Suspicious TCP/UDP connections on Currports

Slartybart said:

If it is, kill it.

The fact that it hung leads to to believe there is something down under the covers. I'll pull up instructions for another tool.
-

I've stopped that scan, I'll go an start with JRT now and then move on to TDSS, next post will be both logs

Slartybart said:

Since Sophos was supposed to tkae care of somoto but hung, you'll have to do some manual labor



It's not too much though

• Check Control Panel -> Programs and Features for the somoto toolbar
  >> uninstall it if found
  As a matter of fact, uninstall any toolbars you don't use.
  You could remove all toolbars in the list and reinstall any later if you decide you want them - that's up to you
• In every browser on your system, check for somoto in
  
  • home / start page -> replace somoto with "open a blank page" or the site you want opened first
  • search providers -> change the default to your favorite search engine and remove somoto from the list of providers
  • Firefox (FF) only: in addition to the home page and search providers
  • check and repair opened new tabs
  • in the FF address bar type
  • about:config
  • click "I'll be careful, I promise"
    If somoto is in these entries, change them, otherwise no action is required
  • search for browser.newtab.url -> right click on the result and select modify
    replace somoto with www.google.com
    click OK
  • search for browser.search.defaultenginename -> right click on the result and select modify
    replace somoto with www.google.com
    click OK
  • remove somoto from the search provider list
    in the FF search box, click on Google,
    then select Manage Search Engines
    slect somoto and hit Remove
    Click OK
  
  
• Export your registry and search the export fo Somoto
• post any keys / values found in the search

I'll edit this post to clean it up, just wanted to get it "down on paper"

My browsers show no symptons of Somoto, and there was no Somoto program or any Somoto registry keys when searching in regedit.exe, there is a hctoolbar.exe in the directory listed though, seeing as it's [hc]toolbar, this hc could be related to some features for hypercam, so I'll uninstall that program, but as I say, no symptons of toolbars and that crap show up. I've finished JRT and I am about to run TDSS, will be back soon with both logs!

Slartybart said:

Devian Art mean anything to you? hctoolbar / [hc]toolbar - which directory listing? Pgms & Feats?

I understand you decided to uninstall it. It's a toolbar, probably no harm removing it. If hypercam needs it, there's a good chance that it can be retireved from the net or installation disc.

Good news about your browsers - if somoto got on your system it didn't dig in deep.

Ok, I'll be somewhere around here.

Bill

I know of the website Deviantart, it's a bit buggy for me though, so I rarely use it, why?
Hctoolbar was where Somoto was found in the Program files folder for Hypercam.

Slartybart said:

Then, please download Junkware Removal Tool to your desktop
-

TDSSKiller came back clean, JRT deleted a few things, here is the log:
JRT.zip

Slartybart said:

That's what I found when I looked foor inof on hctoolbar

ohhhh that's something to consider

DevianArt is a bit buggy, hctoolbar is associated with DeviantArt (at least in my search) and somot stuck it in hybercam.

What a tangled web... anyway I think somoto is taken care of. Did you pick it up at DevianARt - dunno.

Deviantart is pretty reputable and well known, and the only things you can download from there are photos, so I doubt it. Anything to worry about in any logs I've posted?