Internet Explorer 7 Popup Windows

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by hamlin, Apr 10, 2007.

  1. hamlin

    hamlin Private E-2

    Hi,

    Not sure who or when but I think in the last week a trojan/dialler has been downloaded and given permission to use explorer....

    Have done umpteen virus scans (avast); several spyware scans (avg antispyware, spybot, adaware); vundofix (atribune)[found file called tmp5.tmp.dll]. All programs discovered problems and fixed them (HAH), I deleted the quarantine items, toggled system restore.

    And THEN I discovered this forum. :eek:

    Symptoms:
    While in IE7 a separate window will popup, advertising all sorts of things. One even started a dialogue? I was typing at the time (i look at key board not screen) so didn't notice the popup and then it started playing sound- which stopped when I closed IE7.
    A possible separate problem. When shutting computer down or logging off, will not do the task until you log off/ shut down a second time.

    Followed the Read and Run Me first thread
    I was unable to use bitscan. Had to run in normal mode for panda. I have not toggled system restore since following steps 1-7
     

    Attached Files:

  2. hamlin

    hamlin Private E-2

    In addition to the latest AVG antispyware report (which showed nothing), I have attached the same report from 2 days ago.

    Any and all help would be great, TA!
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Start by downloading two tools we will need

    - Process Explorer

    - Pocket KillBox

    Extract them to their own folder somewhere that you will be able to locate them later.

    Make sure you have rebooted in Normal Mode (do not open any other processes)

    Also make sure that one and only one Internet Explorer browser is opened up

    - Run Process Explorer

    In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

    Once you see this screen click on each instance of kbd603.dll once and then click the kill button. After you have killed all of the kbd603.dll under winlogon click ok. (If you do not find the dll, just continue on.)

    Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
    awvtsrp.dll
    d3dvie.dll

    Next double click on explorer.exe and again click once on each instance of kbd603.dll and kill it. (If you do not find the dll, just continue on.)

    Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
    awvtsrp.dll
    d3dvie.dll

    Next double click on iexplore.exe and again click once on each instance of kbd603.dll and kill it. (If you do not find the dll, just continue on.)

    Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
    awvtsrp.dll
    d3dvie.dll

    Now just exit Process Explorer.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {9923f5dc-ed00-41fa-80d5-eb3e172809e3} - C:\WINDOWS\system32\kbd603.dll
    O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\opomkl.dll",setvm
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O20 - Winlogon Notify: d3dvie - C:\WINDOWS\SYSTEM32\d3dvie.dll
    O20 - Winlogon Notify: kbd603 - C:\WINDOWS\SYSTEM32\kbd603.dll

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now run Pocket Killbox by doubleclicking on killbox.exe
    • select File, Cleanup, Delete All Backups
    • Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    • Then after it deletes the files click the Exit (Save Settings) button.
    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\system32\awvtsrp.dll
    C:\WINDOWS\SYSTEM32\d3dvie.dll
    C:\WINDOWS\system32\jkhhg.exe
    C:\WINDOWS\system32\kbd603.dll
    C:\WINDOWS\system32\mllml.exe
    C:\WINDOWS\opomkl.dll
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.
    If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

    If Killbox does not reboot just reboot your PC yourself.

    Now attach the below new logs and tell me how the above steps went.

    1. GetRunKey
    2. ShowNew
    3. HJT


    Make sure you tell me how things are working now!
     
  4. hamlin

    hamlin Private E-2

    Hi Cheers for quick response!!

    Completed.

    Process Explorer:
    I found and killed heaps of the .dll's
    kbd603.dll
    awvtsrp.dll
    d3dvie.dll


    HijackThis:
    O2 - BHO: (no name) - {9923f5dc-ed00-41fa-80d5-eb3e172809e3} - C:\WINDOWS\system32\kbd603.dll
    Did not exsist fixed (instead):
    O2 - BHO: (no name) - {9923f5dc-ed00-41fa-80d5-eb3e172809e3} - C:\WINDOWS\system32\d3dvie.dll


    Pocket Killbox:
    On double clicking killbox.exe Windows installer tried running, Microsoft Publisher 2000 "installing". i had to press cancel a couple of times to stop it and get to killbox. And then...
    After running killbox.exe I did not complete
    * select File, Cleanup, Delete All Backups
    * Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    * Then after it deletes the files click the Exit (Save Settings) button.
    BEFORE Deleting the "system32" files, did the above after a reboot...

    Cheers again, please advise if further actions are required, will continue to run in normal mode till told otherwise. I presume if nothing else I will need to toggle system restore.

    Thanks, Rangi
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Only one bad file seems to remain! Delete the below file manually:

    C:\WINDOWS\system32\geedded.dll

    If you have a problem deleting it, make sure you tell me.


    After doing the above, if you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you run Avenger, you can delete all files related to Avenger now.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    9. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  6. hamlin

    hamlin Private E-2

    Great! Sorted, no weird stuff hapening at the moment. Using firefox as default browser anyhow.

    Will make sure the other users of the computer read through and understand How to Protect yourself from malware!

    Cheers Again, Rangi
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds