8.5 2009.12.09 -
Microsoft 1.5302 2009.12.09 -
NOD32 4674 2009.12.09 -
Norman 6.03.02 2009.12.09 -
nProtect 2009.1.8.0 2009.12.09 -
Panda 10.0.2.2 2009.12.09 -
PCTools 7.0.3.5 2009.12.09 -
Prevx 3.0 2009.12.09 -
Rising 22.25.02.09 2009.12.09 -
Sophos 4.48.0 2009.12.09 -
Sunbelt 3.2.1858.2 2009.12.09 WebWatcher
Symantec 1.4.4.12 2009.12.09 -
TheHacker 6.5.0.2.088 2009.12.07 -
TrendMicro 9.100.0.1001 2009.12.09 -
VBA32 3.12.12.0 2009.12.08 -
ViRobot 2009.12.9.2078 2009.12.09 -
VirusBuster 5.0.21.0 2009.12.09 -
Additional information
File size: 2150939 bytes
MD5 : bc31abf53b86255bee601ed9a7b4746b
SHA1 : d837bd0f6b11c66e26c2378978ab1f50c87ccfb0
SHA256: 85862288290f5dc270c4378a8f314b969849daeffa57adf6ac27cce14c60c019
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xFF9D2
timedatestamp.....: 0x4A946874 (Wed Aug 26 00:40:52 2009)
machinetype.......: 0x14C (Intel I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x120F7B 0x121000 6.71 de9a9e01c1f8c63f80b28ca85a719ad4
.rdata 0x122000 0xC9DDF 0xCA000 5.55 67e398a217e2669ff495b38dd026a992
.data 0x1EC000 0xE39C 0xC000 4.77 3a86b9de2e0dc6600dea1745902bd356
.SSSHARE 0x1FB000 0x15 0x1000 0.01 b7e855e14bec14e637d85f5e6e30ad6b
.rsrc 0x1FC000 0x958 0x1000 4.22 6d192cd61583dc8c34392b7613d81b26
.reloc 0x1FD000 0xF582 0x10000 5.45 54c914682900635acd7cd208cccf40a1

( 12 imports )

> advapi32.dll: GetSecurityDescriptorSacl, CryptDeriveKey, CryptDecrypt, CryptEncrypt, CryptDestroyKey, CryptAcquireContextW, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptReleaseContext, RegGetKeySecurity, RegOpenKeyW, RegSetKeySecurity, RegQueryValueExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, SetSecurityDescriptorSacl, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, LookupAccountNameW, ConvertSidToStringSidW, RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW
> gdi32.dll: CreateCompatibleBitmap, SelectObject, BitBlt, GetObjectW, GetDIBits, DeleteDC, DeleteObject, CreateCompatibleDC
> kernel32.dll: LocalFree, GetComputerNameW, HeapFree, GetProcessHeap, GetTickCount, WaitForSingleObject, CreateEventW, HeapAlloc, lstrcmpW, lstrlenA, GetProcAddress, LoadLibraryW, DeleteFileW, GetTempPathW, VirtualProtect, lstrcpynW, lstrcpyW, WaitForMultipleObjects, TerminateThread, Sleep, SetEndOfFile, WriteFile, SetFilePointer, GetFileAttributesExW, GetFileTime, CreateFileW, ReadFile, GetFileSize, GetTempFileNameW, lstrcatW, GetExitCodeThread, GetCurrentProcessId, CompareFileTime, MoveFileW, GetACP, IsValidCodePage, HeapSize, HeapReAlloc, ReleaseMutex, ReleaseSemaphore, InterlockedExchangeAdd, UnmapViewOfFile, MapViewOfFile, GetTimeZoneInformation, FileTimeToLocalFileTime, OpenEventW, GlobalFree, GlobalReAlloc, GlobalUnlock, GlobalLock, CreateSemaphoreW, CreateMutexW, GetCurrentProcess, CreateFileA, CreateFileMappingW, ProcessIdToSessionId, OpenFileMappingW, FindClose, FindNextFileA, FindFirstFileA, lstrcpynA, CreateMutexA, GetCurrentThreadId, CreateDirectoryW, GlobalSize, GetSystemTime, GetSystemTimeAsFileTime, GetStringTypeA, FlushFileBuffers, GetConsoleMode, GetConsoleCP, SetStdHandle, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, SetHandleCount, GetOEMCP, SetLastError, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetStdHandle, HeapCreate, VirtualAlloc, VirtualFree, SetEvent, CloseHandle, FindResourceExW, LockResource, WideCharToMultiByte, GetThreadLocale, SetThreadLocale, LoadLibraryExW, GetModuleHandleW, FindResourceW, LoadResource, SizeofResource, MultiByteToWideChar, FreeLibrary, InterlockedDecrement, InterlockedIncrement, InitializeCriticalSectionAndSpinCount, DisableThreadLibraryCalls, GetModuleFileNameW, lstrcmpiW, GetLastError, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, RaiseException, lstrlenW, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CompareStringA, CompareStringW, SetEnvironmentVariableA, GlobalAlloc, FileTimeToSystemTime, ExitProcess, GetModuleHandleA, GetCPInfo, LCMapStringW, LCMapStringA, GetCommandLineA, CreateThread, ExitThread, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, RtlUnwind, QueryPerformanceFrequency, QueryPerformanceCounter, GetCurrentDirectoryA, GetModuleFileNameA, SetCurrentDirectoryA, LoadLibraryA, HeapDestroy, GetVersionExA, GetLocaleInfoA, InterlockedExchange
> netapi32.dll: NetApiBufferFree, NetWkstaUserEnum
> nspr4.dll: PR_AtomicIncrement, PR_AtomicDecrement
> ole32.dll: GetHGlobalFromStream, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, StringFromGUID2, CoCreateInstance, OleRun, CoUninitialize, CreateStreamOnHGlobal, CoInitializeEx
> oleaut32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> rpcrt4.dll: UuidCreate
> shlwapi.dll: PathAppendW, PathFileExistsW, SHCreateStreamOnFileW, StrStrIA, StrStrIW, PathRemoveFileSpecW
> user32.dll: CharNextW, CharLowerW, CharLowerBuffW, CharLowerA, MsgWaitForMultipleObjects, GetDesktopWindow, GetParent, UnregisterClassA, MessageBoxW, IsWindow, ReleaseDC, GetWindowDC, GetSystemMetrics, GetWindowRect, GetForegroundWindow, RegisterWindowMessageW, SendMessageTimeoutW, GetClassNameW
> wtsapi32.dll: WTSFreeMemory, WTSQuerySessionInformationW, WTSOpenServerW, WTSCloseServer
> xpcom.dll: NS_StringGetData, NS_GetComponentManager, NS_GetServiceManager, NS_NewNativeLocalFile, NS_CStringContainerFinish, NS_CStringContainerInit, NS_StringContainerFinish, NS_StringContainerInit2, NS_StringContainerInit, NS_CStringSetData, NS_CStringCopy, NS_CStringGetData, NS_StringCopy, NS_Alloc, NS_Free

( 1 exports )

> DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, NSGetModule
TrID : File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
ssdeep: 24576:6jPTNgA3MeeyDvWEKgVkmjew2e9oLJHv7fCpaepbFNAmTMy8N87TjMqP3KL:6fyA3tTKgVSfLJHzKpa0bFNAgTYZL
PEiD : -
RDS : NSRL Reference Data Set

[Cypher]

Hi PopaTom.

Please thank everyone and anyone who has helped me!

Your most welcome
Things are looking good so far good work


I see you have CCleaner installed please run it now.
CAUTION: Please do NOT use the "Registry" button in the left pane.
This is a built-in registry cleaner. Removing certain entries can render your computer inoperable!

Next.

Please Temporarily Disable your Anti-virus so it will not interfere with the below scan.
Note: Don't forget to re-enable again afterwards.

Next.

ESET online scannner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• Please go Here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

In your next reply.

• ESET log.
• Please give me an update on your computers performance.

[PopaTom]

Hi Cypher,
I wish I had some good news BUT when I downloaded "ESET" I made sure the box was unchecked that said `remove found threats` but couldnt locate "Advanced Settings" therefore I couldn`t check the option Scan archives. I`m not sure if I simply overlooked it or it wasn`t there. Also when ESEST had finished the scan I couldn`t locate the "log.txt" file to send you. Should I remove and reload ESET? Thank

Hi Again Cypher:

I went ahead and went thru your instructions again and reran ESET. I found out where I had messed up. My fingers must have been working faster than my brain,: "DUH" Anyway, here is the log file you asked for, I think.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=7.00.6000.16915 (vista_gdr.090826-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=f939c6cc28de3448ab97bfca78613b96
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-12-11 01:09:38
# local_time=2009-12-10 06:09:38 (-0700, US Mountain Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 1140402 1140402 0 0
# compatibility_mode=2561 16776869 100 85 0 26114984 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=26165
# found=0
# cleaned=0
# scan_time=2817
esets_scanner_update returned -1 esets_gle=53251
# version=7
# IEXPLORE.EXE=7.00.6000.16915 (vista_gdr.090826-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=f939c6cc28de3448ab97bfca78613b96
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-12-11 02:44:11
# local_time=2009-12-10 07:44:11 (-0700, US Mountain Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 1146033 1146033 0 0
# compatibility_mode=2561 16776869 100 85 0 26120615 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=26226
# found=0
# cleaned=0
# scan_time=2858


OOOPS: I think both log files are posted from both scans " By the way" I have an older Desktop that I would love to ?Service? for lack of a better word. And also a newer Laptop that is completely disabled as far as connecting to the browser and to anything connected to the net. If you would be interested.............?

[Cypher]

Hi PopaTom.

I have an older Desktop that I would love to ?Service?

You will have to start a new topic in the malware forum for each of your computers and wait for a new helper.
When this topic is completetd it will be closed.

your latest set of logs appear to be clean!

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Clean up with OTM

• Double-click OTM.exe to start the program, This tool will remove all the tools we used to clean your pc.
• Close all other programs apart from OTMoveIt3 as this step will require a reboot
• On the OTM main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Next.

• Create a new, clean System Restore point which you can use in case of future system problems:
• Press Start >> All Programs >> Accessories >>System Tools >> System Restore
• Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
• Now remove old, infected System Restore points:
• Next click Start >> Run and type cleanmgr in the box and press OK
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
• Press OK and Yes to confirm

Next.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.


Next

Install internet explorer 8

You can find information and install IE 8 from Here


Next.

Update your service pack to XPSP3

You can find information on how to update to XPSP3 Here



Here are some free programs I recommend that could help you improve your computer's security.

Install Malwarebytes Anti-malware
These are anti-malware applications that can thoroughly remove even the most advanced malware. They include a number of features, including a built in protection monitor that blocks malicious processes before they even start.
You can find information and Download it from HERE

Install Sitehound
SiteHound is a toolbar for Microsoft Internet Explorer and Mozilla Firefox which alerts you if you're about to enter a potentially dangerous website.
You can find more information and download it from Here

Install WinPatrol
As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
For more information, please visit HERE

MVPS Hosts

Install MVPS Hosts File From Here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
You can Find the Tutorial HERE

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer
You can do that HERE

Read some information HERE On how to prevent Malware

Is your pc running slow?
Read What to do if your Computer is running slowly

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!

[PopaTom]

Hello Cypher, Everything was going along perfectly untill after I used OTM to clean up. After Otm was finished I clicked on IE and got this msg:

Error Msg:
"CTF loader has encountered a problem and needs to close. We are sorry for the inconvenience."

I reported it, as instructed, to Microsoft but haven`t heard back from them yet. What should I do.

Everything else is working find and the PC is faster than a speeding bullet:)

Should I go ahead with the restore point?
---------------------------------------------------------------------------

Hi Again Cypher,
This morning there is no sign of the msg (CTF Loader).
I guess simply shutting down and restarting got rid of it.
I am going ahead with the instructions you posted in your last msg.
Thank you and your partners at MRU for all that you have done in assisting me in restoring my computer to "LIKE NEW" condition.
I am looking forward to working with you all again in restoring my Desktop and in restoring my other Laptop.
I have worked with local techs through out the years that I have owned PC`s and never have I felt the level of satisfaction that I am feeling now!
I will be sending a donation to help MRU remain on line to help others as you have helped me.
Thank You, Thank You, Thank You, PopaTom


Thanks, PopaTom

[Cypher]

Hi PopaTom.

That error can be caused by a number of things.
In this case it my be due to your use of Registry Cleaners in the past.
Please continue with the instructions below.

OTC

Download OTC by Old Timer and save it to your Desktop.

• Double-click OTC.exe
• Click the CleanUp! button
• Select Yes when the Begin cleanup Process? Prompt appears
• If you are prompted to Reboot during the cleanup, select Yes
• The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

Next.

• Create a new, clean System Restore point which you can use in case of future system problems:
• Press Start >> All Programs >> Accessories >>System Tools >> System Restore
• Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
• Now remove old, infected System Restore points:
• Next click Start >> Run and type cleanmgr in the box and press OK
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
• Press OK and Yes to confirm

Next.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Next

Install internet explorer 8

You can find information and install IE 8 from Here


Next.

Update your service pack to XPSP3

You can find information on how to update to XPSP3 Here

Here are some free programs I recommend that could help you improve your computer's security.

Install Malwarebytes Anti-malware
These are anti-malware applications that can thoroughly remove even the most advanced malware. They include a number of features, including a built in protection monitor that blocks malicious processes before they even start.
You can find information and Download it from HERE

Install Sitehound
SiteHound is a toolbar for Microsoft Internet Explorer and Mozilla Firefox which alerts you if you're about to enter a potentially dangerous website.
You can find more information and download it from Here

Install WinPatrol
As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
For more information, please visit HERE

MVPS Hosts

Install MVPS Hosts File From Here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
You can Find the Tutorial HERE

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer
You can do that HERE

Read some information HERE On how to prevent Malware

Is your pc running slow?
Read What to do if your Computer is running slowly

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

[PopaTom]

Hi Cypher, All done!!!!
I love you,Man.
Thanks

[Cypher]

Hi PopaTom.
Your most welcome
I will ask for this topic to be closed, good luck.

[Dakeyras]

As it appears this issue has been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.