MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 10-27-05, 10:39
Styx_oz Styx_oz is offline
Private E-2
 
Join Date: May 2005
Posts: 24
Thanks: 0
Thanked 0 Times in 0 Posts
Default Something Wicked....

Good Morning, Afternoon or Evening

I'm have a very technologically challenging week, the hard drive on my notepad retired hurt, and moving to the family desktop to do some work I discover that the desktop has been hijacked. Blue Screen, black square in the middle "Spyware Infection" message....

Technical details:

Windows XP Service Pack 2
Intel Celereon
997 MHz 512 MB RAM

I went through the "Read and Run me First" thread.... this is what happened:

Online Scanners:

I ran all four, one after the other, they all picked up viruses. I saved the logs from Bitdefender and Panda, both attached. The Bitdefender one was in .html format, I copied and pasted it into notepad, hope this was the correct thing to do.

I then rebooted in safe mode as per instructions and ran all of the cleaning tools. Ad-Aware SE found nothing, Spybot found a host of things (including some CoolWebSearch stuff), Microsoft Antispyware found one item, CWShredder found nothing, Kill2Me found nothing.

When I rebooted into normal mode, still the horrid desktop, so I thought I'd go one step further and try Ewido Security Suite. This found and cleaned 232 objects! (But didn't get rid of the desktop problem)

Before I run HJT, Should I now uninstall Ewido, or can it run in conjunction with AVG?

Thanks in advance.
Attached Files
File Type: txt Activescan.txt (11.5 KB, 1 views)
File Type: txt bitdefenderlog051027.txt (5.7 KB, 0 views)
Reply With Quote
Sponsored links
  #2  
Old 10-27-05, 17:40
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,227
Thanks: 61
Thanked 7,611 Times in 4,096 Posts
Default Re: Something Wicked....

In the Special Removal Procedures thread mentioned in the READ & RUN ME, you will find the following which it sounds like you need to run.

SpySheriff (aka SpywareNo) Removal

Since you alread ran the READ ME, just start at step 2.
Post the follow up HJT log when finished.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #3  
Old 10-27-05, 19:27
Styx_oz Styx_oz is offline
Private E-2
 
Join Date: May 2005
Posts: 24
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Something Wicked....

Thank you

I followed the steps in the SpySheriff Removal thread as instructed. The only file that I found to delete was the C:\Documents and Settings\username\application data\install.dat .

After completing the regedit instructions the desktop appears to be back to normal.

HJT log attached.

Do I need to uninstall ewido, or can it run along with AVG?

Cheers
Attached Files
File Type: log hijackthis051028.log (4.4 KB, 1 views)
Reply With Quote
  #4  
Old 10-27-05, 20:54
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,227
Thanks: 61
Thanked 7,611 Times in 4,096 Posts
Default Re: Something Wicked....

You can run Ewido with AVG. Ewido is a tool that compliments antivirus applications.

You mage some more items to fix. Please note that one of the items I see remnants of may have been attempting to steal financial info from you. See this:

http://securityresponse.symantec.com....banker.b.html

You may want to consider changing any passwords to financial related sites etc that you may have been accessing via your PC (just to be safe).

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O20 - Winlogon Notify: f3dsl - lsd_f3.dll (file missing)
O21 - SSODL: SysTray.Excn2 - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - C:\WINDOWS\system32\ocjjkegd.dll
O21 - SSODL: SysTray.Exmr - {73F8D5FF-6F5C-4f5b-B964-E6F214F6F852} - C:\WINDOWS\system32\bpdfklnb.dll (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete
:
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\WINDOWS\system32\ocjjkegd.dll

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #5  
Old 10-28-05, 00:44
Styx_oz Styx_oz is offline
Private E-2
 
Join Date: May 2005
Posts: 24
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Something Wicked....

Thanks again

I will definitely have the internet banking passwords changed.

Ran hijack this and fixed problems suggested. When I booted into safe mode, I found not only ibm00001.exe but also ibm00002.exe both created on same day at same time, so I deleted them both (hope this was right)

Computer seems to be running fine, out of interest tho, I checked my banking website, when I clicked on the "login" screen the new browswer window that opened had an about:blank label for a few seconds before it changed into the one I would normally expect. (I didn't log in) Don't know if this means anything.

Oh, and when I logged on in normal mode AVG didn't start-up. I opened it maually with no problems.

new HJT log attached.
Attached Files
File Type: log hijackthis 051028a.log (3.9 KB, 1 views)
Reply With Quote
Sponsored links
  #6  
Old 10-28-05, 01:53
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,227
Thanks: 61
Thanked 7,611 Times in 4,096 Posts
Default Re: Something Wicked....

You may want to uninstall AVG, then reboot, and then reinstall. Something may have gotten corrupted somewhere if it is not running at startup. Let me know what happens.

There are no issues to worry about in your log now. Although as a personal opinion, I don't like any of these things:

9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 06:26.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger