Immortal(e-Group Instant Access)bug

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by rayzur, Oct 12, 2005.

Page 2 of 2
  1. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did it come back before or after you made a connection to the internet?
    Can you pin point exactly when it came back?
    What kind of connection to the internet do you have (dial-up, cable, dsl)? And do you have use a router?

    Do the below!

    Generate a StartupList log using HijackThis.
    Run HJT and on the first screen, click the button that says "Open the Misc Tools section". In the next window first select "List also minor sections (full)" and then click the button that says "Generate StartupList log". CLick Yes to the Do you want to continue prompt. Now a notepad window will come up with the Startuplist.txt file. It is already saved in the the directory HJT is running from. So just come back here and upload the file as an attachment to your next message.


    Let's get an installed programs list from HijackThis.
    Run HijackThis, click Open the Misc Tools section
    Click "Open Uninstall Manager"
    Click "Save List" (generates uninstall_list.txt)
    Click Save, copy and paste the results in your next post.
     
    chaslang, Oct 19, 2005
    #51
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Also please download WinPFind

    Extract it to the root folder of drive C ( C:\ ). This will create a folder called WinPFind in the C:\ folder. Inside c:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

    When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard. Then save it to a file using notepad and upload the text file here as an attachment.
     
    chaslang, Oct 19, 2005
    #52
  3. rayzur

    rayzur Private First Class

    It came back after I made internet connection, I finished all the steps last night & shut it down. Earlier today I went online to get windows updates & other misc. updates. I am a late bloomer, I have (dial-up) and I do not have or use a router.
     

    Attached Files:

    Last edited by a moderator: Oct 19, 2005
    rayzur, Oct 19, 2005
    #53
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you run WinPfind?

    So cnjukvps is really in the installed program list! What happens if you run Add/Remove programs and try to uninstall it?

    Take a look at the Program Control list in ZoneAlarm and let me know if you see anything strange or that you do not recognize it list.
     
    Last edited: Oct 19, 2005
    chaslang, Oct 19, 2005
    #54
  5. rayzur

    rayzur Private First Class

    Back again, I got the WinPFind dowloaded & I saw the note about it taking "upwards to 30 minutes or more". It ran for 2&1/2 hours and I didn't see any results. Did I do something wrong or is it possible that it could take that long or longer. I did click stop on it & I went on to deleting (cnjukvps) from the Add/Remove tool. That was successful with no evidence left in system files or HJT. I've ran Spybot S&D again & it still finds MagicControl.Agent & Connect MFC Application. Out of that log I was able to see - MagicControl.Agent:Library-c:\windows\system\msegcompid.dll - and I went there but could not find it. According to the notes I'm keeping, I show that I found & deleted (msegcompid.dll) according to your things to look for at the end of mssg.#18. I must confess that I am beginning to get frustrated by this full circle situation. Let me know about the WinPFind run time, should it be taking that long?
     
    rayzur, Oct 20, 2005
    #55
  6. rayzur

    rayzur Private First Class

    Okay, I figured out how to get into the Registry Editor by entering 'regedit'. I found & deleted (HKEY_USERS\DEFAULT\Software\LanConfig) and (HKEY_USERS\DEFAULT\Software\mc) . This has been a learning experience for me, I sat down in front of a computer for the first time in my life about two months ago. I figured this out by going back to the Spy-Bot.net site you informed me about in your 1st mssg. In their instructions in the 3rd to the last sentence they prompt me enter --(HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. And then to delete the " cptmgc " entry. Well it wasn't there but something very suspicious was " onduikyvwt ". I didn't touch it, backed out of there and went straight to Add/Remove and there it was. And of course it is in c:\windows\system...also with our familiar extensions of (exe.) - (.nav ) & (_nav.net). Now that I understand the Registry Editor I can go back in there and delete (onduikyvwt) but I have not done so yet. P.S. Also while I was in there I did look for (HKEY_USERS\.DEFAULT\Software\livesvc) but did not find it. It was the source of ( Connect MFC Application ) according to Spybot S&D. If you haven't done so yet check my previous post.(??? about WinPFind)
     
    rayzur, Oct 20, 2005
    #56
  7. rayzur

    rayzur Private First Class

    Still having trouble with WinPFind, all entries have mutated to (olqgy.exe) now.
     
    rayzur, Oct 20, 2005
    #57
  8. rayzur

    rayzur Private First Class

    I did go back into regedit and delete ( onduikyvwt.exe ) since I said that I haven't touched it in mssg.#56. Thats how it mutated to (olqgy). I see what you mean about needing to get it out of the start up system. At this rate it would just keep me chasing my tail!
     
    rayzur, Oct 20, 2005
    #58
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes! Fixing malware problems is like this sometimes until you can find the root of the problem. You have something else hidden that is reinfecting you and that is what we need to find.

    You did not answer my previous question/request:
    I really would like to get Winpfind to run. Not sure why it is taing so long. Try booting in safe mode with networking (if you have that option) but then physically unplug your cable to the internet so nothing can get in or out. Then make sure you do not run anything but WinPfind. See if that helps. If so, post the log.
     
    chaslang, Oct 20, 2005
    #59
  10. rayzur

    rayzur Private First Class

    Forgot about the Zone Alarm, I just looked in there & did notice something that looked strange to me. It seems to me that a legitimate program would have some info on it. This is something called "dw15"-w/no product name- Last policy\NA- Last modified\invalid date-File size\0kb. No info about what it really is, could that be a bogus file size when actually it may have a file. I'm going to let the WinPFind run as you suggest.
     
    rayzur, Oct 21, 2005
    #60
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you right click on it and select properties? Does it show where it is located/running from? Have you looked under both the Programs tab and also the Components tab?

    Is there anything unusal under Alerts?
     
    chaslang, Oct 21, 2005
    #61
  12. rayzur

    rayzur Private First Class

    Okay, I got everything worked out with WinPFind. A file had been lost somewhere along the way in my 1st download of it. Went back to majorgeeks and redownloaded into a fresh folder, scan was completed in 15 minutes. Looking back through Zone Alarm I couldn't find any more info on dw15. I don't think its anything to be concerned about, I think that it is part of windows programming. I did a "Find Files or Folders" search in C:\ and it did find a (DW15.exe) whose properties included Microsoft. I was unable to Rt. click on dw15 in Z/A to find any properties or Rt. click on anything else either. Zone Alarm Pro trial period has ended & it is Std. Z/A now, I have lost some of the features. Wasn't able to find a Components tab. I'd hate to get bogged down on something thats probably nothing to be concerned about. The WinPFind log should attatch below if upload is successful.
     

    Attached Files:

    rayzur, Oct 21, 2005
    #62
  13. rayzur

    rayzur Private First Class

    Yes it looks like (dw15) is just a subfolder/file to a program right above it called ( Distrubuted COM SE..) which is described as Microsoft Operating Systems. There is a subfolder/file similar to it called (Spybot SD.exe) right under Spybot S&D. It is similar in that it shows a 0kb file size, last policy update-N/A, last modified date-(invalid date). All in all Zone/Alarm looks fine! Onward Thru The Fog. ;)
     
    rayzur, Oct 21, 2005
    #63
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what you are referring to when you say "subfolder/file to a program right above it". What and where are you look at?

    Do you see the below files:

    C:\WINDOWS\SYSTEM\msplock32.dll <---- delete this
    C:\WINDOWS\Unwash6.exe <--- rename this to Unwash6.xxx
    c:\windows\system\olqgyj.exe <--- this needs to be deleted along with the other files that we have been seeing with these each time.
     
    Last edited: Oct 21, 2005
    chaslang, Oct 21, 2005
    #64
  15. rayzur

    rayzur Private First Class

    I'm sorry about the confusion, I'll explain what I was trying to say. In the programs list on the programs tab of Z/A's Program Control window. Items that are related to one another are next to each other. Being that it is a list that goes from top to bottom. If there are two items that are related to each other, one of them is either above or below. All I was trying to say was that dw15 was related to the item that was listed above it, and the item above it was a Microsoft program. I probably never should have even mentioned dw15, but I didn't make the connection that it was legitamate program till after the fact. Now about the items to delete, Just delete them- no safe mode or restarting. Delete in the order you have them listed?
     
    rayzur, Oct 21, 2005
    #65
  16. rayzur

    rayzur Private First Class

    I have made a test pass through windows explorer & I have located everything that you have listed. And I did notice to RENAME , not to delete the one item. I'm ready to do all of this if you have no instructions regarding safe mode or restarting.
     
    rayzur, Oct 22, 2005
    #66
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That list does not necessarily show programs that are related to each other. It is just alphabetical list.

    Where was dw15 located and running from? Right clicking and selecting Properties should tell you.

    Yes delete and rename in the order listed.
     
    chaslang, Oct 22, 2005
    #67
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The reason I ask about dw15 is because it is a valid program from Microsoft used for many differnent applications. It is for Microsoft Application Error Reporting

    However, malware could easily use the same name and just run from somewhere else.
     
    chaslang, Oct 22, 2005
    #68
  19. rayzur

    rayzur Private First Class

    This is getting crazy! When I made the test pass through windows explr. , all of the (olqgyj) extensions were there-(.exe)-(.dat) &(_nav.dat).The first item would not respond to being deleted, I have Webroot "Window Washer" -similar to Ccleaner. The first item only responded to shred&bleach , but it appears to be gone. Renamed 2nd item to ( Unwash6.xxx) no problem. When I went after the (olqgyj)'s which there were three of in test pass. The (.dat) was missing & the (exe) refused deletion & shred/bleach. The (_nav.dat) was shredded&bleached. olqgyj is still sitting in Add/Remove, I'm sure if I take it from there we will just be looking for the new mutation.
     
    rayzur, Oct 22, 2005
    #69
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    See if olqgyj.exe is running in a HJT process manager list. If so, kill it. Then try deleting it.
    If not, try renaming is to olqgyj.xxx. If it is still there and cannot be stopped or renamed, try the below.

    Locate the olqgyj.exe file with Windows Explorer and tight click on it and drag to your Desktop and unclick. Select Move . This moves the file to the Desktop. If this succeeds, try deleting or renaming it now while it is on the Desktop.
     
    chaslang, Oct 22, 2005
    #70
  21. rayzur

    rayzur Private First Class

    I understand that youare working on several different issues at the same time & it's almost impossible to keep up with the details of every thread. If you will refer back to my mssg.#62 you wil see where I stated that I was unable to rt. click on not only dw15 , but anything. I guess that when I'm in the Z/A window, My rt. click capabilities are disabled. Now one thing I do remember is that when I did the file search on dw15, I found the file in windows to be(DW15) all capital letters. This may be a clue! Did you see my results in my previous mssg.??
     
    rayzur, Oct 22, 2005
    #71
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If the previous does not work, try this.

    Download and install Unlocker

    Accept all the install default settings.

    Now open Windows Explorer and navigate to olqgyj.exe

    And right click on the file name and select Unlocker

    A Window will pop up showing some information about the locked file and which Process Paths are using it. Make sure you write down the info so you can tell me later what you saw. Then click Unlock All Now Kill the process! And then try to delete the file itself using Windows Explorer. Did that work?
     
    chaslang, Oct 22, 2005
    #72
  23. rayzur

    rayzur Private First Class

    Just tried to download "Unlocker", unsuccessful! It requires Win XP/2K , a file was lost while trying to download to my windows 98. Once again I thought I was closing in on it last night. That renaming of (Unwash6.exe) to (Unwash6.xxx) was not related to problem, that was the uninstall file for "Window Washer" by webroot. Thats ok though, it expired & I uninstalled it anyway. By the way!, it has mutated three times now since three series of removal attempts & restarts. It is currently (wjvpycih), after HJT kill process & other deleting efforts I went back through regedit & found the familiar entries of (HKEY_USERS\.DEFAULT\Software\livesvc)-.....(LanConfig)...(mc) and found (wjvpycih) sitting in LOCAL_MACHINE under Run --(HKEY_LOCAL_MACHINE\Software\Windows\CurrentVersion\Run) these are all the things that the Spy-Bot.net website has listed in the things to look for. All in all, I'm still caught in the vicious circle (tail chasing). Growing weary after 2 weeks of MagicControl infection! Maybe if we network this issue to other spyware fighters , we may find someone who has been there/done that. That is if you haven't done so already. Thanks for your ongoing support!
     
    rayzur, Oct 22, 2005
    #73
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sorry I forgot that Unlocker does not support your OS. However the below does.

    Download Process Explorer

    Unzip it and run ProcessExplorer and lets configure some options first:
    Click View and select Show Lower Pane. And where it says "Lower Pane View" make sure DLL's is checked. Now click on wjvpycih.exe (or whatever it is called now). Now also under the View menu choose "Select columns" and put a check mark on "Image Path". Now click on File and then Save As. And save the process list. Post it back here as an attachment.

    For a malware fighting company (Webroot) to do something so STUPID in times like this is amazing. You would think that they would be smart enough to keep there own files in there own folders and user names that represent that actual application names.

    Try going to the below website:

    http://www.virustotal.com/flash/virustotal_en.html

    Use the Browse button and navigate to your c:\windows\explorer.exe files and have it scanned for problems. Let me know if anything is found.
     
    chaslang, Oct 22, 2005
    #74
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    In Internet Explorer click Tools, Internet Options, Security tab. and click once on the Trusted Zones icon. Then click the Sites button. Is anything listed in your Trusted Zones?
     
    chaslang, Oct 22, 2005
    #75
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Also try giving the below a run after cleaning up all the files like we had been doing.

    Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixMCA.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixMCA.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.
     
    chaslang, Oct 22, 2005
    #76
  27. rayzur

    rayzur Private First Class

    Here is the "Process Explorer" attatchment of new mutation called (ikdbgfx.exe). I see no sense in my continuing to try to delete this thing only to have it continually changing names. I'm going to the website you referred me to while you look over the P/E attatchment.
     

    Attached Files:

    rayzur, Oct 22, 2005
    #77
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This process seems to be related to your Mailskinner program! If you trust that program than perhaps you need to leave this alone. Personally if I see a program that renames itself all the time like this, I suspect malware. However perhaps they have another excuse which I would call stupidity.
     
    chaslang, Oct 22, 2005
    #78
  29. rayzur

    rayzur Private First Class

    No websites listed in trusted zones. I got the " fixMCA.reg " file made & into the registry. ;)
     
    rayzur, Oct 22, 2005
    #79
  30. rayzur

    rayzur Private First Class

    I have been wandering about that mailskinner program! Remember that I am a beginner & please forgive any ignorance on my part. And I use that word "Ignorance" in its proper context, which simply means that I'm uninformed/uneducated in all areas of PC's. I just assumed that the mailskinner program was related somehow to my AVG A/V as it scanned incoming mail. I did not download that mailskinner on my own free will & if it is the source of my problems then KILL IT I will!
     
    rayzur, Oct 22, 2005
    #80
  31. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not necessarily saying Mailskinner is bad. There is no information that directly accuses is of being malware but at this point I do not like what I see. Based on what I see hear and have read about it, I suspect it to be something we do not want. Also if you did not install it, I have to wonder where it came from. I have seen some people related it to similar that you have had with eGroup and EdgeAccess. I'm not sure that it has anything to do with MagicControl. I would recommend looking for it in Add/Remove programs and uninstalling it. Then post a new HJT log and tell me if any of these other files we have been seeing with changing names are still around.

    Also did that fixMCA.reg patch help with MagicControl. If not, try it again after uninstalling Mailskinner.
     
    chaslang, Oct 22, 2005
    #81
  32. rayzur

    rayzur Private First Class

    :) Your the Bomb Chas, words can't describe how much I appreciate your help through all of this! All I can say is, Thank you!-Thank you!-Thank you!! MagicControlAgent is no loger in my life or my computer. I will let the results speak for themself. When I got rid of "mailskinner", I was able to remove MagicControlAgent -Connect MFC Application & all their mutated little buddies! It is a good feeling knowing that the PC is clean & seeing that (congratulations!) at the end of a Spybot S&D scan. All of this was done while on-line & after the restart. I went back through all of the scenarios that were causing the mutations to make sure all was well. Personally with the experience I've just came out of, I would have to say that "mailskinner" has everything to do with malware. There are several things to do still in the way of follow-up protection I'm sure. I have already replaced the MS java with sun java according to follow up procedures that I thought I was ready for 2weeks ago. I hope that the info. you gained from this battle will help you in the wonerful work you do of helping others & your zero-tolerance approach to this pathetic world of malware! Thanks again, rayzur from Texas. God bless P.S> HJT below if you need it FYI
     

    Attached Files:

    rayzur, Oct 22, 2005
    #82
  33. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome! And yes, now we know where to classify Mailskinner. And they have the nerve to say "No Malware" on there main page.

    Your log is clean but you could just have HJT fix the below two lines:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    If they come back, it is not a problem.

    I assume you are implying that you are following the steps in:

    How to Protect yourself from malware!

    If so, that's great! Because it is the next step.
     
    chaslang, Oct 22, 2005
    #83
Page 2 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds