Fraud.WindowsProtectionSuite and Microsoft.Windows.RedirectedHosts [Archive]

NotTechnical

2009-12-01, 15:32

For the past several weeks, I have been unable to access Google, GMail, or Yahoo! search. I have used several different browsers including Firefox, IE, and Chrome. I realized that I did not have an active AV program running at the time (I know, I'm an idiot), so I downloaded Norton AV which cleaned several things off the system. But alas, it did not fix the issue above.

So I downloaded SpyBot S&D and run a system scan. This uncovered more issues of which two were Fraud.WindowsProtectionSuite and Microsoft.Windows.RedirectedHosts. I tried to destroy all these problems using SpyBot, but again was rejected by this problem. It continued to tell me that the Hosts file was not accessible. I tried many manual ways of getting to the hosts file including using notepad to change it, but each time was given the Access Denied problem or that the file is read only. I even ran a little program from MVPS.org to try and clean it up. All that it was successful in doing was creating a backup of the Hosts file, but never able to change it. Given that I am not a tech guy, I realized quickly that I am at the edge of my own technical abilities if not guided by someone much smarter than I.

Anyway, I performed the following as outlined:

1. Turned off Tea Timer in Spybot
2. Ran the ERUNT Registry backup
3. Ran a HijackThis system scan. As it was running, the following dialog boxes showed up.

Dialog Box #1
For some reason your system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may NOT be able to fix this.
If that happens, you need to edit the file yourself. To do this, click Start, Run and type:
Notepad H:\WINDOWS\System32\drivers\etc\hosts
And press Enter. Find the line(s) HijackThis reports and delete them. Save the file as ‘hosts’ (with quotes), and reboot.

Dialog Box #2
You have an particularly large amount of hijacked domains. It’s probably better to delete the file itself then to fix each item (and create a backup).
If you see the same IP address in all the reported O1 items, consider deleting your Hosts file, which is located at H:\WINDOWS\System32\drivers\etc\hosts.

The scan log from Hijack This is below:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:15:52 AM, on 12/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\ATI Technologies\ATI.ACE\cli.exe
H:\WINDOWS\stsystra.exe
H:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
H:\Program Files\Google\Google Talk\googletalk.exe
H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
H:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
H:\Program Files\iTunes\iTunesHelper.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
H:\Program Files\Windows Desktop Search\WindowsSearch.exe
H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
H:\Program Files\Bonjour\mDNSResponder.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\Norton AntiVirus\Engine\17.1.0.19\ccSvcHst.exe
H:\WINDOWS\system32\SearchIndexer.exe
H:\Program Files\Norton AntiVirus\Engine\17.1.0.19\ccSvcHst.exe
H:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
H:\Program Files\iPod\bin\iPodService.exe
H:\Program Files\ATI Technologies\ATI.ACE\cli.exe
H:\WINDOWS\system32\wuauclt.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe
H:\Program Files\Microsoft Office\Office12\WINWORD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 64.86.16.113 google.ae
O1 - Hosts: 64.86.16.113 google.as
O1 - Hosts: 64.86.16.113 google.at
O1 - Hosts: 64.86.16.113 google.az
O1 - Hosts: 64.86.16.113 google.ba
O1 - Hosts: 64.86.16.113 google.be
O1 - Hosts: 64.86.16.113 google.bg
O1 - Hosts: 64.86.16.113 google.bs
O1 - Hosts: 64.86.16.113 google.ca
O1 - Hosts: 64.86.16.113 google.cd
O1 - Hosts: 64.86.16.113 google.com.gh
O1 - Hosts: 64.86.16.113 google.com.hk
O1 - Hosts: 64.86.16.113 google.com.jm
O1 - Hosts: 64.86.16.113 google.com.mx
O1 - Hosts: 64.86.16.113 google.com.my
O1 - Hosts: 64.86.16.113 google.com.na
O1 - Hosts: 64.86.16.113 google.com.nf
O1 - Hosts: 64.86.16.113 google.com.ng
O1 - Hosts: 64.86.16.113 google.ch
O1 - Hosts: 64.86.16.113 google.com.np
O1 - Hosts: 64.86.16.113 google.com.pr
O1 - Hosts: 64.86.16.113 google.com.qa
O1 - Hosts: 64.86.16.113 google.com.sg
O1 - Hosts: 64.86.16.113 google.com.tj
O1 - Hosts: 64.86.16.113 google.com.tw
O1 - Hosts: 64.86.16.113 google.dj
O1 - Hosts: 64.86.16.113 google.de
O1 - Hosts: 64.86.16.113 google.dk
O1 - Hosts: 64.86.16.113 google.dm
O1 - Hosts: 64.86.16.113 google.ee
O1 - Hosts: 64.86.16.113 google.fi
O1 - Hosts: 64.86.16.113 google.fm
O1 - Hosts: 64.86.16.113 google.fr
O1 - Hosts: 64.86.16.113 google.ge
O1 - Hosts: 64.86.16.113 google.gg
O1 - Hosts: 64.86.16.113 google.gm
O1 - Hosts: 64.86.16.113 google.gr
O1 - Hosts: 64.86.16.113 google.ht
O1 - Hosts: 64.86.16.113 google.ie
O1 - Hosts: 64.86.16.113 google.im
O1 - Hosts: 64.86.16.113 google.in
O1 - Hosts: 64.86.16.113 google.it
O1 - Hosts: 64.86.16.113 google.ki
O1 - Hosts: 64.86.16.113 google.la
O1 - Hosts: 64.86.16.113 google.li
O1 - Hosts: 64.86.16.113 google.lv
O1 - Hosts: 64.86.16.113 google.ma
O1 - Hosts: 64.86.16.113 google.ms
O1 - Hosts: 64.86.16.113 google.mu
O1 - Hosts: 64.86.16.113 google.mw
O1 - Hosts: 64.86.16.113 google.nl
O1 - Hosts: 64.86.16.113 google.no
O1 - Hosts: 64.86.16.113 google.nr
O1 - Hosts: 64.86.16.113 google.nu
O1 - Hosts: 64.86.16.113 google.pl
O1 - Hosts: 64.86.16.113 google.pn
O1 - Hosts: 64.86.16.113 google.pt
O1 - Hosts: 64.86.16.113 google.ro
O1 - Hosts: 64.86.16.113 google.ru
O1 - Hosts: 64.86.16.113 google.rw
O1 - Hosts: 64.86.16.113 google.sc
O1 - Hosts: 64.86.16.113 google.se
O1 - Hosts: 64.86.16.113 google.sh
O1 - Hosts: 64.86.16.113 google.si
O1 - Hosts: 64.86.16.113 google.sm
O1 - Hosts: 64.86.16.113 google.sn
O1 - Hosts: 64.86.16.113 google.st
O1 - Hosts: 64.86.16.113 google.tl
O1 - Hosts: 64.86.16.113 google.tm
O1 - Hosts: 64.86.16.113 google.tt
O1 - Hosts: 64.86.16.113 google.us
O1 - Hosts: 64.86.16.113 google.vu
O1 - Hosts: 64.86.16.113 google.ws
O1 - Hosts: 64.86.16.113 google.co.ck
O1 - Hosts: 64.86.16.113 google.co.id
O1 - Hosts: 64.86.16.113 google.co.il
O1 - Hosts: 64.86.16.113 google.co.in
O1 - Hosts: 64.86.16.113 google.co.jp
O1 - Hosts: 64.86.16.113 google.co.kr
O1 - Hosts: 64.86.16.113 google.co.ls
O1 - Hosts: 64.86.16.113 google.co.ma
O1 - Hosts: 64.86.16.113 google.co.nz
O1 - Hosts: 64.86.16.113 google.co.tz
O1 - Hosts: 64.86.16.113 google.co.ug
O1 - Hosts: 64.86.16.113 google.co.uk
O1 - Hosts: 64.86.16.113 google.co.za
O1 - Hosts: 64.86.16.113 google.co.zm
O1 - Hosts: 64.86.16.113 google.com
O1 - Hosts: 64.86.16.113 google.com.af
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - H:\Program Files\Norton AntiVirus\Engine\17.1.0.19\IPSBHO.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATICCC] "H:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "H:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [googletalk] H:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "H:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] H:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe ARM] "H:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O4 - Global Startup: Windows Search.lnk = H:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://H:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Append to existing PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Apple Mobile Device - Apple Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - H:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c9ec372ea56a1e) (gupdate1c9ec372ea56a1e) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - H:\Program Files\Norton AntiVirus\Engine\17.1.0.19\ccSvcHst.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - H:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 12261 bytes

Thanks you so much in advance for your help. I have seen others in this blog that have had this same issue and it has been resolved. I searched long and hard to find a group who dealt with this, and yours seems to be the only one.

Dakeyras

2009-12-04, 10:27

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hi NotTechnical and welcome to Safer Networking. :)

I'm Dakeyras and I am going to try to assist you with your problem. Please take note of the below:

I will start working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine!.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Refrain from running self fixes as this will hinder the malware removal process.
It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
Reset Host File:

Open Notepad.
Copy and Paste everything from the Code Box below into Notepad: <-- Start >> Run... type in notepad and select OK

@Echo off
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
del %0
Go to File >> Save As
Save File name as "Dakeyras.bat" <-- Make sure to include the quotes.
Change Save as Type to All Files and save the file to your Desktop.
It should look like this: http://i223.photobucket.com/albums/dd202/Dakeyras_album/Dakeyras.jpg
Now double click on the desktop Dakeyras.bat to run the batch file. It will self-delete when completed.

Scan with RSIT:

Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Make sure that RSIT.exe is on the your Desktop before running the application!

Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:

log.txt will be opened maximized.
info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
Note: Both logs can also be located within this folder rsit at the root of your installed Hard-Drive. EG: H:\rsit

When completed the above, please post back the following in the order asked for:

How is you computer performing now, any further symptoms and or problems encountered?
Both RSIT logs. <-- Post them individually please, IE: one Log per post/reply.

Dakeyras

2009-12-08, 14:22

Due to the lack of feedback this Topic is closed.

If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send a private message (pm). A valid, working link to the closed topic is required.