avast hijacked? new virus/varient?

system · 2015-08-22T18:55:29.000Z

Everything is hijacked… running thru a remote machine it seems. running combofix i cant install recovery console. cant connect to most things via https. mbam comes up with nothing as does superantispyware. combofix did fix some things tdsskiller - nothing. I also cleared the nvram on this xp machine i’m using now. my win7 laptop has the same or similar issues (tiny firewall was blocking 67 system connections!), so i havent tried to run it in weeks - i figure cleaning this desktop with xp would be easier since i can pull the cmos battery. I’m in over my head here. in the registry i found HKEY_CLASSES_ROOT.TMCONTAINER00000000000000000001 (and xx-002), while starting to look elsewhere. other “interesting” things caught by PCTools firewall plus: [.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
c:\windows\temp\7zsf.tmp\setup.exe
c:\windows\temp\nsh11.tmp\ns17.tmp
appl pid 4012
firefox - Port Name : \RPC
CONTROL\OLED097DAAB50284A4BBF456DC421A0
Process ID : 4068
Target Application PID : 1404
Target Application Path : C:\WINDOWS\SYSTEM32\SVCHOST.EXE

Connecting Application’s PID : 4068
Local Port : 65535
Protocol : UDP
Remote Port : 53

Application PID : 5368
Event Type : Windows Messaging - Initiate DDE
HWND : 0x10014
LPARAM : 0xc06ec06a
Message : 0x3e0
Target Application PID : 900
Target Application Path : C:\WINDOWS\SYSTEM32\CSRSS.EXE
Thread ID : 944
WPARAM : 0x2005ba
Application Path : c:\documents and settings\mom and
dad\my documents\mozilla firefox\firefox.exe
Event Type : Extended Event Hooking
Hook ID : 7
Hook Procedure : 0x197924346164x
Module : 1979187200
Process ID : 4252
Target Application PID : 0
Target Application Path : [SYSTEM PROCESS]
Thread ID : 0
Application Path : c:\program files\winrar\winrar.exe
Event Type : Open Thread
Target Application PID : 0
Target Application Path : [SYSTEM PROCESS]
Unique Thread : 5568

I can post logs if someone can help me PLEASE!

Pondus · 2015-08-22T19:02:06.000Z

If you want help, then we need some logs https://forum.avast.com/index.php?topic=53253.0
Scroll down to second picture … Farbar Recovery Scan Tool … run as instructed and attach the two diagnostic logs

Also attach Combofix log

system · 2015-08-22T20:18:17.000Z

Thank you! here it is:
it was too large to post so both FRST.txt and addition.txt are attached

system · 2015-08-22T20:25:02.000Z

sorry - combofix log attached

essexboy · 2015-08-22T20:27:19.000Z

Could you let me know what problems you have after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: Startup: C:\Documents and Settings\Mom and Dad\Start Menu\Programs\Startup\FrostWire On Startup.lnk [2010-12-23] ShortcutTarget: FrostWire On Startup.lnk -> C:\Program Files\FrostWire\FrostWire.exe (No File) Startup: C:\Documents and Settings\Mom and Dad\Start Menu\Programs\Startup\MEMonitor.lnk [2008-01-15] ShortcutTarget: MEMonitor.lnk -> C:\Program Files\Sprint music manager\MEMonitor.exe (No File) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2734996620-1405688005-191977121-1010\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION URLSearchHook: HKU\S-1-5-21-2734996620-1405688005-191977121-1010 - (No Name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - No File HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION U4 RemoteRegistry; no ImagePath S0 rqlswp; System32\drivers\dcifqkkp.sys [X] C:\windows\System32\drivers\dcifqkkp.sys Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F RemoveProxy: CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: ipconfig /flushdns CMD: netsh winsock reset catalog CMD: netsh int ip reset c:\resetlog.txt CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-08-22T21:25:52.000Z

sorry it took so long… when it rebooted it went into “dell diags” which it started doing 2 days ago. Fix log:

Fix result of Farbar Recovery Scan Tool (x86) Version:21-08-2015 03
Ran by Harry (2015-08-22 16:39:10) Run:1
Running from C:\Documents and Settings\Harry\Desktop
Loaded Profiles: Harry (Available Profiles: Katie Panetti & Mom and Dad & Mom & Dad & Harry & Administrator)
Boot Mode: Normal

==============================================

fixlist content:

CreateRestorePoint:
Startup: C:\Documents and Settings\Mom and Dad\Start Menu\Programs\Startup\FrostWire On Startup.lnk [2010-12-23]
ShortcutTarget: FrostWire On Startup.lnk → C:\Program Files\FrostWire\FrostWire.exe (No File)
Startup: C:\Documents and Settings\Mom and Dad\Start Menu\Programs\Startup\MEMonitor.lnk [2008-01-15]
ShortcutTarget: MEMonitor.lnk → C:\Program Files\Sprint music manager\MEMonitor.exe (No File)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2734996620-1405688005-191977121-1010\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
URLSearchHook: HKU\S-1-5-21-2734996620-1405688005-191977121-1010 - (No Name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: “about:newtab” <======= ATTENTION
U4 RemoteRegistry; no ImagePath
S0 rqlswp; System32\drivers\dcifqkkp.sys
C:\windows\System32\drivers\dcifqkkp.sys
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: Reg Delete “HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg” /F
Reg: Reg Add “HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg” /F
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers

Restore point was successfully created.
C:\Documents and Settings\Mom and Dad\Start Menu\Programs\Startup\FrostWire On Startup.lnk => moved successfully
C:\Program Files\FrostWire\FrostWire.exe not found.
C:\Documents and Settings\Mom and Dad\Start Menu\Programs\Startup\MEMonitor.lnk => moved successfully
C:\Program Files\Sprint music manager\MEMonitor.exe not found.
“HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer” => key removed successfully.
“HKU\S-1-5-21-2734996620-1405688005-191977121-1010\SOFTWARE\Policies\Microsoft\Internet Explorer” => key removed successfully.
HKU\S-1-5-21-2734996620-1405688005-191977121-1010\Software\Microsoft\Internet Explorer\URLSearchHooks\{4D25F926-B9FE-4682-BF72-8AB8210D6D75} => value removed successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\Tabs => value restored successfully
RemoteRegistry => service removed successfully.
rqlswp => service removed successfully.
“C:\windows\System32\drivers\dcifqkkp.sys” => File/Folder not found.

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully

========= End of Reg: =========

========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully

========= End of Reg: =========

========= Reg Delete “HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg” /F =========

The operation completed successfully

========= End of Reg: =========

========= Reg Add “HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg” /F =========

The operation completed successfully

========= End of Reg: =========

========= RemoveProxy: =========

HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings => value removed successfully.
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-2734996620-1405688005-191977121-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-2734996620-1405688005-191977121-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings => value removed successfully.

========= End of RemoveProxy: =========

========= netsh advfirewall reset =========

The following command was not found: advfirewall reset.