virushelpzone hijack/trojan?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by crookedheart, Jul 19, 2006.

  1. crookedheart

    crookedheart Private E-2

    So, like the other two threads on virus help zone, this came through an msn link.

    Both IE and Firefox default to virushelpzone.com as the home page and it resets if you change it.

    Norton no longer works, Hijack This no longer works (except in safe mode) and many websites with removal tools are unaccessible.

    I have run through the "read this tutorial".

    Windows defender gives a warning about a possible host hijack on start-up, but is unable to remove it.

    I have attached my hijack this log from a scan run in safe mode.

    I hope someone can help.

    Thanks so much.
     

    Attached Files:

  2. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    I dont think you did all the steps. I dont see the online scans you needed to do in the log file.

    NOTE: Our main malware fighter, Chaslang, is on vacation. Responses may be very slow for the coming week.

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
      • Bitdefender
      • Panda Scan
      • HijackThis
    .
     
  3. crookedheart

    crookedheart Private E-2

    sorry, i thought i had posted this in the original message.

    I am unable to get to bitdefender, it seems to be like the symantec site, blocked.

    i was unable to do the panda active scan before, but have since managed to get it to work.

    here is the new hjt, the active log and also the kapersky log.

    also. after running a few scans/removals i'm getting this message upon booting in normal mode.

    followed by a prompt to either reinstall or delete the registry entry.
     

    Attached Files:

    Last edited: Jul 20, 2006
  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Your HijackThis log is from Safe Mode, I need one from Normal Mode.
     
  5. crookedheart

    crookedheart Private E-2

    HJT isn't running in normal mode. It freezes up the whole system.

    I read in the other thread on this issue that the other fellow had the same problem, and he was told to run it in safe mode, so that's what I did.

    i've also tried renaming it "hjt.com" but it still doesn't work.
     
    Last edited: Jul 21, 2006
  6. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Rename hijackthis.exe to analyse.exe.
     
  7. crookedheart

    crookedheart Private E-2

    wow! Magic :)

    thanks, i now have a hjt log from normal mode.

    here it is.
     

    Attached Files:

  8. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    HijackThis not installed properly; move HijackThis to C:\Program Files\HJT. Do this now, before proceeding.

    Empty the Norton Antivirus Quarantine Folder
    Empty the Norton Protected Recycle Bin
    Empty the Recycle Bin

    Uninstall the Zango Toolbar

    Download
    - Pocket Killbox
    - ExplorerXP

    Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:
    Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

    Now run Pocket Killbox:

    Choose Tools -> Delete Temp Files and click the RED X.

    Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.
    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Now boot into SAFE MODE

    Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)
    Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

    Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.

    REBOOT to Normal Mode.

    Follow the directions in How to Reset Web Settings.

    Post a fresh HijackThis log.
     
  9. crookedheart

    crookedheart Private E-2

    HJT moved. Zango removed.

    Everything went smoothly.

    During the day, while I was at work, the um... "Dad virus" re-installed Norton:mad: , which kind of worked, but it doesn't seem to be able to update.

    However, I am able to access the Symantec site now.

    Also, when I was downloading the tools for the original "read this first", I had to download from mirrors, because I could not access many of the "author's site"s. I instead received an error that Firfox was unable to access those servers.

    Now, I can access all of the sites, except one. Bitdefender.com still will not load.

    Also, Norton, still randomly freezes and some program is trying to access the internet (I don't know what it's called, as it happened while someone else was on the computer but they knew it was a *.exe that they didn't recognize.)

    I have since run everything that Shadow Puter Dude asked me to so I'm currently hoping that either it is gone now(best) or that it will try to access the internet while I'm here so I can copy it down.

    Here is my new HJT log,

    Thank you so much.
     

    Attached Files:

  10. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Is this really the Start page for IE, C:/HP/REGION/start.html?

    There are many applications that require acess to the Internet. Many of which, you'll not recognize the name. In those cases it is best to block access until you can determine what the program is and what it does.

    Norton may have to be fully uninstalled, and then reinstalled; to get it to behave. If you are experiencing any problems with Norton.

    Even though Norton is the top selling AV application, it's not the most effective. The top selling AV apps miss many viruses; because the malware developers test their viruses against Norton, McAfee, Trend Micro and a few others to make sure they are not detectable; before the virus is relased into the wild.

    Otherwise the sytstem appears to be clean.

    Lets flush all your restore points and create a new clean one for your system.

    Disable And Enable System Restore
    How to Protect yourself from malware!

    Safe surfing.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds