Please help, malware/spyware remaining!

Hello

I've been through the 'Read & Run Me First' thread & followed all stages. I have attached logs for Bitdefender, Panda Active Scan, GetRunKey, and will attach ShowNew and HiJackThis logs to next post.

I was hit by a huge amount of popups, error messages and the like, all at the same time, including fake explorer messages and speech-bubble shaped messages from taskbar selling software. My homepage was changed, browser windows would reload as different pages, and my computer was running really slowly as a result of all this activity.

After running all the processes listed in the 'Read & Run Me First' thread, now problems are narrowed down to the following:

• Pop-ups while online. Examples as follows: "Data Execution Prevention", "Spyware Removal Wizard", "Attention! Virus Detected", "Buffer overrun detected", fake explorer window selling SpyProtect.
• Computer running slightly slower than usual

Big improvement, but there still must be something there. Please advise me on what I should do next!

System specs are as follows:

Microsoft Windows XP Professional, version 5.1.2600, Service Pack 2.
System Memory: 256 MB (PC133 SDRAM)
CPU Type: Intel Pentium IIIE, 1000 Mhz (7.5 x 133)



Thanks in advance.

 

ShowNew and HiJackThis logs attached.

 

Please look in Add/Remove Programs for the following and uninstall them if found:

VSAdd-in

VirusBursters

ipwins

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.microsoft.com/i sapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: (no name) - {3D8C0C6A-75C7-5DF8-3D05-0174E7C24A35} - C:\WINDOWS\system32\qofkurh.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O2 - BHO: (no name) - {5D3217AB-3E82-190D-F29A-0BC237A74CA9} - C:\WINDOWS\system32\hxouymn.dll
O2 - BHO: (no name) - {9ED51E33-38D3-41AF-96D5-C435717A4A24} - C:\WINDOWS\system32\hggeb.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\iusmfssa.dll
O2 - BHO: (no name) - {F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} - C:\WINDOWS\system32\cbxxwtq.dll

O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvceh.dll,startup
O4 - HKLM\..\Run: [qgfvyxb.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\qgfvyxb.dll,cefxmwc
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [bkhqrrj.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\bkhqrrj.dll,esnbyag
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot

O15 - Trusted Zone: http://www.asuapplications.co.uk (HKLM)

O20 - Winlogon Notify: cbxxwtq - C:\WINDOWS\SYSTEM32\cbxxwtq.dll
O20 - Winlogon Notify: hggeb - C:\WINDOWS\system32\hggeb.dll
O20 - Winlogon Notify: winafg32 - C:\WINDOWS\SYSTEM32\winafg32.dll

O23 - Service: sgbx_device - Sagem - C:\WINDOWS\system32\sgbxcoms.exe

Again, make sure ALL browser windows are closed when you click FIX.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\WINDOWS\Temp ← Delete everything in this folder!

C:\Program Files\ipwins ← Delete this whole folder if it exist!

C:\Program Files\VSAdd-in ← Delete this whole folder if it exist!

C:\Program Files\VirusBursters ← Delete this whole folder if it exist!

Next, run CCleaner to clean up cookies and temp files.

NOW:
Click Start > Run > type services.msc and Click OK

Locate sgbx_device - Sagem and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, REBOOT and proceed with the rest of this fix...

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now. Also, please attach a fresh HJT log.

 

Thanks for the help!

I ran through the above. Only minor problems:

• No Virusbursters or ipwins in Add / Remove Programs menu
• O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll did not appear in HiJackThis scan so I couldn't select it
• O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll did not appear in HiJackThis scan so I couldn't select it
• sgbx_device was already stopped and disabled

So far no more pop-ups or anything like that, so it's looking good. I have attached the new HiJackThis log.

Please let me know if you see anything else that needs to be dealt with.

 

Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial.

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

O2 - BHO: (no name) - {09F881B0-C45C-410A-8D75-3DCF9C6F8961} - C:\WINDOWS\system32\hggeb.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\tpdjygvh.dll
O2 - BHO: (no name) - {F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} - C:\WINDOWS\system32\cbxxwtq.dll

O20 - Winlogon Notify: cbxxwtq - C:\WINDOWS\SYSTEM32\cbxxwtq.dll
O20 - Winlogon Notify: hggeb - C:\WINDOWS\system32\hggeb.dll
O20 - Winlogon Notify: winafg32 - C:\WINDOWS\SYSTEM32\winafg32.dll

Again, make sure ALL browser windows are closed when you click FIX.

Next, run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

Once you complete the above, reboot once more and attach a fresh HJT log.

 

Okay, carried out above. Only one problem:

• O2 - BHO: (no name) - {09F881B0-C45C-410A-8D75-3DCF9C6F8961} - C:\WINDOWS\system32\hggeb.dll wasn't listed in HiJackThis scan so I couldn't select it

Everything else went fine.

However, when I rebooted my computer for the second time (after deleting those files using Killbox) a message popped up from my antivirus software (AVG Resident Shield) saying:

"C: DOCUME~1\User\LOCALS~1\Temp\hxmplncj.dll
Trojan horse Generic2.GGN"

Also, when I went online there was a pop-up that tried to run a control / download something & was blocked by security controls.

I have attached latest HiJackThis log as requested. Please advise!

 

HiJackThis log attached here! Sorry.

 

Okay let's start by downloading two tools we will need:

- Process Explorer 10.21

- Pocket KillBox

Extract them to there own folder somewhere that you will be able to locate them later.

Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of hggeb.dll & cbxxwtq.dll once and then click the kill button. After you have killed all of the hggeb.dll & cbxxwtq.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of hggeb.dll & cbxxwtq.dll and kill it.

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {F5260DD4-0F42-4D4D-B05F-ADC6A3D1A2E9} - C:\WINDOWS\system32\hggeb.dll
O2 - BHO: (no name) - {F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} - C:\WINDOWS\system32\cbxxwtq.dll

O20 - Winlogon Notify: cbxxwtq - C:\WINDOWS\SYSTEM32\cbxxwtq.dll
O20 - Winlogon Notify: hggeb - C:\WINDOWS\system32\hggeb.dll
O20 - Winlogon Notify: winafg32 - winafg32.dll (file missing)


Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.


C:\WINDOWS\SYSTEM32\qtwxxbc.ini
C:\WINDOWS\SYSTEM32\qtwxxbc.ini2
C:\WINDOWS\SYSTEM32\qtwxxbc.bak
C:\WINDOWS\SYSTEM32\qtwxxbc.bak1
C:\WINDOWS\SYSTEM32\qtwxxbc.bak2
C:\WINDOWS\SYSTEM32\qtwxxbc.tmp
C:\WINDOWS\system32\cbxxwtq.dll

C:\WINDOWS\SYSTEM32\beggh.ini
C:\WINDOWS\SYSTEM32\beggh.ini2
C:\WINDOWS\SYSTEM32\beggh.bak
C:\WINDOWS\SYSTEM32\beggh.bak1
C:\WINDOWS\SYSTEM32\beggh.bak2
C:\WINDOWS\SYSTEM32\beggh.tmp
C:\WINDOWS\system32\hggeb.dll

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

 

Carried out all above steps. A couple of issues I should mention:

• Could not find entry O2 - BHO: (no name) - {F5260DD4-0F42-4D4D-B05F-ADC6A3D1A2E9} - C:\WINDOWS\system32\hggeb.dll . However, there was an entry 02 - BHO: (no name) - {02281946-2254-40E5-A5A3-45DC0AE973D3} - C:\WINDOWS\system32\hggeb.dll. I went ahead and selected this for fixing, since the end file name was the same as the one in the given list. This may have been a bit reckless of me, hopefully it's ok?
• After all stages were carried out & I rebooted, an AVG window popped up saying "VIRUS DETECTED, C:\WINDOWS\system32\clkmfqcy.dll, Trojan horse Generic2.GGN". I selected the 'Heal' option and it said it had been successfully healed.

I have attached the latest HJT log. Does it look like more work is required? Thanks for all your help so far!

 

Scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\clkmfqcy.dll

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\system32\clkmfqcy.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete this post reboot a few times and attach a fresh HJT log.

 

Hello

Ran through all of above, no problems. HiJackThis log attached.

Could this be the end?

 

Yes, your log looks good.

Are you having any further problems?

 

No further problems, everything seems to be back to normal.

Once more, I thank you for your invaluable assistance.

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!