Please help... I have all the appropriate scans

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Shawn Cox, Dec 4, 2006.

  1. Shawn Cox

    Shawn Cox Private E-2

    I believe I have issues with Smitfraud-C. I may also have SpySheriff, Win32.lager.aq, and CoolWWWSearch.smartsearch problems. Any help/suggestions would be greatly appreciated.

    Thanks,
    Shawn

    I will attach my second three scans on the following post.
     

    Attached Files:

  2. Shawn Cox

    Shawn Cox Private E-2

    Here are the rest of my scans.

    Thanks,
    Shawn
     
  3. Shawn Cox

    Shawn Cox Private E-2

    here is the rest
     
  4. Shawn Cox

    Shawn Cox Private E-2

    Final Three scans to my first thread

    Sorry, I don't think this was in my reply. Here you go.
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: Final Three scans to my first thread

    Welcome to Majorgeeks!

    You did not get HijackThis renamed properly ! You need to rename the executable program not the folder you save it too. You have this:

    C:\Program Files\analyse.exe\HijackThis.exe

    What we asked for is:

    C:\Program Files\HJT\analyse.exe

    Also your HJT log appears to have been obtained out of order before the other scans were completed. Wait until finishing the below before attaching a new HJT log.

    Also you did not follow the directions for installing and using ShowNew. You did GetRunKey okay but not ShowNew. Wait until finishing the below before attaching a new ShowNew log.

    Make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\System32\ipv6mons.dll (file missing)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\ipv6mons.dll
    C:\WINDOWS\System32\nordsys.exe
    c:\windows\system32\taskdir.exe
    c:\windows\system32\ts.ico
    c:\windows\dialup.exe
    c:\windows\waol.exe
    c:\windows\x.exe
    C:\WINDOWS\system32\1821.exe
    C:\WINDOWS\system32\adir.dll
    C:\WINDOWS\system32\iepnjaso.exe
    C:\WINDOWS\system32\instreg_tmp.exe
    C:\WINDOWS\system32\sklmnf.exe
    C:\WINDOWS\system32\sumsw32.exe

    Now run Ccleaner.

    Now reboot in normal mode
    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now attach the below new logs and tell me how the above steps went.

    1. GetRunKey
    2. ShowNew
    3. HJT


    Make sure you tell me how things are working now!
    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    Last edited: Dec 5, 2006
  6. Shawn Cox

    Shawn Cox Private E-2

    Thanks for the advice in your last message. I attached a hijackthis file for your review. Additionally, When I tried to attached a GetRunKey text file and ShowNew text file a message came up saying that I had already posted those files in the thread. I tried renaming the files slightly and that didn't work either. Any suggestions?

    Anyway, my computer is running much better. Thanks for bringing it back to life. I followed everything you said to do. The only trouble I had was in trying to delete some of the files you mentioned. I could not find the following files to delete and I remember to make sure my computer was set to reveal hidden files:

    C:\WINDOWS\System32\ipv6mons.dll
    C:\WINDOWS\System32\nordsys.exe
    C:\WINDOWS\system32\1821.exe
    C:\WINDOWS\system32\iepnjaso.exe

    All others were deleted in safe mode followed by running ccleaner.

    Please advise as to any further steps I should take. I did notice that when I bring up internet explorer I am still seeing "about:blank" appear in the window.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes! Follow the directions in the download links for both programs and EXTRACT the files from the ZIP file and run the programs as requested from a Windows Explorer session. You are not doing this for ShowNew based on the log you attached. Your GetRunKey log reveals that ShowNew.bat is still inside the ShowNew.zip file. Your GetRunKey log was okay meaning you installed it correctly. Since you could not attach the logs this time, it means you did not rerun the programs to get a new log (that is why the files are still the same).

    Please follow those directions for ShowNew and rerun the .bat files and attach the logs! You can even extract the ShowNew.bat file into the same folder as GetRunKey.bat which can simplify things.

    You still have problems to fix but I need those logs to continue.
     
    Last edited: Dec 7, 2006
  8. Shawn Cox

    Shawn Cox Private E-2

    Hopefully, everything was done correctly on my end this time. Thanks for being patient. This is all very new to me.
     

    Attached Files:

  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Now you got it! ;)

    Since you have a paid version of Ad-Aware SE Pro installed, you should uninstalll the trial version of CounerSpy now! Do this before continuing.

    Continue by downloading a tools we will need - Pocket KillBox

    Save it to its own folder somewhere that you will be able to locate it later.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\System32\taskdir.exe

    After clicking Fix, exit HJT.

    Now run Pocket Killbox by doubleclicking on killbox.exe
    Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    Then after it deletes the files click the Exit (Save Settings) button.
    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


    C:\WINDOWS\accesss.exe
    C:\WINDOWS\clrssn.exe
    C:\WINDOWS\systeem.exe
    C:\WINDOWS\systemcritical.exe
    C:\WINDOWS\time.exe
    C:\WINDOWS\users32.exe
    C:\WINDOWS\win32e.exe
    C:\WINDOWS\win64.exe
    C:\WINDOWS\window.exe
    C:\WINDOWS\winmgnt.exe
    C:\WINDOWS\y.exe
    C:\WINDOWS\system32\fhccrxox.exe
    C:\WINDOWS\system32\proqlaim.exe
    C:\WINDOWS\system32\smartdrv.exe
    C:\WINDOWS\System32\taskdir.exe
    C:\WINDOWS\System32\taskdir.dll
    C:\WINDOWS\system32\yuvafnso.exe
    C:\WINDOWS\system32\asgp32.dll
    C:\WINDOWS\system32\smaexp32.dll
    C:\WINDOWS\system32\MRT.INI
    C:\WINDOWS\system32\winlogon.ini
    C:\WINDOWS\system32\lfd.dat
    C:\WINDOWS\system32\lrf.dat
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.
    If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

    If Killbox does not reboot just reboot your PC yourself.

    Now attach the below new logs and tell me how the above steps went.

    1. GetRunKey
    2. ShowNew
    3. HJT
    Make sure you tell me how things are working now!

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  10. Shawn Cox

    Shawn Cox Private E-2

    Thanks for all of your help. My computer is running well. I still have 53 running processes. Shouldn't I have around 43-48? Anyway, here are the attachments you requested. Please advise with any further instructions.
     
  11. Shawn Cox

    Shawn Cox Private E-2

    Sorry...here are the attachments
     

    Attached Files:

  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    There is no set number that anyone should expect to see running. Every PC is different and has different base requirements. Laptops typically show more process running at startup than Desktops. People running internet security suite type applications will always hae a lot more process running than some one who just installs separate antivirus, antispyware, and firewall applications that don't have the massive overhead of security suites.


    Your log is clean. If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds