R&R Completed, your assistance please

BillyGoat · Jul 23, 2006

I have gone through the R&R post process completely. Now I am at the point to post what I have for your help. I would like to say thank you very much in advance! I don't know what I would have done without this site and the people running it!

Some of the items found were: vcodec, pipas, trojanproxy xorpix.fam, backdoor eterok among others I'm sure. I am also have problems with IE trying to access an IP with win32:adan-094 and -078 Fortunately Avast keeps blocking it but IE just wont stop trying.

Please let me know what I should do next to clean everything up and how to keep it clean. Thank you!

BillyGoat · Jul 23, 2006

I also have a counterspy log for you since defender wont run on my computer yet.

Shadow_Puter_Dude · Jul 23, 2006

Please download FixWareout by LonnyRJones from one of the two below links and save it to your desktop.

http://downloads.subratam.org/Fixwareout.exe

http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Run Fixwareout.

Click Next,

then Install,

make sure Run fixit is checked

and click Finish.

The fix will begin; follow the prompts.

You will be asked to reboot your computer; please do so.

Your system may take longer than usual to load; this is normal.

When you run fixwareout, just follow the prompts, you will need to restart when prompted.

After rebooting (restart) back into normal boot mode, make sure you have all web browsers closed.

Go into Control Panel -->Network Connections.

Right click on your connection

and click Properties.

On the Properties page, highlight Internet Protocol(TCP/IP)

Click Properties. This will bring up another page.

Select Obtain DNS Server Automatically.

Click the ok button. The page will close.

Press ok on the page in front of you.

Restart the computer.

Reconnect to the Internet using Internet Explorer.

Now come back here and attach the log from fixwareout. It is located at c:\fixwareout\report.txt

Post a fresh HijackThis log as well.

BillyGoat · Jul 23, 2006

Done deal. Thanks. What's next?

Shadow_Puter_Dude · Jul 23, 2006

Download
- Pocket Killbox

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

R3 - URLSearchHook: (no name) - {152A1C18-44D9-F66A-064F-A4B56123E4DE} - AliceSD.dll (file missing)
O4 - HKLM\..\Run: [gabber] barint.exe
O4 - HKLM\..\Run: [teqq32] lpt.exe
O4 - HKLM\..\Run: [tazkh.exe] C:\WINNT\system32\tazkh.exe
O4 - HKCU\..\Run: [ftbar] Uint32.exe
O4 - HKCU\..\Run: [ActionScr] TRPT.exe
O4 - HKCU\..\Run: [Trayz] nmdllw.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.108 85.255.112.131
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.108 85.255.112.131
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.108 85.255.112.131
O20 - Winlogon Notify: 1_32bean32_1reg - C:\Documents and Settings\All Users.WINNT\Documents\Settings\1_32bean32_1.dll
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

AliceSD.dll
barint.exe
lpt.exe
nmdllw.exe
TRPT.exe
Uint32.exe
C:\Documents and Settings\All Users.WINNT\Documents\Settings\1_32bean32_1.dll
C:\WINNT\system32\{02707724-1BDA-41F3-9778-E8B8E6EF41FC}.exe
C:\WINNT\system32\{0448784A-7138-438C-B0AC-E1FD25709728}.exe
C:\WINNT\system32\{055E5639-A132-4A27-813A-24FF2F253989}.exe
C:\WINNT\system32\{095CB3AE-68FB-40F8-8699-BDC3C99AE7D4}.exe
C:\WINNT\system32\{09B9D75E-895D-4390-939E-D657C8885680}.exe
C:\WINNT\system32\{0E3FE2E7-3992-4048-B61B-0FF6292D5BE4}.exe
C:\WINNT\system32\{19E014AC-332A-4F63-AD96-D4CECEDD6832}.exe
C:\WINNT\system32\{1AC8A745-E110-4BEE-BCC5-6DE9E381D469}.exe
C:\WINNT\system32\{237CBF82-4A1A-487F-8A3F-40807CE15451}.exe
C:\WINNT\system32\{27F4577D-2772-457A-8097-726FC190A8DC}.exe
C:\WINNT\system32\{2F9FC97B-0B81-4D8F-A2AE-0A68DCDC8A62}.exe
C:\WINNT\system32\{30E8CA41-B43E-48E9-B7EC-8A9DB49074A4}.exe
C:\WINNT\system32\{3312C7E0-F2F8-46AB-8B74-C053D9AF842D}.exe
C:\WINNT\system32\{3E810A7E-2B7A-4986-A597-BECE258C1181}.exe
C:\WINNT\system32\{4364A0CB-E547-4149-98E2-B05A558EB485}.exe
C:\WINNT\system32\{48A748F9-12C8-4938-B1E5-1A081C9D5205}.exe
C:\WINNT\system32\{48F6D0BC-B57A-42AE-B516-FA8CCBE94B66}.exe
C:\WINNT\system32\{4C71ABAA-52F9-44D5-B662-825D3A8133D8}.exe
C:\WINNT\system32\{4E064B05-F3C7-4C3C-B543-E3C1E2205176}.exe
C:\WINNT\system32\{4F3A71F8-9D5C-46A9-9593-AB85BB081B7E}.exe
C:\WINNT\system32\{53596A10-9D40-4CAC-BBC7-47E1306EBBEE}.exe
C:\WINNT\system32\{5D478AD3-3903-4C3F-A776-93403D82EF06}.exe
C:\WINNT\system32\{5F1B3C3A-E42A-44FD-A99C-DF01B38BCFDF}.exe
C:\WINNT\system32\{5FBAD011-4239-41AC-BFDD-F3485CA14311}.exe
C:\WINNT\system32\{646D7C17-8DA3-4AEC-A8F3-7B726BC749F7}.exe
C:\WINNT\system32\{6823EC2F-9661-4C37-A10C-78844E9EB165}.exe
C:\WINNT\system32\{6C8DB179-DBA6-411F-817C-74B76AC99623}.exe
C:\WINNT\system32\{76F2CF63-6533-458B-914C-6CB7B0A47F33}.exe
C:\WINNT\system32\{7764A7D6-84C9-4A88-89ED-482336CB8D61}.exe
C:\WINNT\system32\{7F49A54A-C655-4ACB-9365-2B962C726C37}.exe
C:\WINNT\system32\{847022B0-1FB7-4597-B154-6A5E7BC8423D}.exe
C:\WINNT\system32\{84C07912-FDFD-4D1B-944A-58FA782FB15B}.exe
C:\WINNT\system32\{8A283D61-1EC0-46C4-953C-17CDF548BEA8}.exe
C:\WINNT\system32\{8AB26439-0C87-4BCC-A065-2F89242B39A6}.exe
C:\WINNT\system32\{90B37612-1639-463D-B014-3EF32B4F8D37}.exe
C:\WINNT\system32\{90FC3D2B-CE29-411C-87D9-8A68A04682C0}.exe
C:\WINNT\system32\{971EA2FE-5411-4072-9134-7E6F24976FBE}.exe
C:\WINNT\system32\{9BBBFEA6-5BBF-4761-8427-2BA309194375}.exe
C:\WINNT\system32\{9F4E721D-EC1A-4FD6-B1D6-554004DFF99E}.exe
C:\WINNT\system32\{ACF1346E-E347-4220-BDC8-828B29EDFD1A}.exe
C:\WINNT\system32\{AF8B452A-7223-428B-96A0-577345D176BE}.exe
C:\WINNT\system32\{B51CBD0A-27B9-43C9-B202-9A7B00394E8A}.exe
C:\WINNT\system32\{BA52C13B-206A-470C-A74B-3B8395685E59}.exe
C:\WINNT\system32\{C0188577-0184-4048-9F7C-DCAF7ECE478B}.exe
C:\WINNT\system32\{C5A1D349-D722-4021-AE67-373EC88040E2}.exe
C:\WINNT\system32\{CCD26C3E-D198-444D-A877-01B6037B06E7}.exe
C:\WINNT\system32\{CE571F5C-60A6-41D4-90CC-416336A95972}.exe
C:\WINNT\system32\{D88786C9-FF21-4ED4-B6FA-2629628C2A5F}.exe
C:\WINNT\system32\{DE39BBE3-28A9-4566-9E48-BCF9007D1AA6}.exe
C:\WINNT\system32\{DFC33430-6262-4E4B-9EFE-826501864AD3}.exe
C:\WINNT\system32\{E6C1C799-7859-4477-B1B4-DEA0AC6D725E}.exe
C:\WINNT\system32\{EA4C868E-D9AD-4F87-84A8-FF64E9DA18DF}.exe
C:\WINNT\system32\{EAD906AD-5B81-4665-AE9C-0F91BFB949CA}.exe
C:\WINNT\system32\{EC009C6C-2D9E-411D-80DE-0913ADF4FFD8}.exe
C:\WINNT\system32\{F22ABAE1-E3C3-4B9B-AA2F-67FA559ADB90}.exe
C:\WINNT\system32\{F4C33F95-09CB-4456-868F-E30282AA905B}.exe
C:\WINNT\system32\{F62BFD22-84DB-48D7-ADBC-CC7238A9F58F}.exe
C:\WINNT\system32\{F75C8CF8-D12C-484C-8D8D-A4855EF6C668}.exe
C:\WINNT\system32\{F7B57FF5-1A4C-4150-A49E-1DE84F9BA512}.exe
C:\WINNT\system32\{FF9240D8-99E1-4E3F-99F1-11A84D3954FD}.exe
C:\WINNT\system32\csqoo.exe
C:\WINNT\SYSTEM32\DMQRS.EXE
C:\WINNT\system32\tazkh.exe
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

AliceSD.dll <<=== Delete the File
barint.exe <<=== Delete the File
lpt.exe <<=== Delete the File
nmdllw.exe <<=== Delete the File
TRPT.exe <<=== Delete the File
Uint32.exe <<=== Delete the File
C:\Documents and Settings\All Users.WINNT\Documents\Settings\1_32bean32_1.dll <<=== Delete the File
C:\WINNT\system32\{02707724-1BDA-41F3-9778-E8B8E6EF41FC}.exe <<=== Delete the File
C:\WINNT\system32\{0448784A-7138-438C-B0AC-E1FD25709728}.exe <<=== Delete the File
C:\WINNT\system32\{055E5639-A132-4A27-813A-24FF2F253989}.exe <<=== Delete the File
C:\WINNT\system32\{095CB3AE-68FB-40F8-8699-BDC3C99AE7D4}.exe <<=== Delete the File
C:\WINNT\system32\{09B9D75E-895D-4390-939E-D657C8885680}.exe <<=== Delete the File
C:\WINNT\system32\{0E3FE2E7-3992-4048-B61B-0FF6292D5BE4}.exe <<=== Delete the File
C:\WINNT\system32\{19E014AC-332A-4F63-AD96-D4CECEDD6832}.exe <<=== Delete the File
C:\WINNT\system32\{1AC8A745-E110-4BEE-BCC5-6DE9E381D469}.exe <<=== Delete the File
C:\WINNT\system32\{237CBF82-4A1A-487F-8A3F-40807CE15451}.exe <<=== Delete the File
C:\WINNT\system32\{27F4577D-2772-457A-8097-726FC190A8DC}.exe <<=== Delete the File
C:\WINNT\system32\{2F9FC97B-0B81-4D8F-A2AE-0A68DCDC8A62}.exe <<=== Delete the File
C:\WINNT\system32\{30E8CA41-B43E-48E9-B7EC-8A9DB49074A4}.exe <<=== Delete the File
C:\WINNT\system32\{3312C7E0-F2F8-46AB-8B74-C053D9AF842D}.exe <<=== Delete the File
C:\WINNT\system32\{3E810A7E-2B7A-4986-A597-BECE258C1181}.exe <<=== Delete the File
C:\WINNT\system32\{4364A0CB-E547-4149-98E2-B05A558EB485}.exe <<=== Delete the File
C:\WINNT\system32\{48A748F9-12C8-4938-B1E5-1A081C9D5205}.exe <<=== Delete the File
C:\WINNT\system32\{48F6D0BC-B57A-42AE-B516-FA8CCBE94B66}.exe <<=== Delete the File
C:\WINNT\system32\{4C71ABAA-52F9-44D5-B662-825D3A8133D8}.exe <<=== Delete the File
C:\WINNT\system32\{4E064B05-F3C7-4C3C-B543-E3C1E2205176}.exe <<=== Delete the File
C:\WINNT\system32\{4F3A71F8-9D5C-46A9-9593-AB85BB081B7E}.exe <<=== Delete the File
C:\WINNT\system32\{53596A10-9D40-4CAC-BBC7-47E1306EBBEE}.exe <<=== Delete the File
C:\WINNT\system32\{5D478AD3-3903-4C3F-A776-93403D82EF06}.exe <<=== Delete the File
C:\WINNT\system32\{5F1B3C3A-E42A-44FD-A99C-DF01B38BCFDF}.exe <<=== Delete the File
C:\WINNT\system32\{5FBAD011-4239-41AC-BFDD-F3485CA14311}.exe <<=== Delete the File
C:\WINNT\system32\{646D7C17-8DA3-4AEC-A8F3-7B726BC749F7}.exe <<=== Delete the File
C:\WINNT\system32\{6823EC2F-9661-4C37-A10C-78844E9EB165}.exe <<=== Delete the File
C:\WINNT\system32\{6C8DB179-DBA6-411F-817C-74B76AC99623}.exe <<=== Delete the File
C:\WINNT\system32\{76F2CF63-6533-458B-914C-6CB7B0A47F33}.exe <<=== Delete the File
C:\WINNT\system32\{7764A7D6-84C9-4A88-89ED-482336CB8D61}.exe <<=== Delete the File
C:\WINNT\system32\{7F49A54A-C655-4ACB-9365-2B962C726C37}.exe <<=== Delete the File
C:\WINNT\system32\{847022B0-1FB7-4597-B154-6A5E7BC8423D}.exe <<=== Delete the File
C:\WINNT\system32\{84C07912-FDFD-4D1B-944A-58FA782FB15B}.exe <<=== Delete the File
C:\WINNT\system32\{8A283D61-1EC0-46C4-953C-17CDF548BEA8}.exe <<=== Delete the File
C:\WINNT\system32\{8AB26439-0C87-4BCC-A065-2F89242B39A6}.exe <<=== Delete the File
C:\WINNT\system32\{90B37612-1639-463D-B014-3EF32B4F8D37}.exe <<=== Delete the File
C:\WINNT\system32\{90FC3D2B-CE29-411C-87D9-8A68A04682C0}.exe <<=== Delete the File
C:\WINNT\system32\{971EA2FE-5411-4072-9134-7E6F24976FBE}.exe <<=== Delete the File
C:\WINNT\system32\{9BBBFEA6-5BBF-4761-8427-2BA309194375}.exe <<=== Delete the File
C:\WINNT\system32\{9F4E721D-EC1A-4FD6-B1D6-554004DFF99E}.exe <<=== Delete the File
C:\WINNT\system32\{ACF1346E-E347-4220-BDC8-828B29EDFD1A}.exe <<=== Delete the File
C:\WINNT\system32\{AF8B452A-7223-428B-96A0-577345D176BE}.exe <<=== Delete the File
C:\WINNT\system32\{B51CBD0A-27B9-43C9-B202-9A7B00394E8A}.exe <<=== Delete the File
C:\WINNT\system32\{BA52C13B-206A-470C-A74B-3B8395685E59}.exe <<=== Delete the File
C:\WINNT\system32\{C0188577-0184-4048-9F7C-DCAF7ECE478B}.exe <<=== Delete the File
C:\WINNT\system32\{C5A1D349-D722-4021-AE67-373EC88040E2}.exe <<=== Delete the File
C:\WINNT\system32\{CCD26C3E-D198-444D-A877-01B6037B06E7}.exe <<=== Delete the File
C:\WINNT\system32\{CE571F5C-60A6-41D4-90CC-416336A95972}.exe <<=== Delete the File
C:\WINNT\system32\{D88786C9-FF21-4ED4-B6FA-2629628C2A5F}.exe <<=== Delete the File
C:\WINNT\system32\{DE39BBE3-28A9-4566-9E48-BCF9007D1AA6}.exe <<=== Delete the File
C:\WINNT\system32\{DFC33430-6262-4E4B-9EFE-826501864AD3}.exe <<=== Delete the File
C:\WINNT\system32\{E6C1C799-7859-4477-B1B4-DEA0AC6D725E}.exe <<=== Delete the File
C:\WINNT\system32\{EA4C868E-D9AD-4F87-84A8-FF64E9DA18DF}.exe <<=== Delete the File
C:\WINNT\system32\{EAD906AD-5B81-4665-AE9C-0F91BFB949CA}.exe <<=== Delete the File
C:\WINNT\system32\{EC009C6C-2D9E-411D-80DE-0913ADF4FFD8}.exe <<=== Delete the File
C:\WINNT\system32\{F22ABAE1-E3C3-4B9B-AA2F-67FA559ADB90}.exe <<=== Delete the File
C:\WINNT\system32\{F4C33F95-09CB-4456-868F-E30282AA905B}.exe <<=== Delete the File
C:\WINNT\system32\{F62BFD22-84DB-48D7-ADBC-CC7238A9F58F}.exe <<=== Delete the File
C:\WINNT\system32\{F75C8CF8-D12C-484C-8D8D-A4855EF6C668}.exe <<=== Delete the File
C:\WINNT\system32\{F7B57FF5-1A4C-4150-A49E-1DE84F9BA512}.exe <<=== Delete the File
C:\WINNT\system32\{FF9240D8-99E1-4E3F-99F1-11A84D3954FD}.exe <<=== Delete the File
C:\WINNT\system32\csqoo.exe <<=== Delete the File
C:\WINNT\SYSTEM32\DMQRS.EXE <<=== Delete the File
C:\WINNT\system32\tazkh.exe <<=== Delete the File

c:\documents and settings\all users.winnt\favorites\Online Pharmacy <<=== Delete the Folder
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

BillyGoat · Jul 24, 2006

Wow, okay done. Here you go. What do you think?

BillyGoat · Jul 24, 2006

FYI, last night after I posted the reply above I disconnected this computer from the internet. CounterSpy ran a scan at its sceduled time and found the same 3 it keeps finding, zlob.media-codec, backdoor.eterok, and Trojan-Proxy.Win32.Xorpix.Fam Backdoor

the copied the report into notepad, TXT below

Shadow_Puter_Dude · Jul 24, 2006

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.

REGEDIT4

[-HKEY_CLASSES_ROOT\Media-Codec.Chl]

[-HKEY_CLASSES_ROOT\Media-Codec.Chl\CLSID {6BF52A52-394A-11D3-B153-00C04F79FAA6}]

[-HKEY_CLASSES_ROOT\vsenchancer.chl]

[-HKEY_CLASSES_ROOT\vsenchancer.chl\CLSID {6BF52A52-394A-11D3-B153-00C04F79FAA6}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\1_32bean32_1reg]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\1_32bean32_1reg DllName C:\Documents and Settings\All Users.WINNT\Documents\Settings\1_32bean32_1.dll]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\1_32bean32_1reg Startup 1_32bean32_1reg]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\1_32bean32_1reg Impersonate 1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\1_32bean32_1reg Asynchronous 1]
Click to expand...

Close Notepad.

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

O20 - Winlogon Notify: 1_32bean32_1reg - C:\Documents and Settings\All Users.WINNT\Documents\Settings\1_32bean32_1.dll (file missing)
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

REBOOT to Safe Mode.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

REBOOT to Normal Mode.

CounterSpy come back clean now?

Post a fresh HijackThis log.

BillyGoat · Jul 24, 2006

Ran into a problem. See HT file attached. There is no 020 line do you still want me to do step 1 as described in your post?

BillyGoat · Jul 24, 2006

Well I figured I would just go ahead and do the second step since O20 wasn't in need of repair.... You guys work miracles, of the non-supernatural kind, but still. Your right the scan cam up clean. Here is a fresh HT. How does it look?

Shadow_Puter_Dude · Jul 24, 2006

Your HijackThis log is clean.

Lets flush all your restore points and create a new clean one for your system.

Disable And Enable System Restore
How to Protect yourself from malware!

Safe surfing.

BillyGoat · Jul 24, 2006

W2K here. I am making sure that I am following the thread to prevent this.

Thank you so very much for all your time and attention. Given the current state of the internet, I am sure I'll be back at some point. Take care, cheers.

Shadow_Puter_Dude · Jul 24, 2006

You're welcome.

Log in or Sign up

R&R Completed, your assistance please

BillyGoat Private E-2

Attached Files:

Activescan.txt

bdscan.txt

hijackthis.log

BillyGoat Private E-2

Attached Files:

CounterSpy.txt

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Attached Files:

report.txt

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Attached Files:

hijackthis.log

BillyGoat Private E-2

Attached Files:

CS072507.txt

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Attached Files:

hijackthis.log

BillyGoat Private E-2

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

R&R Completed, your assistance please

BillyGoat Private E-2

Attached Files:

BillyGoat Private E-2

Attached Files:

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Attached Files:

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Attached Files:

BillyGoat Private E-2

Attached Files:

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Attached Files:

BillyGoat Private E-2

Attached Files:

Shadow_Puter_Dude MG Authorized Malware Fighter

BillyGoat Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

Useful Searches