MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 06-27-08, 03:28
herm67 herm67 is offline
Private E-2
 
Join Date: Jun 2008
Posts: 5
Thanks: 0
Thanked 0 Times in 0 Posts
Default remove zlob dns changer

hi,

i have a zlob dns changer that was detected by Spybot. zlob continually hijacks my web pages sending me places i dont want to go. when i delete it using spybot everything works fine. however, whenever i turn the computer off and back on the zlob returns and spybot detects it again. i ran the fixwareout program i saw posted on this site and it said it could not flush zlob and deletion failed. i am back to square one and despearetly want to get rid of this thing..PLEASE HELP!!! The following is the info. obtained by the wareout program:



i hope this helps explain to you what might be going because i have no idea what any of it means. thanks. i will check back over the weekend and pray someone has a solution for me.
Attached Files
File Type: txt Wareout log.txt (3.0 KB, 5 views)

Last edited by TimW; 06-27-08 at 10:06.. Reason: Removed inline log.
Reply With Quote
Sponsored links
  #2  
Old 06-27-08, 10:07
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,699
Thanks: 449
Thanked 4,651 Times in 4,390 Posts
Default Re: remove zlob dns changer

Welcome to Major Geeks!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

READ & RUN ME FIRST. Malware Removal Guide
Reply With Quote
  #3  
Old 07-02-08, 12:00
herm67 herm67 is offline
Private E-2
 
Join Date: Jun 2008
Posts: 5
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: remove zlob dns changer

here are the logs for super anti spyware, combo fix and malware bytes. the file said the spyb ot log was too large, but i can tell you it did find the zlob dns changer as it always does. i will post the mg tools logs in the next reply. thanks again for the help and i will checl back in a couple days.
Attached Files
File Type: doc ComboFix 08.doc (48.5 KB, 4 views)
File Type: doc SUPERAntiSpyware Scan Log.doc (23.5 KB, 2 views)
File Type: doc Malwarebytes.doc (24.5 KB, 2 views)
Reply With Quote
  #4  
Old 07-02-08, 12:02
herm67 herm67 is offline
Private E-2
 
Join Date: Jun 2008
Posts: 5
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: remove zlob dns changer

here are the mg tools logs
Attached Files
File Type: zip MGlogs.zip (69.8 KB, 3 views)
Reply With Quote
  #5  
Old 07-02-08, 18:14
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,699
Thanks: 449
Thanked 4,651 Times in 4,390 Posts
Default Re: remove zlob dns changer

You have a wareout infection> you started off right but you need to disable all anti-virus and spyware programs and disable Teatimer!

Please download FixWareout by LonnyRJones from one of the two below links and save it to your desktop.

http://downloads.subratam.org/Fixwareout.exe

http://www.bleepingcomputer.com/file...Fixwareout.exe

* Run Fixwareout.
* Click Next,
* then Install,
* make sure Run fixit is checked
* and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.

When you run fixwareout, just follow the prompts, you will need to restart when prompted.

After rebooting (restart) back into normal boot mode, make sure you have all web browsers closed.

* Go into Control Panel -->Network Connections.
* Right click on your connection
* and click Properties.
* On the Properties page, highlight Internet Protocol(TCP/IP)
* Click Properties. This will bring up another page.
* Select Obtain DNS Server Automatically.
* Click the ok button. The page will close.
* Press ok on the page in front of you.
* Restart the computer.
* Reconnect to the Internet using Internet Explorer.
* Now come back here and attach the log from fixwareout. It is located at c:\fixwareout\report.txt
Reply With Quote
Sponsored links
  #6  
Old 07-06-08, 23:52
herm67 herm67 is offline
Private E-2
 
Join Date: Jun 2008
Posts: 5
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: remove zlob dns changer

here are the logs you requested. after running fixwareout spybot was run again and is now saying it is not finding any immediate threats!! I did go online and tried a few sites and had no problems reaching them.. No browser page hijacks after five different sites. also, prior to changing my dns server to automatic it was showing a preferred dns server number but i forgot to write it down before setting to automatic. when I went back to check for the numbers nothing would come up. so far everything seems to be working right again. I will check back in a couple days for your response to the logs i provided and to let you know if there have been any relapses. Lets keep our fingers crossed!! thanks again for all of your help to this point.
Attached Files
File Type: doc fixwareout.doc (26.5 KB, 2 views)
File Type: doc spybot.doc (26.5 KB, 2 views)
Reply With Quote
  #7  
Old 07-07-08, 10:21
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,699
Thanks: 449
Thanked 4,651 Times in 4,390 Posts
Default Re: remove zlob dns changer

Let me know....
Reply With Quote
  #8  
Old 07-07-08, 18:53
herm67 herm67 is offline
Private E-2
 
Join Date: Jun 2008
Posts: 5
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: remove zlob dns changer

all of my internet browsing is working perfectly thanks to you guys. thank you so much!!! You guys are the best and now my wife is off my back!!!

The one problem that seems to have popped up is that when I turn on my computer and get to the desk top a pop up box appears with the following information:

Line 1: SmartBridgeAlerts: MotiveSB.exe- Entry point not found

Line 2: The procedure entry point GetProcessImageFileName W could not be located in the dynamic link library PSAPI.DLL.

There is also a large red circle with an X through it near the left side of the pop up box. This does not appear to be causing any problems with the computer function, but i was wondering how to repair it because it is annoying. Any ideas?

Note: The box does not say Line 1 and Line 2. I did that to separate the info for you. Thanks again for the help.
Reply With Quote
  #9  
Old 07-07-08, 20:15
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,699
Thanks: 449
Thanked 4,651 Times in 4,390 Posts
Default Re: remove zlob dns changer

Apparently this is a problem with many people after installing IE7 ....
Quote:
you need to search your computer for any file
named PSAPI.DLL and rename those to psapiold.dll that are not in the
C:\WINDOWS\System32 folder. **Do not rename the PSAPI.DLL file in your \\Windows\System32
directory. **
You should ask for further assistance in the software section for this issue.

If you are not having any other malware problems, it is time to do our final steps:

1. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
2. Click START then RUN
* Now type "%userprofile%\Desktop\cf" /u in the runbox ( or whatever you renamed it to) and click OK.
* Note: The space between the cf and the /U, it must be there.
3. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
4. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
5. If you are running Windows XP or Windows ME, do the below:
* Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
* Then reboot and Enable System Restore to create a new clean Restore Point.
6. After doing the above, you should work thru the below link:
How to Protect yourself from malware!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Please help remove ZLOB DNS Changer Kernel_Lodby Malware Removal 1 04-06-08 21:00
trying to remove zlob xaphire Malware Removal 7 03-08-08 23:38
Zlob DNS changer found after cleaning procedures Snotagain Malware Removal 18 02-15-08 02:19
help ... suspected zlob dns changer infection rinoa1 Malware Removal 8 09-08-07 23:20
zlob dns changer -can't get rid of it! backagain0 Malware Removal 5 08-18-07 21:28


All times are GMT -5. The time now is 05:21.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger