Welcome Home to Lots of Viruses!

Welcome to Major Geeks!


Start by downloading two tools we will need

- Process Explorer

- Pocket KillBox

Extract them to their own folder somewhere that you will be able to locate them later.

Make sure you have rebooted in Normal Mode (do not open any other processes)

Make sure that one and only one Internet Explorer browser is opened up

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of any of the below DLL files (if found) and then click the
kill button.
hpbahpb.dll
ipv6monq.dll
ipv6monr.dll
jxaztfoh.dll
stp68_2007.dll
txgobwwx.dll
txjebshc.dll

After you have killed all instances of any of the above DLLs under winlogon click ok.
(If you do not find these DLLS, just continue on.)

Next double click on explorer.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll
ipv6monq.dll
ipv6monr.dll
jxaztfoh.dll
stp68_2007.dll
txgobwwx.dll
txjebshc.dll

After you have killed all instances of any of the above DLLs under Explorer click ok.
(If you do not find these DLLS, just continue on.)

Next double click on iexplore.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll
ipv6monq.dll
ipv6monr.dll
jxaztfoh.dll
stp68_2007.dll
txgobwwx.dll
txjebshc.dll

After you have killed all instances of any of the above DLLs under iexplore click ok.
(If you do not find these DLLS, just continue on.)

Now just exit Process Explorer.

Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {48EA419A-4BC5-4C1F-B045-DBAE871C060A} - c:\windows\system32\hpbahpb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O4 - HKLM\..\Run: [dcdnwvdm] C:\WINDOWS\system32\dcdnwvdm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [dcdnwvdm] C:\WINDOWS\system32\dcdnwvdm.exe
O20 - AppInit_DLLs:
O20 - Winlogon Notify: nfhakpga - C:\WINDOWS\SYSTEM32\hpbahpb.dll
O20 - Winlogon Notify: stp68_2007 - stp68_2007.dll (file missing)

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue. After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. ShowNew
4. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

This infection is still there. Let's try another method of fixing this.

First uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
C:\Documents and Settings\All Users\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software


Now download install and update Prevx1 then run a full scan and fix what it finds. See if you can save a log and attach it. Then also attach a new HJT log.

 

Okay you are the second person to indicate that Prevx does not fix something that they claim to fix. Oh well, I guess we will not be trying it anymore. Please uninstall it now.


Now please download ProcessDLL.zip and save to your desktop.

Extract the ProcessDll.exe file from inside and run it.

This will create a new file on your Desktop called procdll.txt

Attach this log as your next post.


Also run this: Using Sophos Anti-Rootkit and attach the requested log from it.


Do you have a bootable Windows XP SP2 installation CD? Chances are very high that we are going to need it to try and fix this.

 

Also please do the below. DO NOT REBOOT at anytime while doing the below and DO NOT power down or reboot after attaching new logs. Wait until I give you the next steps.

Download the below two tools and extract them to a folder of there own.
You can put both into the same folder.

• Filemon for WinNT/2K/XP - Additional informaton and help for Filemon can be found here: Filemon
• RegMon for NT,2000,XP - Additional informaton and help for Filemon can be found here: Regmon

First let's just setup Filemon.

• Run Filemon by double clicking on filemon.exe
• When it comes up, change the *.* in the Include box to be hpbahpb.dll; ungjjhjm.sys The semicolon between the two filenames is required.
• Then click Apply and OK.
• The Filemon window now comes up and will monitor for anything accessing hpbahpb.dll or ungjjhjm.sys
• Now just leave this running and continue.

Now go back and run the Process Explorer procedure to unhook hpbahpb.dll from winlogon.exe, explorer.exe, and iexplore.exe (also unhook it from csrss.exe which we did not do before). After doing this, try fixing the below two lines with HJT:

O2 - BHO: (no name) - {48EA419A-4BC5-4C1F-B045-DBAE871C060A} - c:\windows\system32\hpbahpb.dll
O20 - Winlogon Notify: nfhakpga - C:\WINDOWS\SYSTEM32\hpbahpb.dll

Now exit HJT.

Now delete the below files!
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\48EA419A-4BC5-4C1F-B045-DBAE871C060A.dat
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\48EA419A-4BC5-4C1F-B045-DBAE871C060A.ini
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\48EA419A-4BC5-4C1F-B045-DBAE871C060A.txt


Now go back to the Filemon screen and click File and then uncheck the Capture Events selection to stop the capture process. Then use File, Save As to save the log to a file like filemon.log and post it back here as an attachment.

Now attach new logs from ShowNew and HJT!

 

Make sure you have rebooted in Normal Mode (do not open any other processes)

• Make sure that one and only one Internet Explorer browser is opened up!
• Also shutdown ALL other processes including Instant Messengers, antivirus and antispyware tools!

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll
libssl32.dll
libeay32.dll
jxaztfoh.dll
mgyyumjw.dll


After you have killed all instances of any of the above DLLs under winlogon click ok.
(If you do not find these DLLs, just continue on.)

Next double click on explorer.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll
txgobwwx.dll
libssl32.dll
libeay32.dll
txjebshc.dll
jxaztfoh.dll
mgyyumjw.dll


After you have killed all instances of any of the above DLLs under Explorer click ok.
(If you do not find these DLLs, just continue on.)

Next double click on iexplore.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll
txgobwwx.dll
libssl32.dll
libeay32.dll
txjebshc.dll
jxaztfoh.dll
mgyyumjw.dll

After you have killed all instances of any of the above DLLs under iexplore click ok.
(If you do not find these DLLs, just continue on.)

Next double click on csrss.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll

After you have killed all instances of any of the above DLLs under iexplore click ok.
(If you do not find these DLLs, just continue on.)

MAKE SURE YOU READ THE BELOW NOTE ABOUT MULTIPLE SVCHOST.EXE PROCESSES!!!!


Next double click on svchost.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
hpbahpb.dll
libssl32.dll
libeay32.dll
jxaztfoh.dll
mgyyumjw.dll

After you have killed all instances of any of the above DLLs under iexplore click ok.
(If you do not find these DLLs, just continue on.)

NOTE: There will be multiple instances of svchost.exe running. YOU MUST CHECK EACH ONE and kill the above DLLs in each one if found. I suspect that only one will have them, but there is no way for me to tell you which on.


Now just exit Process Explorer.

Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {48EA419A-4BC5-4C1F-B045-DBAE871C060A} - c:\windows\system32\hpbahpb.dll
O20 - Winlogon Notify: nfhakpga - C:\WINDOWS\SYSTEM32\hpbahpb.dll


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. ShowNew
4. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

You have a new type of infection that is not very well known as of yet. There are no known fixes yet for this infection. It is possible that booting to the Recovery Console from your original Windows XP CD (if you have one) can be used to delete the files. But if the infection has other files hidden somewhere, they could reinfect you at normal startup. The only way to know would be to try.

However at this point (especially since you have time constraints), it may be faster to format and reinstall Windows.

If means you did not get NEW logs. You have to run the programs again to get new logs. You are trying to attach the exact same files as last time.

 

You don't need to do that! What I would suggest is:

• to back up any important personally data and settings first.
• get copies of your antivirus, antispyware, and firewalls onto a CD so they can be reinstalled after the format but before conntecting the PC to the internet.
• then boot from the Windows CD and delete the current partition.
• then recreate the partition
• then format
• then reinstall Windows
• then install the protection software mentioned above
• then connect the PC to the internet and download ALL updates for Windows and for your protection software
• then start reinstalling all other required application.....etc.

Double click on the files and look at the date and time inside the files (about 15 lines down in the log). What do you see in each file?