HELP! superMWindow problem

Welcome to Majorgeeks!

If you had follow all of the READ & RUN ME you would have attach all the other logs requested and they would have been attach before HijackThis. As the READ & RUN ME shows you HijackThis is the very last step. Also we asked you not to run Spybot's Teatimer in the READ ME and you have it running.

Please attach the 5 other logs and disable Teatimer.

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

 

Also I have a few questions:

Did you setup the below Proxy Server for something?
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 125.248.244.131:8080

Also did you add the below to your Trusted Zone? If so, are they really necessary.
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://locator1.cdn.imageservr.com


Do you know what the below are for?
O16 - DPF: {808A2E66-B55C-42B2-97ED-DBC00B702649} (PDBoxPlay Class) - http://203.238.128.131/fileDir/cab/PDBoxPI.cab
O16 - DPF: {9BF607E0-4CC1-4099-9A07-362C9E4FB090} (WStarter Control) - http://live.pdbox.co.kr:8057/WStarter.cab

 

Please download the attach modified version of GetRunKey. This modified file is named GetRunKeyX.zip and the file you will need to run is named GetRunKeyX.bat. Again extract all files from the ZIP file. There is also a new file name zip.exe in the ZIP file. You MUST extract these two files into the same folder where you originally extracted GetRunKey.zip to. You extracted them here:

C:\Documents and Settings\John Vitasa\My Documents\various\GetRunKey\


Then locate the GetRunKeyX.bat and run it.

When it completes there will be 3 new logs in your c:\ folder.

C:\xtmpsysccs.zip
C:\xtmpsyscs1.zip
C:\xtmpsyscs3.zip

These can be pretty large. Hopefully they do not exceed upload file size limits. Please attach these three files to your next message.

 

Could those two items in the Trusted Zone be related to viewing of your MMS live feed?

You have a load of malware hiding on your PC, let's get started removing it.


If you installed and use RealVNC, you will have to restore it from the Quarantine folder of CounterSpy or you will need to reinstall it.

Uninstall the below software:
Java 2 Runtime Environment, SE v1.4.2_05
Mozilla Firefox (1.5.0.8)
Viewpoint Media Player

Now install the current version of Sun Java from: Sun Java Runtime Environment

Then install the current version of FireFox from: Mozilla Firefox


Continue by downloading two tools we will need

- Process Explorer

- Pocket KillBox

Extract them to their own folder somewhere that you will be able to locate them later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Make sure you have rebooted in Normal Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of ewbvdd.dll once and then click the kill button. After you have killed all of the ewbvdd.dll under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of ewbvdd.dll and kill it. (If you do not find the dll, just continue on.)

Now just exit Process Explorer.

Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.
C:\Program Files\Common Files\{84D39D07-09DC-1033-0127-030311130001}\Update.exe

After killing all the above processes, click Back.
Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000010} - C:\WINDOWS\DH.dll (file missing)
O2 - BHO: (no name) - {0BF30220-C9BA-493E-B4A9-4D7B52DAED2B} - C:\WINDOWS\system\ewbvdd.dll
O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - C:\WINDOWS\system32\uppbamie.dll
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O16 - DPF: {9BF607E0-4CC1-4099-9A07-362C9E4FB090} (WStarter Control) - http://live.pdbox.co.kr:8057/WStarter.cab
O20 - Winlogon Notify: ewbvdd - C:\WINDOWS\system\ewbvdd.dll

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\America Online 9.0a\download\02.exe
C:\Program Files\Common Files\{34D39D07-09DC-1033-0127-030311130001}\888.dll
C:\Program Files\Common Files\{34D39D07-09DC-1033-0127-030311130001}\Uninstall.exe
C:\Program Files\Common Files\{84D39D07-09DC-1033-0127-030311130001}\System.dll
C:\Program Files\Common Files\{84D39D07-09DC-1033-0127-030311130001}\Update.exe
c:\windows\downloaded program files\UERS_0001_NI57M1124NetInstaller.exe
c:\windows\downloaded program files\WinadX.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1019.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1019.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\HDPlugin1019.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\HDPlugin1019.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\HDPlugin1019.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\HDPlugin1019.inf
C:\WINDOWS\Downloaded Program Files\DeskAdX.dll
C:\WINDOWS\Downloaded Program Files\WinadX.dll
C:\WINDOWS\Downloaded Program Files\WinTaskAdX.dll
C:\WINDOWS\Downloaded Program Files\WStarter.ocx
C:\WINDOWS\Downloaded Program Files\int_ver34.INF
C:\WINDOWS\Sm9obiBWaXRhc2E\mA6Cv21qurl1wZH.vbs
C:\WINDOWS\DHU.exe
C:\WINDOWS\justin2a.exe
C:\WINDOWS\system\ewbvdd.dll
C:\WINDOWS\SYSTEM32\aapklfqo.exe
C:\WINDOWS\SYSTEM32\apnjcnio.dll
C:\WINDOWS\SYSTEM32\awpobppn.dll
C:\WINDOWS\SYSTEM32\axupqbhw.dll
C:\WINDOWS\SYSTEM32\bmwsuhim.dll
C:\WINDOWS\SYSTEM32\dbcvoxpp.dll
C:\WINDOWS\SYSTEM32\djivcqvp.dll
C:\WINDOWS\SYSTEM32\dlh9jkd1q7.exe
C:\WINDOWS\SYSTEM32\dlh9jkd1q6.exe
C:\WINDOWS\SYSTEM32\dlh9jkd1q8.exe
C:\WINDOWS\SYSTEM32\dlh9jkd1q1.exe
C:\WINDOWS\SYSTEM32\dlh9jkd1q2.exe
C:\WINDOWS\SYSTEM32\dlh9jkd1q5.exe
C:\WINDOWS\SYSTEM32\dsfhoupe.dll
C:\WINDOWS\SYSTEM32\ehsystos.dll
C:\WINDOWS\SYSTEM32\fsmhjsie.exe
C:\WINDOWS\SYSTEM32\jlskkgrh.dll
C:\WINDOWS\SYSTEM32\kedhpvgo.dll
C:\WINDOWS\SYSTEM32\kernels88.exe
C:\WINDOWS\SYSTEM32\mykbplad.dll
C:\WINDOWS\System32\objsafe.tlb
C:\WINDOWS\SYSTEM32\oxggqqav.dll
C:\WINDOWS\SYSTEM32\qlsjmlpc.exe
C:\WINDOWS\SYSTEM32\spcuxgir.dll
C:\WINDOWS\SYSTEM32\tmxixqjx.dll
C:\WINDOWS\SYSTEM32\ukjpjbrd.dll
C:\WINDOWS\SYSTEM32\uppbamie.dll
C:\WINDOWS\SYSTEM32\wajvvtcs.dll
C:\WINDOWS\SYSTEM32\whbqpuxa.ini
C:\WINDOWS\SYSTEM32\wyfynkpm.dll
C:\WINDOWS\SYSTEM32\xdoqiimm.dll
C:\WINDOWS\SYSTEM32\DRIVERS\DP.sys
C:\WINDOWS\Temp\b116.exe
C:\WINDOWS\Temp\b122.exe
C:\WINDOWS\Temp\nsa148.tmp
C:\WINDOWS\Temp\nsm15E.tmp
C:\WINDOWS\Temp\nsq15B.tmp
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G1AF8PAB\116[1].net
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G1AF8PAB\exefile[1].exe
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\WHE7W5UN\122[1].net
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\WT2VCT6J\r[1].exe
C:\3456346345643.exe
c:\syst.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folders and delete if found:
c:\windows\system32\vmss
C:\Program Files\Common Files\{34D39D07-09DC-1033-0127-030311130001}
C:\Program Files\Common Files\{84D39D07-09DC-1033-0127-030311130001}

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Since you have a paid version of Ad-Aware and since we have fixed things with CounterSpy, you can uninstall CounterSpy now. It is only a 15 day trial anyway and will stop working after that period.

You're welcome.

You did not follow my directions in message # 6 for uploading those 3 ZIP files that I need. I also needed that step to be run before the other cleanup steps in message # 7.

Please upload those three files now.


You also never shutdown Spybot's Teatimer as requested and you should not be using this anyway with Ad-watch running.

Now Disable Spybot's TeaTimer

• Run Spybot and click Mode
• Select Advanced Mode.
• Then click Tools and select Resident.
• Now in the right window pane, uncheck TeaTimer.
• Also while this is open, in the left column now select IE Tweaks
• and then in the right pane make sure all the Miscellaneous locks are unchecked.
• Now quit Spybot!

You have another malware DLL that showed up on Dec 19th. Delete the below file (manually or with Killbox if necesssary)
C:\WINDOWS\SYSTEM32\sawqojms.dll

 

You did not disable it from loading!!!! You just killed the process which is not the same thing.


Tell me the size of each file. I really doubt that they are too large. There should be three separate files and with compression added by putting them into the ZIP file, I think they should be 350k or less in size. If you cannot attach all of them in one message, attach them on at a time, but I have done similar with three files like this all from 250k to 300k and all attached without a problem.

 

It is due to Ad-Aware's Ad-watch blocking the change. Shutdown Ad-Watch and redo my fix. Then also run HJT and fix the below line if found:
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\My Shared Folder\Spybot - Search & Destroy\TeaTimer.exe

Then reboot and let me know what happens.

 

We still have a little bit to do based on those logs I had you upload. There are items related to CmdService and NETWORK_MONITOR we need to remove. These can be very stubborn and frequently require use of a tool to take ownership of registy keys so that we can remove them. I had to work up a fix for you. Let's get started.

Download the new version of GetRunKey from Using GetRunKey and use it to get a new log and attach the runkeys.txt log.

Make sure you do the above and attach the log FIRST before you do the below. I want to be able to see a before and after set of logs.


Please download and install Registrar Lite Make sure you select a Majorgeeks download link and not the Authors!

Run Registrar Lite navigate to each of the following keys (one at a time) and take ownership of them (I explained how to do that further down).

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDSERVICE\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETWORK_MONITOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETWORK_MONITOR\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDSERVICE\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NETWORK_MONITOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NETWORK_MONITOR\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000

To take ownership of the key do the following:

• Copy & Paste the registry key from above into the Address bar of Registrar Lite and hit the enter key. This will bring you to the registry key.
• Click-on Security in the top Menu
• Select Take Ownership
• Repeat these steps for all of the registry keys given above before continue to the next steps below.
• Now leave RegistrarLite running and continue
• Now run the fixME.reg REGISTRY PATCH below in this message.
• Tell me the results. Any error messages?
• Now in RegistrarLite click View and then Refresh
• Now navigate one at a time to each of the above keys we took ownership of to make sure they were deleted.
• If any of the keys still exist, right click on it and select Delete. Let me know if you have to do this and if you get any error messages at this point.

Here is the Registry Patch

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Then reboot your PC!

Now run GetRunKey again and attach a second log from it that is from after running the above procedure.

 

Okay we got some of them removed but some remain. This are the ones that are typically more stubborn because they are owned by the System (the operating system) which makes it harder to remove.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDSERVICE

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETWORK_MONITOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NETWORK_MONITOR

I want you to use Registar Lite again to navigate to each key (one at a time) by pasting them into the Address Bar and hitting return. Now this time click the Security menu item and select Edit Permissions. Here is what I expect you to see in the Group or user names area of the form:

Everyone
SYSTEM

Select Everyone by clicking on it. Now at the bottom in the Permissions box click the check box for Full Control. The click Apply and then OK to get back to the main Registrar Lite screen. Nowright click on the registry key and select Delete. The click View and Refresh. Check to see if the registry key just deleted truly deleted. If so, move on to the next to work thru the whole list. If it does not delete, I want you to boot into safe mode and repeat these exact same steps to see if we can do it from safe mode.

Let me know the results. If it looks to you like they all deleted, attach a new GetRunKeys log.

 

Good job!

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Think of it as a Christmas present a few days early!