Need help attatched hijack this file

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by theguardian, Sep 16, 2005.

  1. theguardian

    theguardian Private E-2

    hello i think i have alot of stuff on here.

    i already did all the steps before i logged into the account and asked for help. so save time for me and the admins
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No you did not! Please go back and run the RavAntirus online scanner as required and run anything else you may have skipped. Then post a new log.

    Also please post the BitDefender and RAv logs.
     
  3. theguardian

    theguardian Private E-2

    ok here is the rav report that is the only thing that i forgot to do.

    thank you
     

    Attached Files:

  4. theguardian

    theguardian Private E-2

    new hijackthis log
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    HJT logs should be posted from normal boot mode but I will see what I can do based on your first log.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Look in Add/Remove programs for WinTools and uninstall if found.

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
    C:\WINDOWS\system32\w?aclt.exe
    C:\Program Files\ipee\othb.exe

    After killing all the above processes, click "Back".
    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O2 - BHO: (no name) - {07854E8B-A363-ABBC-4B31-D138023F92BE} - C:\WINDOWS\system32\xgqfe.dll (file missing)
    O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll (file missing)
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O4 - HKLM\..\Run: [Microsoft WinUpdate] kcoojeqp.exe
    O4 - HKLM\..\Run: [Sound System] WinSound1.exe
    O4 - HKLM\..\Run: [reg1.reg] vuamgard.exe
    O4 - HKLM\..\Run: [Microsoft Update] vpc32.exe
    O4 - HKLM\..\Run: [Microsoft Windows Update] svmhost.exe
    O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
    O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
    O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
    O4 - HKLM\..\RunServices: [Microsoft WinUpdate] kcoojeqp.exe
    O4 - HKLM\..\RunServices: [Sound System] WinSound1.exe
    O4 - HKLM\..\RunServices: [reg1.reg] vuamgard.exe
    O4 - HKLM\..\RunServices: [Microsoft Update] vpc32.exe
    O4 - HKLM\..\RunServices: [Microsoft Windows Update] svmhost.exe
    O4 - HKCU\..\Run: [Microsoft WinUpdate] kcoojeqp.exe
    O4 - HKCU\..\Run: [Sound System] WinSound1.exe
    O4 - HKCU\..\Run: [reg1.reg] vuamgard.exe
    O4 - HKCU\..\Run: [Microsoft Windows Update] svmhost.exe
    O4 - HKCU\..\Run: [Microsoft Update] vpc32.exe
    O4 - HKCU\..\Run: [Xbc] C:\WINDOWS\system32\w?aclt.exe
    O4 - HKCU\..\Run: [Aaou] C:\Program Files\ipee\othb.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\Program Files\Common Files\WinTools <--- the whole folder
    C:\Program Files\ipee <--- the whole folder
    C:\WINDOWS\system32\kcoojeqp.exe
    C:\WINDOWS\system32\WinSound1.exe
    C:\WINDOWS\system32\vuamgard.exe
    C:\WINDOWS\system32\vpc32.exe
    C:\WINDOWS\system32\svmhost.exe
    C:\WINDOWS\system32\E6F1873B.DLL
    C:\WINDOWS\system32\D0CE0C16B1 or C:\WINDOWS\system32\D0CE0C16B.EXE or C:\WINDOWS\system32\D0CE0C16B1.DLL

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now we need to Reset Web Settings:
    1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
  7. theguardian

    theguardian Private E-2

    so far so good but here is my current hijack this log so you can see by the way thank you for all you help i really do appreciate it
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Have HJT fix the below two lines BUT MAKE SURE no browsers (including this one) are open when you click Fix

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)

    Then make sure you Reset Web Settings as in my previous message. Please use the www.majorgeeks.com setting at least temporarily while we are fixing your PC.

    Then post a new HJT log.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds