Infected Computer - Please Advise

Welcome to Majrogeeks!

Run CounterSpy again and this time Delete all the malware it finds. You can ignore Weatherbug but remember it will serve ad popups to you; however you must fix everything else. Attach a new log from this run showing what you fixed. Run this now and attach the log.

After re-running CounterSpy and attaching the log, uninstall CounterSpy now since you have Windows Defender installed.

You need to cleanup all the infected Outlook emails that BitDefender reported and could not fix.

You totally ignored step 3 of the READ ME. This is a major reason for you PC being slow! Uninstall one of the antivirus programs now. It's your choice but the one that is the biggest resource hog is Symantec.

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - (no file)
O2 - BHO: (no name) - {40D4A862-4E31-F7C8-110A-0B8011E1504E} - C:\WINDOWS\system32\geqvskm.dll (file missing)
O2 - BHO: (no name) - {BEA59AE7-BA9C-44FB-8E04-56DE5C94A6F6} - C:\WINDOWS\system32\fccyv.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\gbcitmhg.dll",setvm
O20 - Winlogon Notify: fccyv - C:\WINDOWS\system32\fccyv.dll (file missing)
O20 - Winlogon Notify: wingbl32 - wingbl32.dll (file missing)

After clicking Fix, exit HJT.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Documents and Settings\Ryan Thrun\Favorites\Antivirus Test Online.url
C:\WINDOWS\system32\mixaqwet.exe
C:\WINDOWS\system32\wtssvtr.exe
C:\WINDOWS\system32\fccyv.dll
C:\WINDOWS\system32\gbcitmhg.dll
C:\WINDOWS\system32\lxkfqyvd.dll
C:\WINDOWS\system32\ncfmvkdt.dll
C:\WINDOWS\system32\nknqdiom.dll
C:\WINDOWS\system32\vyccf.tmp
C:\WINDOWS\system32\ghmticbg.ini
C:\Program Files\vyccf.ini
C:\Program Files\vyccf.ini2

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folder and delete if found:
C:\Documents and Settings\Ryan Thrun\Application Data\a?sembly <--- this folder name will probably look like assembly
C:\Program Files\VSAdd-in
C:\Program Files\VSToolbar

Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Ryan Thrun\Local Settings\Temp

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

I only wanted you to uninstall after it fixed everything. The below link shows steps used to get logs. See message 5 thru 8

http://forums.majorgeeks.com/showthread.php?t=111581

The READ ME does not have you install any antivirus programs.

AVG will work indefinitely and is one of the free tools we recommend.

NO! HijackThis has bugs and it reports things to be missing when they are not. Only fix what we ask you to fix.

If Norton is so good, why did you get infected to begin with.


You are using OLD version of GetRunKey and ShowNew. Please update to the current versions from the links in the READ ME.

 

A few things did not get fixed. Let's try this again! Make sure that ALL unnecessary applications are closed before continuing.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\vyccf.ini
C:\WINDOWS\system32\vyccf.ini2

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.
After reboot run CCleaner
Also delete all files and subfolders (if any still exist) in the below folder except ones from the current date (Windows will not let you delete the files from the current day).
C:\Documents and Settings\Ryan Thrun\Local Settings\Temp\

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Strange!!! The middle image indicates nothing was found yet the log agrees with the last image that says 3 items were found.

Uninstall CounterSpy now! We will remove anything necessary manually. Also delete the below two folders that CounterSpy's uninstall leaves behind:
C:\Documents and Settings\Ryan Thrun\Local Settings\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

You are starting to clutter up your Desktop with too much junk! Delete the below which are all on your Desktop!

Code:

"C:\Documents and Settings\Ryan Thrun\Desktop\"
active~1.txt  Dec 24 2006       15092  "Activescan.txt"
avgasr~1.txt  Dec 30 2006        1040  "AVG AS Report.txt"
avgavr~1.txt  Dec 30 2006         112  "AVG AV Report.txt"
bitdef~1.htm  Dec 24 2006       34102  "BitDefender.html"
bitdef~1.txt  Dec 24 2006       34102  "BitDefender.txt"
counte~1.rtf  Dec 22 2006        8393  "CounterSpy.rtf"
counte~1.txt  Dec 30 2006        3493  "CounterSpy.txt"
counte~2.txt  Jan  2 2007        3891  "CounterSpy2.txt"
counte~3.txt  Jan 12 2007        2284  "CounterSpy3.txt"
fixme.reg     Jan 12 2007        1366  "fixme.reg"
hijack~1.log  Dec 30 2006       11743  "hijackthis.log"
hijack~2.log  Jan  6 2007        6596  "hijackthis2.log"
newfiles.txt  Dec 29 2006       31385  "newfiles.txt"
newfil~1.txt  Jan  6 2007       32408  "newfiles2.txt"
runkeys.txt   Dec 29 2006       18077  "runkeys.txt"
runkeys2.txt  Jan  6 2007       18646  "runkeys2.txt"
runkeys3.txt  Jan 13 2007       17540  "runkeys3.txt"
smitfi~1.txt  Dec 30 2006        4975  "smitfiles.txt"
smitfr~1.rtf  Dec 29 2006       10885  "Smitfraud Removal Inst.rtf"
SMITREM       Dec 30 2006              "smitRem"

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Attach a new log from ShowNew!

Are you having any other malware problems now!

 

You're welcome. Your log is clean. If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!