MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 05-10-05, 02:41
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default help me i'm just a wiggy girl!

I received some sort of attack on my computer that arrived with two icons, one is a dog called "cashback" and the other is a circle is a "websearch".

I have a windows 98 machine. A friend told me to run this program called adaware, which I ran and it showed over 600 issues with my computer. Some could not be deleted.

My computer is running so slowly and pop-ups keep shutting me down, I don't know what to do.

I tried using Hijack This is per the same friend.

Would anyone be able to help me identify what I should not have on my computer?

Thanks,
wigged
Reply With Quote
Sponsored links
  #2  
Old 05-10-05, 09:29
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:


Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting
Reply With Quote
  #3  
Old 05-10-05, 12:33
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Dear BJGarrick,
Thank you so much for your assistance.
Attached is the log you requested.
Attached Files
File Type: log hijackthis.log (7.6 KB, 2 views)
Reply With Quote
  #4  
Old 05-10-05, 13:54
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

First, please look in Add/Remove Programs in Control Panel and uninstall the following:

WinTools

Toolbar

CashBack

NaviSearch


After you uninstall the above programs, procede with running these online scans:
TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After you run these online scans, post your results as in what was found and if it was deleted or not. Also, reboot and post a fresh HJT log.
Reply With Quote
  #5  
Old 05-10-05, 18:47
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Thanks so much, I will do that.
BTW, what does PM mean? I am new to this arena and I don't want to break any etiquitte.
Reply With Quote
Sponsored links
  #6  
Old 05-11-05, 01:41
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

Quote:
Originally Posted by wiggyirl
Thanks so much, I will do that.
BTW, what does PM mean? I am new to this arena and I don't want to break any etiquitte.
Okay, will be awaiting results and new log.

PM means "Private Message"
Reply With Quote
  #7  
Old 05-11-05, 16:14
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Thanks for the information.


I've run all the scans. They all found stuff but none of them were able to remove everything.

Attached is the log from Hijack This after the last scan.
Attached Files
File Type: log hijackthis.log (6.3 KB, 4 views)
Reply With Quote
  #8  
Old 05-11-05, 22:20
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

Please look in Add or Remove Programs for the following and Uninstall them if found:

ADVANCED SEARCHBAR

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcy/d...om/search/ie.h tml
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://yahoo.sbc.com/dial
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8 080;http=proxy.prodigy.net:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL (file missing)
O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} -C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\TOOLBAR.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\SYSTEM\NSO233.DLL
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
O2 - BHO: Fizzlebar.clsFwBar - {9056A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - C:\SYSFWB\9758255949\IEFWBAR.DLL
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL

O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL (file missing)
O3 - Toolbar: Advanced Searchbar - {43F02779-6D88-4958-8AD3-83C12D86ADC7} - C:\PROGRAM FILES\ADVANCED SEARCHBAR\TOOLBAR.DLL

O4 - HKLM\..\Run: [PSoft1] C:\WINDOWS\SYSTEM\psoft1.exe
O4 - HKLM\..\Run: [ktvozs] c:\windows\system\ktvozs.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\XUTXZU.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\XVZWXN.exe
O4 - HKLM\..\Run: [autoupdate] rundll32 C:\WINDOWS\SYSTEM\WINUP2DATE.DLL,SHStart
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKCU\..\Run: [ZprqRWd7S] OIGISN12.EXE
O4 - Startup: tddn.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -%windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\Program Files\Advanced Toolbar ← Delete this whole folder if it exist!

C:\SYSFWB ← Delete this whole folder if it exist!

C:\WINDOWS\System\KTVOZS.exe

C:\WINDOWS\System\XVZWXN.exe

C:\WINDOWS\System\OIGISN12.exe

C:\WINDOWS\System\MSBE.dll

C:\WINDOWS\System\NSO233.dll

C:\WINDOWS\System\psoft1.exe

C:\WINDOWS\System\ktvozs.exe

C:\WINDOWS\System\XUTXZU.exe

C:\WINDOWS\System\WINUP2DATE.dll

C:\WINDOWS\CFGMGR52.dll

C:\WINDOWS\nrrvll.exe

C:\WINDOWS\CFGMGR52.dll

C:\WINDOWS\NRRVLL.exe

C:\WINDOWS\PACKAGER.exe


OIGISN12.exe <-- Search for this file and delete when found!

tddn.exe <-- Search for this file and delete when found!

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin


And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After doing ALL of the above, Scan with HijackThis and attach the new log.
Reply With Quote
  #9  
Old 05-12-05, 23:43
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Thank You,
It seems my computer is healthy now.
Attched is the most rectent log for your perusal.
Wow...what a difference!
Attached Files
File Type: log hijackthis.log (3.6 KB, 3 views)
Reply With Quote
  #10  
Old 05-13-05, 01:08
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

Download Pocket KillBox
(Don't run it yet though)

Reboot into Safe Mode

Now, once in safe mode scan with HJT and have it fix the below entries:

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\nrrvll.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Be sure you have ALL browsers closed before you click FIX!


Locate PocketKillbox

Now, Copy and Paste C:\WINDOWS\nrrvll.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click YES.

Now allow Killbox to reboot you system. After your system has rebooted scan with HJT and attach one last log.
Reply With Quote
Sponsored links
  #11  
Old 05-26-05, 19:49
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

I'm stillhaving serious pop-up problems.
I am running all the same scans.
Should I post the Hijack This results?
Reply With Quote
  #12  
Old 05-26-05, 21:54
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

You have to follow my post in a timely manner. These infections mutate over time and cause more problems.

When we begin a fix you need to stay with it until we are complete.

Post a fresh HJT log and we will go from there.
Reply With Quote
  #13  
Old 05-27-05, 10:26
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Hi,
I thought I did everything, but I guess I didn't.
Here's the newest logfile:

Edit by bjgarrick: Unrequested, Inline HJT log removed!

Last edited by bjgarrick; 05-27-05 at 23:14.. Reason: Unrequested, Inline HJT log removed!
Reply With Quote
  #14  
Old 05-27-05, 23:16
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

Your log is very bad, you have several issues we need to address. Try not to reboot any if possible as it will make it impossible. There are several steps in removing these new infections you have so it will take some work and time. This fix needs to be done in a timely manner if possible so we can nail it before it can mutate and get worse.

Please look in Add or Remove Programs for the following and Uninstall them if found:

AutoUpdate

NaviSearch

Virtual Bouncer


After you uninstall the above programs, procede with these online scans.

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After you complete these online scans above, procede with the below steps:

1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.


Now come back here and post both logs as attachments along with a fresh HJT log.
Reply With Quote
  #15  
Old 06-01-05, 01:23
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Thanks so very much. This was quite the adventure.

Attached are two of the requested files. I'll attach the third log in the next posting.
Attached Files
File Type: txt hijackthis01.log.txt (5.4 KB, 3 views)
File Type: txt Qoollog2.txt (1.7 KB, 1 views)
Reply With Quote
Sponsored links
  #16  
Old 06-01-05, 01:24
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

Here is the third Log.
Thanks!!!
Attached Files
File Type: txt rklog01.txt (869 Bytes, 2 views)
Reply With Quote
  #17  
Old 06-01-05, 14:24
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

Reboot into Safe Mode and procede with the below!


Locate PocketKillbox

Procede with this even if they do not show in blue!

Now, Copy and Paste C:\WINDOWS\NRRVAA.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\OCCBQQQ.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\CERES.dll into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\Buddy.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\system\WINUP2~1.dll into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\system\QOOL.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\system\WMCONFIG.cpl into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\SYSTEM\ktvozs.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\SYSTEM\winup2date.dll into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\SYSTEM\Qool.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\SYSTEM\mc-58-12-0000079.exe into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click NO.

Now, Copy and Paste C:\WINDOWS\SYSTEM\temperror32.dat into the box If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now Click YES.

Allow Killbox to reboot your system! After you have rebooted post 3 new logs!
Reply With Quote
  #18  
Old 06-02-05, 02:05
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

wow! this was so much simpler.
are we getting closer?
thanks again.
1 st two logs posted here.
3rd log in next reply.
Attached Files
File Type: txt hijackthis02.log.txt (5.3 KB, 1 views)
File Type: txt Qoolog03.txt (1.5 KB, 1 views)
Reply With Quote
  #19  
Old 06-02-05, 02:06
wiggyirl wiggyirl is offline
Private E-2
 
Join Date: May 2005
Posts: 23
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: help me i'm just a wiggy girl!

third log attached.
Attached Files
File Type: txt rklog02.txt (510 Bytes, 1 views)
Reply With Quote
  #20  
Old 06-02-05, 02:28
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: help me i'm just a wiggy girl!

Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\PROGRAM FILES\CXTPLS\CXTPLS.DLL
O2 - BHO: SDWin32 Class - {71BA2A40-CDDE-11D9-981F-000FB5088B8F} - C:\WINDOWS\SYSTEM\ENVNQ.DLL
O2 - BHO: adlog Class - {22B9A67D-E689-44B6-B775-0E8FE84B4F9B} - C:\WINDOWS\SYSTEM\HQADEGO.DLL
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [PS1] C:\WINDOWS\SYSTEM\ps1.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\INHMIQ.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\AFWRWN.exe
O4 - HKLM\..\Run: [checkrun] C:\WINDOWS\SYSTEM\ELITEGWC32.EXE
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\nrrvaa.exe reg_run
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [ktvozs] c:\windows\system\ktvozs.exe
O4 - HKLM\..\Run: [oE8k36R] ODTJUI09.EXE
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKCU\..\Run: [ZprqRWd7S] NTD_CI.EXE
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000079-d.exe
O4 - Startup: tddn.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} - http://www.pacimedia.com/install/pcs_0016.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\Program Files\Toolbar ← Delete this whole folder if it exist!

C:\Program Files\Common Files\WinTools ← Delete this whole folder if it exist!

C:\Program Files\CXTPLS ← Delete this whole folder if it exist!

C:\WINDOWS\NRRVAA.exe
C:\WINDOWS\OCCBQQQ.exe
C:\WINDOWS\CFGMGR52.dll
C:\WINDOWS\nrrvaa.exe
C:\WINDOWS\wupdt.exe

C:\WINDOWS\System\NTD_CI.exe
C:\WINDOWS\System\HLIDYBR.exe
C:\WINDOWS\System\HKIBECO.exe
C:\WINDOWS\System\ENVNQ.dll
C:\WINDOWS\System\HQADEGO.dll
C:\WINDOWS\System\ps1.exe
C:\WINDOWS\System\INHMIQ.exe
C:\WINDOWS\System\AFWRWN.exe
C:\WINDOWS\System\ELITEGWC32.exe <-- Also look for other files starting with ELITE and ending with EXE. There could be as many as 10 more.
C:\WINDOWS\System\ktvozs.exe

C:\WINDOWS\Start Menu\Programs\Startup\tddn.exe

C:\Program Files\Common Files\mc-58-12-0000079-d.exe

ODTJUI09.exe

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin


And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log along with 2 new logs from the tools.
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 07:27.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger