Malware Removal Forums

Problems caused by someone pharming on my computer.

LB1 · 2011-04-12T18:22:03+00:00

I have a problem whereby when I log on to online banking I get redirected to a false login page. I only realised this as it asked for my whole password not just 3 digits. I found a trojan on the computer and have got rid of this however the problem is still the same when attempting to log on to my bank. I have run HiJackThis in safe mode as it wouldn't let me save the log in normal mode. Here it is...any suggestions to help solve this will be gratefully welcomed! Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 19:12:56, on 12/04/2011 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.19019) Boot mode: Safe mode Running processes: C:\Windows\Explorer.EXE C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.philips.com/pc R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Int

39 min read

LB1

April 15, 2011, 8:49 AM UTC

File name:
stdnet_updater.exe
Submission date:
2011-04-15 08:39:50 (UTC)
Current status:
finished
Result:
1/ 38 (2.6%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.04.15.00 2011.04.15 -
AntiVir 7.11.6.133 2011.04.15 -
Antiy-AVL 2.0.3.7 2011.04.15 -
Avast 4.8.1351.0 2011.04.14 -
Avast5 5.0.677.0 2011.04.14 -
BitDefender 7.2 2011.04.15 -
CAT-QuickHeal 11.00 2011.04.15 -
ClamAV 0.97.0.0 2011.04.15 -
Commtouch 5.2.11.5 2011.04.15 -
Comodo 8349 2011.04.15 -
DrWeb 5.0.2.03300 2011.04.15 -
Emsisoft 5.1.0.5 2011.04.15 -
eSafe 7.0.17.0 2011.04.13 -
eTrust-Vet 36.1.8272 2011.04.14 -
F-Prot 4.6.2.117 2011.04.14 -
F-Secure 9.0.16440.0 2011.04.15 -
Fortinet 4.2.257.0 2011.04.15 -
GData 22 2011.04.15 -
Ikarus T3.1.1.103.0 2011.04.15 -
Jiangmin 13.0.900 2011.04.15 -
K7AntiVirus 9.96.4382 2011.04.13 -
Kaspersky 7.0.0.125 2011.04.15 -
Microsoft 1.6702 2011.04.15 -
NOD32 6042 2011.04.15 probably a variant of Win32/StartPage.LWOOMNQ
Norman 6.07.07 2011.04.15 -
Panda 10.0.3.5 2011.04.14 -
PCTools 7.0.3.5 2011.04.15 -
Prevx 3.0 2011.04.15 -
Rising 23.53.03.06 2011.04.14 -
Sophos 4.64.0 2011.04.15 -
SUPERAntiSpyware 4.40.0.1006 2011.04.14 -
Symantec 20101.3.2.89 2011.04.15 -
TheHacker 6.7.0.1.173 2011.04.13 -
TrendMicro 9.200.0.1012 2011.04.15 -
TrendMicro-HouseCall 9.200.0.1012 2011.04.15 -
VIPRE 9017 2011.04.15 -
ViRobot 2011.4.15.4411 2011.04.15 -
VirusBuster 13.6.305.0 2011.04.14 -
Additional information
MD5 : 6fcc662dad6bfa5e6b4608d23a85799b
SHA1 : 1ed5b1f7351b77907f06c6c75f24b8d8b41601d0
SHA256: 38b9d233434c1818da5a366554f23b823769c54587b8e5db3b54b017e226e717

VT Community

LB1

April 15, 2011, 8:55 AM UTC

File name:
acssetup.exe
Submission date:
2011-04-15 08:47:11 (UTC)
Current status:
finished
Result:
1/ 38 (2.6%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.04.15.00 2011.04.15 -
AntiVir 7.11.6.133 2011.04.15 -
Antiy-AVL 2.0.3.7 2011.04.15 -
Avast 4.8.1351.0 2011.04.14 -
Avast5 5.0.677.0 2011.04.14 -
BitDefender 7.2 2011.04.15 -
CAT-QuickHeal 11.00 2011.04.15 -
ClamAV 0.97.0.0 2011.04.15 -
Commtouch 5.2.11.5 2011.04.15 -
Comodo 8349 2011.04.15 -
DrWeb 5.0.2.03300 2011.04.15 -
Emsisoft 5.1.0.5 2011.04.15 -
eSafe 7.0.17.0 2011.04.13 -
eTrust-Vet 36.1.8272 2011.04.14 -
F-Prot 4.6.2.117 2011.04.14 -
F-Secure 9.0.16440.0 2011.04.15 -
Fortinet 4.2.257.0 2011.04.15 -
GData 22 2011.04.15 -
Ikarus T3.1.1.103.0 2011.04.15 -
Jiangmin 13.0.900 2011.04.15 -
K7AntiVirus 9.96.4382 2011.04.13 -
Kaspersky 7.0.0.125 2011.04.15 -
Microsoft 1.6702 2011.04.15 -
NOD32 6042 2011.04.15 probably a variant of Win32/StartPage.LWOOMNQ
Norman 6.07.07 2011.04.15 -
Panda 10.0.3.5 2011.04.14 -
PCTools 7.0.3.5 2011.04.15 -
Prevx 3.0 2011.04.15 -
Rising 23.53.03.06 2011.04.14 -
Sophos 4.64.0 2011.04.15 -
SUPERAntiSpyware 4.40.0.1006 2011.04.14 -
Symantec 20101.3.2.89 2011.04.15 -
TheHacker 6.7.0.1.173 2011.04.13 -
TrendMicro 9.200.0.1012 2011.04.15 -
TrendMicro-HouseCall 9.200.0.1012 2011.04.15 -
VIPRE 9017 2011.04.15 -
ViRobot 2011.4.15.4411 2011.04.15 -
VirusBuster 13.6.305.0 2011.04.14 -
Additional information
MD5 : 9f4cd1a1c6d50dec9415a095520a7ad5
SHA1 : 1b3e2ba99ad892ffde84b94819a2bbbaed65b7dc
SHA256: 2cf0579879ff3e3dcfba1dd5e08ac2b8bf0c33aff814077325cd331880a789ae

LB1

April 15, 2011, 8:55 AM UTC

Online banking is back to its normal self.

deltalima

April 15, 2011, 9:25 AM UTC

Hi LB1,

Online banking is back to its normal self.

Good, the two files scanned would seem to be a false positive, so delete them only if you have no need for them.

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

Remove GMER

Delete the GMER icon from your desktop.

Clean up with OTL

Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CleanUp! button
Say Yes to the prompt and then allow the program to reboot your computer.

Create a new, clean System Restore point which you can use in case of future system problems:

Press Start >> All Programs >> Accessories >>System Tools >> System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
Now remove old, infected System Restore points:
Next click Start >> Run and type cleanmgr in the box and press OK
Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
Press OK and Yes to confirm

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software