Remnents of WINmxw32.dll infection and browser hijack

Chev · Nov 22, 2006

G'day people,

Looking for some help with my PC... have got remnents it seems of a virus / spyware in my system. I say remnents, because after running all the diagnostic tools in the "Read and Run this First" sticky, a lot of the baddie bugs "seem" to have dissappeared. Though i still get pop-ups in IE(6). I had been getting complete browser hijacks - redirecting me to a website - "www.eupdate.com" which had bogus anti-spyware and the like. That seems to have stopped (for now), but i'm still getting pop-ups and weird cookies wanting to embed, as soon as i click on IE to start, but before the page has even opened.

Anyway, if i post a HJT log, as well as some of the other logs that i have from running the diagnostics, can someone help me to purge whats left in the system. Looks like it may still have some deep rooted registry changes or something, but i'm not quite sure what to delete, and what not too...

Thanks in advance,
Danno.

Chev · Nov 22, 2006

and some more logs...

Chev · Nov 22, 2006

Unfortunately the Bit Defender logs dont show anything now. I ran this scan very late - actually in the early hours of the morning, and it did detect and remove / delete a lot of stuff. I didnt realise at the time, plus the brain was switching off that i had to manually export the log.

Chev · Nov 22, 2006

Ran VundoFix and it picked up a few items.

Here is the log file of that.

Chev · Nov 22, 2006

And follows is a new HJT log file...

Chev · Nov 22, 2006

After reading another post - i've run a fresh Pandascan with this log file, followed by a fresh HJT log file.

Chev · Nov 22, 2006

reading thru another thread, i thought i would try the SmitFraudFix program, and PC-Cillan detected the program dumphive.exe in the SFF program as a virus/spyware. Is this right?

chaslang · Nov 22, 2006

I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

STEP 1: Complete this procedure completely including attaching the requested log before doing the second procedure.

Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach that log in your next reply.

Note:process.exe ( which is used my SmitFraudFIx ) is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. The below is a link to what process.exe is.

http://www.beyondlogic.org/consulting/proc...processutil.htm

IMPORTANT: Do NOT run any other options until you are asked to do so!
Click to expand...

STEP 2: PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting.

Please print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. Again, if there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer into Safe Mode : Starting your computer in Safe mode

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

Now reboot into normal mode and attach this new rapport.txt log here.
Click to expand...

Now attach new logs from:

GetRunKey

ShowNew

HJT

How are things working now?

Chev · Nov 22, 2006

Here is the log file of STEP 1 :

appreciate the help...

Chev · Nov 22, 2006

STEP 2 :

rapport2 is the saved text file from clean in safe mode.

rapport3 is the search again after rebooting from previous clean.

rapport4 - ran the clean again.

Now back in normal mode. Machine seems to be behaving itself. No funny pop ups, no browser hijacking. That might be it?

Chev · Nov 22, 2006

Should i post a HJT log now?

Chev · Nov 22, 2006

Here is my latest HJT log, just to be on the safe side.

Thanks
Danno.

Chev · Nov 22, 2006

Oh and here are the latest two
GetRun
and
Shownew files...

Chev · Nov 22, 2006

This site is unreal - the panacea of Malware and spyware. You blokes are doing an excellent job.

chaslang · Nov 23, 2006

Make sure viewing of hidden files is enabled (per the tutorial).

Uninstall the below software:
J2SE Runtime Environment 5.0 Update 8
Safety Bar
Now install the current version of Sun Java from: Sun Java Runtime Environment

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\hwxcipjm.exe
C:\WINDOWS\system32\whsgixil.exe
Now run Ccleaner.

Now locate the below folder and delete it if found:
C:\Program Files\VSAdd-in

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\Documents and Settings\Danno\Local Settings\Temp

Now attach the below new logs and tell me how the above steps went.

GetRunKey

ShowNew

HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

Chev · Nov 27, 2006

chaslang said:

Uninstall the below software:
J2SE Runtime Environment 5.0 Update 8 (Done)
Safety Bar (Done)
Now install the current version of Sun Java from: Sun Java Runtime Environment (Done)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\VSAdd-in\VSAdd-in.dll (Couldnt find this file.)
C:\WINDOWS\system32\hwxcipjm.exe - (Done)
C:\WINDOWS\system32\whsgixil.exe - (Done)
Now run Ccleaner.

Now locate the below folder and delete it if found:
C:\Program Files\VSAdd-in - (File not found)

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day). -
C:\Documents and Settings\Danno\Local Settings\Temp - (Done)
Click to expand...

Deleted files as found.

Here are the latest log files thanks Chaslang.

Chev · Nov 27, 2006

I've got to say it again mate, thanks for your help.

As i worked all weekend, (i'm a sparky out there IRL), i havent been back here for the last couple of days. This post of mine was buried back on around page 6 or 7...
I mention that because it looks like lots of people are constantly requesting your help. How many of you are there helping on this site? It looks like its almost a full time job.
What are you doing for a crust - programmer or sys admin?

Anyway, thanks for your help so far. Oh BTW, is this PC ready for a system restore "toggle" yet?

Danno.
Australia.

chaslang · Nov 27, 2006

Not according to your newfiles.txt log. The below shows:

Code:

"C:\Documents and Settings\Danno\Local Settings\Temp\"
control.xml   27 Nov 2006         717  "control.xml"
HSPERF~1      27 Nov 2006              "hsperfdata_Danno"
java_i~1.log  27 Nov 2006        1040  "java_install_reg.log"
java_i~2.log  27 Nov 2006       23584  "java_install.log"
jusched.log   27 Nov 2006        1462  "jusched.log"
kcbyheqk.exe  22 Nov 2006        7911  "kcbyheqk.exe"
nbjuqres.exe  22 Nov 2006        7911  "nbjuqres.exe"
pogbyxuy.exe  21 Nov 2006        7911  "pogbyxuy.exe"
rfoujxbc.exe  21 Nov 2006        7911  "rfoujxbc.exe"
vhieityk.exe  21 Nov 2006        7911  "vhieityk.exe"

The last 5 files (the exe files) all should have been deleted. Why do the still show? They have been there since Nov 21st.

chaslang · Nov 27, 2006

Chev said:

I've got to say it again mate, thanks for your help.
Click to expand...

You're welcome!

Chev said:

How many of you are there helping on this site? It looks like its almost a full time job.
What are you doing for a crust - programmer or sys admin?
Click to expand...

There are about 5 of us who help out in this forum. 4 of which will spend time fixing problems and 1 who mostly polices and posts the READ & RUN ME message. And then out of the 4 only two of us have been really active over the last few months. No I'm not a Sys Admin. I'm an R&D engineer in telecommunications.

Chev said:

Anyway, thanks for your help so far. Oh BTW, is this PC ready for a system restore "toggle" yet?
Click to expand...

Not until I'm sure those files have gone away. Once I know they are gone by seeing a new log, I will give you final instructions.

Chev · Nov 28, 2006

Sorry mate,
I wasnt even aware to delete these ones. When it comes to malware deletion/removal i'm still pretty newbie...

Anyway, i've deleted these specific ones. Is the give away the common byte size on all these rogue files? (7911 bytes)

New runkey, shownew and hjt logs attached.
chaslang said:
Not according to your newfiles.txt log. The below shows:
Code:
"C:\Documents and Settings\Danno\Local Settings\Temp\"
...
kcbyheqk.exe  22 Nov 2006        7911  "kcbyheqk.exe"
nbjuqres.exe  22 Nov 2006        7911  "nbjuqres.exe"
pogbyxuy.exe  21 Nov 2006        7911  "pogbyxuy.exe"
rfoujxbc.exe  21 Nov 2006        7911  "rfoujxbc.exe"
vhieityk.exe  21 Nov 2006        7911  "vhieityk.exe"
The last 5 files (the exe files) all should have been deleted. Why do the still show? They have been there since Nov 21st.
Click to expand...

Chev · Nov 28, 2006

Chaslang,

looking thru my newest newfile.log it looks cleaner, well those files you suggested deleted are gone anyway.

What are these, and do they need to go?

Code:


File Name: "newfiles28Nov2006-2004hrs.txt"
                                                                              
Locating C:\WINDOWS\TEMP files created with in the last 90 days.                

"C:\WINDOWS\Temp\"
mpcmdrun.log  28 Nov 2006        4972  "MpCmdRun.log"
wgaerr~1.txt  28 Nov 2006         255  "WGAErrLog.txt"
wganot~1.set  28 Nov 2006         409  "WGANotify.settings"
[B][COLOR=red]xx62          28 Nov 2006           0  "xx62"
xx63          28 Nov 2006           0  "xx63"
xx64          28 Nov 2006           0  "xx64"
xx65          28 Nov 2006           0  "xx65"
xx66          28 Nov 2006           0  "xx66"[/COLOR][/B]

8 items found:  8 files, 0 directories.
   Total of file sizes:  5,636 bytes      5.50 K

chaslang · Nov 29, 2006

Chev said:

Sorry mate,
I wasnt even aware to delete these ones. When it comes to malware deletion/removal i'm still pretty newbie...
Click to expand...

You were not supposed to have to delete them manually. Running CCleaner should have removed them!

Chev said:

Anyway, i've deleted these specific ones. Is the give away the common byte size on all these rogue files? (7911 bytes)
Click to expand...

It is more the strange filenames and the fact that they were new files that made them standout. The common file size just added to their questionable nature.

Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.

If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.

If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.

If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created

If you are running Windows XP or Windows ME, do the below:

go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

chaslang · Nov 29, 2006

Chev said:

What are these, and do they need to go?

Code:

 
File Name: "newfiles28Nov2006-2004hrs.txt"
 
Locating C:\WINDOWS\TEMP files created with in the last 90 days.                
 
"C:\WINDOWS\Temp\"
mpcmdrun.log  28 Nov 2006        4972  "MpCmdRun.log"
wgaerr~1.txt  28 Nov 2006         255  "WGAErrLog.txt"
wganot~1.set  28 Nov 2006         409  "WGANotify.settings"
[B][COLOR=red]xx62          28 Nov 2006           0  "xx62"[/COLOR][/B][COLOR=red]
[B]xx63          28 Nov 2006           0  "xx63"[/B]
[B]xx64          28 Nov 2006           0  "xx64"[/B]
[B]xx65          28 Nov 2006           0  "xx65"[/B]
[B]xx66          28 Nov 2006           0  "xx66"[/B][/COLOR]
 
8 items found:  8 files, 0 directories.
   Total of file sizes:  5,636 bytes      5.50 K

Click to expand...

They are just temp files related to things you are running or from things Windows itself is doing. Anything in temp folders is normally deleteable!

Chev · Nov 30, 2006

Thanks again mate,

Appreciate the help. Are you in the US or australia?

Dan.

Chev · Nov 30, 2006

Just wondering where to send the carton? (Beer).

chaslang · Dec 1, 2006

You're welcome!

Chev said:

Appreciate the help. Are you in the US or australia?
Click to expand...

I'm right where my Location indicator specifies. Which is in the USA.

Remnents of WINmxw32.dll infection and browser hijack

Chev Private E-2

Attached Files:

Chev Private E-2

Attached Files:

Chev Private E-2

Chev Private E-2

Attached Files:

Chev Private E-2

Attached Files:

Chev Private E-2

Attached Files:

Chev Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Chev Private E-2

Attached Files:

Chev Private E-2

Attached Files:

Chev Private E-2

Chev Private E-2

Attached Files:

Chev Private E-2

Attached Files:

Chev Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Chev Private E-2

Attached Files:

Chev Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Chev Private E-2

Attached Files:

Chev Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Chev Private E-2

Chev Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches