Solved Suspicious TCP/UDP connections on Currports

[Slartybart]

Didn't find squat about this. Is it still in the same place?

If it is, kill it.

The fact that it hung leads to to believe there is something down under the covers. I'll pull up instructions for another tool.

Sorry 'bout Sophos. Based on your experience, it's out of my toolbox.

Bill
-

 

[Slartybart]

Sophos messed up our scan and clean process, I almost forgot about JRT.

Go back to post# 34 and run JRT first.

Then do TDSSKiller below the fold

---

:info: Download: TDSSKiller (select the .exe version)

Launch TDSSKiller
When the TDSSKiller console opens
Change Parameters

Under Additional Options, place a check in the box next to:
Detect TDLFS File System
Click OK

Then press Start Scan

If TDSSKiller finds a suspicious object let the scanner take the deafult action: Skip.
click Continue

If TDSSKiller finds malicious objects, those are displayed in the Scan results.
Make certain that the default action Cure is selected
:warn: If Cure is not available, select Skip. DO NOT select Delete.

then click Continue > Reboot Now
>> A reboot is required to complete the removal of malicious objects.

The scan log is created on C:\ and has a name format of:
C:\TDSSKiller.X.X.X_15.10.2013_15.31.43_log.txt

Please attach (use the paperclip icon on the post menu bar) the scan log to your next post.

 

[Slartybart]

Since Sophos was supposed to tkae care of somoto but hung, you'll have to do some manual labor



It's not too much though

• Check Control Panel -> Programs and Features for the somoto toolbar
  >> uninstall it if found
  As a matter of fact, uninstall any toolbars you don't use.
  You could remove all toolbars in the list and reinstall any later if you decide you want them - that's up to you
• In every browser on your system, check for somoto in
  • home / start page -> replace somoto with "open a blank page" or the site you want opened first
  • search providers -> change the default to your favorite search engine and remove somoto from the list of providers
  • Firefox (FF) only: in addition to the home page and search providers
  • check and repair opened new tabs
  • in the FF address bar type
  • about:config
  • click "I'll be careful, I promise"
    If somoto is in these entries, change them, otherwise no action is required
  • search for browser.newtab.url -> right click on the result and select modify
    replace somoto with www.google.com
    click OK
  • search for browser.search.defaultenginename -> right click on the result and select modify
    replace somoto with www.google.com
    click OK
  • remove somoto from the search provider list
    in the FF search box, click on Google,
    then select Manage Search Engines
    slect somoto and hit Remove
    Click OK
• Export your registry and search the export fo Somoto
• post any keys / values found in the search

I'll edit this post to clean it up, just wanted to get it "down on paper"

 

[oddblob]

If it is, kill it.

The fact that it hung leads to to believe there is something down under the covers. I'll pull up instructions for another tool.
-

I've stopped that scan, I'll go an start with JRT now and then move on to TDSS, next post will be both logs

 

[oddblob]

Since Sophos was supposed to tkae care of somoto but hung, you'll have to do some manual labor



It's not too much though

• Check Control Panel -> Programs and Features for the somoto toolbar
  >> uninstall it if found
  As a matter of fact, uninstall any toolbars you don't use.
  You could remove all toolbars in the list and reinstall any later if you decide you want them - that's up to you
• In every browser on your system, check for somoto in
  • home / start page -> replace somoto with "open a blank page" or the site you want opened first
  • search providers -> change the default to your favorite search engine and remove somoto from the list of providers
  • Firefox (FF) only: in addition to the home page and search providers
  • check and repair opened new tabs
  • in the FF address bar type
  • about:config
  • click "I'll be careful, I promise"
    If somoto is in these entries, change them, otherwise no action is required
  • search for browser.newtab.url -> right click on the result and select modify
    replace somoto with www.google.com
    click OK
  • search for browser.search.defaultenginename -> right click on the result and select modify
    replace somoto with www.google.com
    click OK
  • remove somoto from the search provider list
    in the FF search box, click on Google,
    then select Manage Search Engines
    slect somoto and hit Remove
    Click OK
• Export your registry and search the export fo Somoto
• post any keys / values found in the search

I'll edit this post to clean it up, just wanted to get it "down on paper"

My browsers show no symptons of Somoto, and there was no Somoto program or any Somoto registry keys when searching in regedit.exe, there is a hctoolbar.exe in the directory listed though, seeing as it's [hc]toolbar, this hc could be related to some features for hypercam, so I'll uninstall that program, but as I say, no symptons of toolbars and that crap show up. I've finished JRT and I am about to run TDSS, will be back soon with both logs!

 

[Slartybart]

Devian Art mean anything to you? hctoolbar / [hc]toolbar - which directory listing? Pgms & Feats?

I understand you decided to uninstall it. It's a toolbar, probably no harm removing it. If hypercam needs it, there's a good chance that it can be retireved from the net or installation disc.

Good news about your browsers - if somoto got on your system it didn't dig in deep.

Ok, I'll be somewhere around here.

Bill

 

[oddblob]

Devian Art mean anything to you? hctoolbar / [hc]toolbar - which directory listing? Pgms & Feats?

I understand you decided to uninstall it. It's a toolbar, probably no harm removing it. If hypercam needs it, there's a good chance that it can be retireved from the net or installation disc.

Good news about your browsers - if somoto got on your system it didn't dig in deep.

Ok, I'll be somewhere around here.

Bill

I know of the website Deviantart, it's a bit buggy for me though, so I rarely use it, why?
Hctoolbar was where Somoto was found in the Program files folder for Hypercam.

 

[oddblob]

Then, please download Junkware Removal Tool to your desktop
-

TDSSKiller came back clean, JRT deleted a few things, here is the log:
View attachment JRT.zip

 

[Slartybart]

That's what I found when I looked foor inof on hctoolbar

ohhhh that's something to consider

DevianArt is a bit buggy, hctoolbar is associated with DeviantArt (at least in my search) and somot stuck it in hybercam.

What a tangled web... anyway I think somoto is taken care of. Did you pick it up at DevianARt - dunno.

 

[oddblob]

That's what I found when I looked foor inof on hctoolbar

ohhhh that's something to consider

DevianArt is a bit buggy, hctoolbar is associated with DeviantArt (at least in my search) and somot stuck it in hybercam.

What a tangled web... anyway I think somoto is taken care of. Did you pick it up at DevianARt - dunno.

Deviantart is pretty reputable and well known, and the only things you can download from there are photos, so I doubt it. Anything to worry about in any logs I've posted?

 

[Slartybart]

JRT looks good and you said TDSSkiller reported nothing.

All right. Last one.

Download Old Timer TFC -> save to your desktop.
TFC will close ALL open programs including your browser!
Save any unsaved work.

Right click, run as administrator TFC

Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

:busted: If TFC prompts you to reboot, do so immediately.
:busted: If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.

Bill

 

[oddblob]

:busted: If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.

Bill

It logged me out, I logged back in and then restarted, no prompts, so I guess that means all's good?
It made hidden files/folders appear, but I simply turned that off, I guess this journey is at an end then, I'll uninstall some more software I never use using Revo, thank you so much for all the help you've given me, I'd still be stuck at the Hosts file issue if it wasn't for you!

 

[Slartybart]

You're most welcome oddblob, glad you have the issue resolved. And because of currports/spybot/hosts, you discovered and erradicated other malware.

Yeah, you're good-to-go as I see it.

Curious though, It made hidden files/folders appear - do you mean the folder setting or some particular folder/files?

Keep Mbam - you can remove the other scanners, especially Sophos. They get stale fairly quick due to the nature of malware and you can always download fresh version.

Yeah for some reason Old timer-TFC has some benign side effects. I had one Windows Update restart, probably because I ddin't reboot first to let WU finish.

Anyway, it was a pleasure working with you on this. I learned a bit in the process too.

Bill
-