Serious adware problem

Greetings,

My computer has been badly infected with adware and I'm really having trouble removing it. I have tried the method on this page but the problems still remain.

The software I'm using (CounterSpy, SpyBot and also the ones in the Google pack) always detect adware.cinmus and adware.sogou. Occasionally when I start up, odd software has been installed. For example, this morning "easynet" was installed with a shortcut on my desktop. Despite removing these they still appear when rebooting.

Here is my HijackThis log:

Edit : Removed HJT log for guide to be fully run and all logs attached.


I would be very greatful if you could help me solve this.

David

 

Neverending spyware problem

Greetings,

My computer has been badly infected with adware and I'm really having trouble removing it. I have tried the method on this page but the problems still remain.

The software I'm using (CounterSpy, SpyBot and also the ones in the Google pack) always detect adware.cinmus and adware.sogou. Occasionally when I start up, odd software has been installed. For example, this morning "easynet" was installed with a shortcut on my desktop. Despite removing these they still appear when rebooting.

I have attached a log to this post.

David

 

Re: Neverending spyware problem

jdm2104,

I have merged your threads together so please post here from now on.

It appears you have still not followed the READ & RUN ME, please go back to Halo's post (post #2) and complete the required steps and then post the requested logs.

I will check back a little later.

 

Here are the first three log files

• CounterSpy
• Bitdefender
• Panda Scan

 

Here are the final three:

• GetRunKey
• ShowNew
• HijackThis

 

Many problems were found during all these scans. However, not all could be fixed. A common one was Adware.Sogou and Adware.Cinmus. I noticed alot were found by the BitDefender in the system restore files.

Please let me know if you require any more information.

Thank you for your help.

 

Let's start the fix by running the below utility.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Once you have completed the scan above, reboot with the following fresh logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• ComboFix Log

 

As requested here is the combofix file. The other files requested will follow.

 

The three additional files as requested (combofix in the last post)

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 4:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 5: Begin here after rebooting from Step 4!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 6:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Step 7:
Finally, I would like you to install thew current version of Sun Java: Sun Java Runtime Environment


Step 8:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi,

I have followed the instructions though and attached the required files.

In step 6 I wasn't sure what to do as the web browser I use (Flock) is not on the list. So I have changed back to using IE6. I deleted the cookies etc. from Flock though as well.

I few problems I have noticed:

1) A program called 85211.exe gets blocked by counterspy occasionally.
2) When shutting down the pc I get a "nvsvc.exe" error.
3) Web browser popups are usually from Chinese sites, specifically (6.cn)

Thanks,

David

 

and the avenger log

 

Another warning from Counterspy:

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 4:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 5: Begin here after rebooting from Step 4!
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 6:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Here are the latest log files:

 

and the avenger file

 

Have HJT fix the below entries..

O2 - BHO: Invoke Class - {42A3A616-FF3C-4713-A5C2-4F1B566CEF51} - C:\WINDOWS\system32\b851.dll (file missing)
O4 - HKLM\..\RunOnce: [dj6fn6a] %systemroot%\system32\Rundll32.exe %systemroot%\system32\dj6fn6a.dll,DllUnregisterServer

Next we need to manually remove an entry from the registry.

Click Start > Run > type regedt32 and press ENTER.

Navigate to the following key:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\RunOnce

On the right hand side, locate dj6fn6a and right click on it. Select delete, note any errors if any come up.

Next, please follow the below...

• Now Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
• On the page that opens, scroll down to ms_2fax
• Then right click the entry, select Properties and press Stop Service.
• When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
• Click OK until you get back to Windows.

• Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
• At the lower right, click on the Config button
• Then click the Misc tools button
• Select Delete an NT Service
• Copy/pastems_2fax into the box that opens, and press OK
• If you receive any error messages just ignore them and continue.
• Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

Once you complete the above, download and run CCleaner.

Once you have completed this post, reboot and attach the following fresh logs.

• GetRunKey
• ShowNew
• HijackThis

 

When I navigated to:

There was no entry "dj6fn6a", there was only "Default" in the right hand pane of regedit. Shall I continue with the next steps?

Regards,

David

 

Yes, just continue.

 

Here are the logs:

 

Step 1:
Scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Next we need to run Avenger like we did before…
[*]Run avenger.exe by double-clicking on it.
[*]Check the 'Input script manually' box.
[*]Click on the magnifying glass icon.
[*]Copy everything in the Quote box below, and paste it in the box that opens:[/LIST]

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 3: Begin here after rebooting from Step 2!
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 4:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi,

I got an error loading "dj6fn6a.dll" when avenger rebooted my pc. Justed clicked ok and then continued with no problems.

The new logs:

 

The other log. Thanks for your time by the way!

 

Please download F-Secure's BlacklightBeta

• Download fsbl.exe and save it to the Desktop.
• Once saved... double click fsbl.exe to install the program.
• Click accept agreement and Click scan
• This application may trigger a warning from your antivirus. Let the driver load. Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please attach the BlackLight log.

 

The fsbl scan didn't find anything but I have attached the log.

I got "error loading dj6fn6a.dll" when restarting this morning.

Thanks

 

This is a good thing because it means the file no longer exist and there are just some leftovers we need to remove.

Please download RegSrch.zip

Unzip the archive to your desktop and double click on the VBS file.
(If your AntiVirus alerts, allow the script to run.

Now enter dj6fn6a.dll and post back with the results in this thread (call it regsrch.txt).

 

Nothing found by this software. A box just displayed after it had finished saying:

"Search completed in 56 Seconds. No instances of "dj6fn6a.dll" found."

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 3:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 4:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi,

Here are the latest logs:

 

The "error loading" upon startup is the only thing to report.

Avenger log attached.

 

First, uninstall Spybot - Search & Destroy and Spyware Doctor 5.0.

Next, reboot into Safe Mode and run the below fix.

Once in Safe Mode have HJT fix the below entries...

Next run the below...

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Once you complete this reboot back to normal mode and attach the following fresh logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

 

The new logs:

 

and runkeys

 

Have HJT fix this entry..

Run Avenger once more...

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Attach a fresh GetRunKey & HijackThis log once completed.

 

jdm2104,

Go to http://virusscan.jotti.org and upload the file below...

Post back with the results.

 

Scanned at Jotti but it found nothing wrong with that file in all scans. It said "status ok" after completing.

I've attached the runkeys and HJT logs.

Thank you.

 

Okay! Let's get new logs from..

• ShowNew Log
• GetRunKey Log

 

Latest logs.



P.S I found easynet on my desktop again yesterday so uninstalled it from add/remove programs.

 

Also, I notice something from Symantec in your logs, have you or are you using anything Symantec such as Norton AntiVirus?

 

Yes I have got the Norton Security Scan from the Google pack installed.

 

Okay! I'm not familiar with that but if it's somethat that runs actively shut it down.

Let's try this fix once more.

Begin here...
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 3:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 4: Begin here after rebooting from Step 3!
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 5:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Not sure if the Norton scan works actively. However, I have removed it anyway. Please find the logs attached.

 

Runkeys

 

Let's try this, run Avenger like you have been running it. Copy the below...

Once you have completed the above and have rebooted add the below reg fix.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file trytofixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the trytofixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

 

Also, please run the below..

Please download RegSrch.zip

Unzip the archive to your desktop and double click on the VBS file.
(If your AntiVirus alerts, allow the script to run.

Now enter dj6fn6a and post back with the results in this thread (call it regsrch.txt).

 

Hi,

I have attached the avenger log. The search with RegSrch did not find dj6fn6a.

Regards

 

Okay! Now, it appears Avenger deleted the key, was you able to run the reg fix to add the blank key back?

Also, attach new logs from HijackThis, ShowNew & GetRunKey.