Need Urgent Help/Advice

Hi,

While working on the net, I think I managed to download a malware and its now causing my system to malfunction. I keep getting an error related to the tmp1/tmp2/tmp0 exe files. My internet brouser is also extremely slow and my system gets hung very often. While reading several similar problems online i stumbled upon the HijackThis application and ran it on my pc as per the instructions. Attached is the log file. Would be really great if any of you could help me figure out whats wrong and what needs to be done.

Thanks a ton!

 

Hi ArjunMaharaj,
Welcome to Major Geeks!

Sorry you are having difficulties. You have some fairly serious infections on your computer, and it won't help if we only fix what is showing up in HijackThis, because that will not get rid of all the files which need to be removed. Please go to the READ & RUN ME FIRST and follow the instructions. It's the most useful if you follow the instructions in the order they've been given. However, if after you've run CCleaner and have put the computer into normal msconfig startup mode, you find you are getting too bogged down, please go to the link at the bottom of the page which applies to your operating system and on the page that opens up, find Running Combofix and run this first. Do this only as a last resort as it works best if you can run the scans in order. If you find you can't do something, just skip it and continue on. When you finish, attach the logs with your next post.

abri

 

Hi Abri,

Thanks a ton for the advice. I've run the CCleaner as well, however didnt know if and where the log file might be saved. I however ran the HijacThis again and I've attached the log file. After rebooting my system..when i ran the CCleaner, there were still some files which it deleted.However before rebooting..it said there were 0 files to be deleted..is this usual? Secondly..i also get this windows work offline pop-up with two options saying work-offline or try again..is there anyway i could get rid of this pop-up. I've not logged on to the net from the pc that has the problem. Pls also advice if i still need to run the combofix and other files suggested in the "Windows XP Cleaning Procedure" link.

Thanks a ton!

 

Hi,

*Reposting as I couldnt trace my earlier Reply*

Attached is the logfile from HijackThis after i ran CCleaner. Pls advice if i still need to run the file from the "Windows XP Cleaning Procedure". Also..i keep getting these pop-ups eachtime sayinf work offline..it gives two options..work offline or try again. I'm currently not connected to the internet from the pc which has the problem. Pls also advice how do i get rid of that.Thanks a Ton

 

I'm not being able to attach the log file as I guess its the same as earlier attached. After rebooting my system and when i ran CCleaner it still deletes few files. But before rebooting it when i ran the CCleaner for a 2nd time it said 0 files were deleted.Is it normal? Kindly advice.

 

Hi Arjun Maharaj,

Please go to this link READ & RUN ME FIRST and run all of the instructions and attach the logs we request. We do not need a log from CCleaner and HijackThis is not adequate to fix the things which need fixing on your computer. I can see that there is malware, but I cannot help you to fix it properly until I can look at the logs you will get from the procedures. HijackThis helps us see some things, but it is simply not thorough enough.

If you have questions as you are working through the READ & RUN ME procedures, please ask. For instance, you said that the broken computer is not hooked up to the internet. In this case, you will need to download the installation programs to a cd or a flash drive on a computer that is working and then transfer them to the computer which doesn't have an internet connection. Be sure to install Combofix to the Desktop when you get it off the CD and the MGTools need to be installed on the same drive where your operating system is located (this is the C:\ drive on most computers).

Let me know how you are getting on.
abri

 

Hi Abri,

I ran the applications from the link and i'm attaching the logs here. My internet explorer now opens but cannot browse as it just gets hung. I also keep getting these two errors when I restart my pc.

1.Error loading c:\windows\system32\qydhawj.dll and
2.Error loading c:\windows\system32\yuegtbgh.dll

Not very proficient in systems and a lil lost .

Thanks a ton!!

 

Hi ArjunMaharaj,

Are you using a different browser that is not Internet Explorer, or are you working from a different computer?

I need for you to go back to the XP Cleaning Instructions and download and install the MGTools. You will find a set of instructions on that page called Using MGTools (under Step 2). Please follow the instructions there and attach the MGlogs.zip with your next post. If you get any error messages, look for the explanations about the different possible error messages at the bottom of the page. You still have some malware which is causing the problems you describe, but I need this complete zipped set of logs in order to complete the removal process.

Let me know if this works or not.

Thanks.
abri

 

Hi Abri,

I'm actually working from a different computer.I connect the computer that is infected to the internet but I dont use it for browsing since the problem began..I just run the instant messaging applications like g-talk and msn. I'll run the MGTools again this evening and will attach the MGLOGS.ZIP as an attachment in my next post. Thanks a ton!

Cheers

 

If you've already run the MGTools, you can find the logs as a zip file directly under C. They have the name MGlogs.zip and are located just above the superman icon.

Let me know whether you're able to do this or not. I have some instructions ready from Combofix, but I'd really like to look at the other logs first before I post them to you.

abri

 

Hi Abri,

Attached is the MGlogs.zip file. Kindly review the same and advice. Thanks a ton!

Cheers

 

Arjun Maharaj,
It was worth waiting for the rest of the logs! Please do the following.

1) Open your Windows Live Messenger, go to Help -> Customer Experience Improvement Program and turn it off. That will stop you getting all those sqm files.

2) Then please open the follwing folder and tell me what's inside of it. Do not open any of the files that are in it.

C:\Documents and Settings\All Users\Application Data\SecTaskMan

3) Next, I would like for you to run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {4DDB4EFF-6043-4CEF-9849-F306C2D5BFD0} - c:\windows\system32\yniqptoo.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [50430bfb] rundll32.exe "C:\WINDOWS\system32\qydhowji.dll",b
O4 - HKLM\..\Run: [7B55437F63067B555855] Rundll32.exe "C:\WINDOWS\system32\yuegtbgh.dll",s
O4 - HKCU\..\Run: [7B55437F63067B555855] Rundll32.exe "C:\WINDOWS\system32\yuegtbgh.dll",s
O4 - Global Startup: Bluetooth.lnk = ?
O20 - Winlogon Notify: mwnvmnqr - C:\WINDOWS\SYSTEM32\yniqptoo.dll
O21 - SSODL: RamKernel - {2a8bf0dd-645f-4717-a4a7-290598fad83e} - (no file)

After you click fix, just close hijackthis.

4) Now we need to use ComboFix to remove some malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

Code:

KILLALL::

Driver::
jvbhwaik

File::
C:\WINDOWS\system32\drivers\ykyrlgrf.dat
C:\WINDOWS\system32\BUFADPT.SYS
C:\WINDOWS\system32\xlfhwqwl.dat
C:\WINDOWS\system32\wxoalrxy.dat
C:\WINDOWS\system32\xzfrlihh.dat
C:\WINDOWS\system32\nwugugrt.dat
C:\WINDOWS\system32\qctsbcbx.dat
C:\WINDOWS\system32\drivers\ykyrlgrf.dat
C:\WINDOWS\system32\wfilkogo.dat
C:\WINDOWS\system32\lcwaaxij.ini
C:\WINDOWS\system32\yniqptoo.dll

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4DDB4EFF-6043-4CEF-9849-F306C2D5BFD0}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"7B55437F63067B555855"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"50430bfb"=-
"7B55437F63067B555855"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4babbae5-66b1-11dc-9b5a-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5772d786-4cee-11dc-9b4c-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70993e42-640b-11dc-9b50-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93293fd4-a325-11dc-9b8b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94d938a8-82e6-11dc-9b62-00164162d7cd}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9779556e-640c-11dc-9b51-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10d8-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10d9-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10da-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10db-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10df-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10e3-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10e5-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10e7-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10e9-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10eb-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0ed10ed-66b2-11dc-9b5b-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd9d7d42-8a25-11dc-9b6d-0016d30365cf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ebdfe7f2-0900-11db-9a9b-00164162d7cd}]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jvbhwaik]
"ImagePath"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jvbhwaik]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mwnvmnqr]

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

5) Now run CCleaner at the default setting with the Windows tab as the one on top.


6) Go to add/remove programs and uninstall the below:

- J2SE Runtime Environment 5.0 Update 6

7) Reboot after uninstalling the above.

8) Install the current version of Sun Java from: Sun Java Runtime Environment


9) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger


10) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip it generates along with the Combofix log.


Let me know how things are running now?

abri

 

Hi Abri,

I've followed the steps as suggested by you. Attached are the requested logs. Most of the other errors I was getting have been rectified now. However I'm still not being able to use internet explorer. I get an error message saying Windows internet explorer cannot open the requested page. I can however still use the instant messengers like g-talk and msn.Pls advice. Thanks!!!

 

Hi ArjunMaharaj,

1) Do you get this message from Internet Explorer for every page you open or only when you first open it and try to get to your start page?

2) Does it happen with other browsers as well? If you don't have another browser, I recommend Firefox which you can download here under Step 7: How to Protect Yourself from Malware

Let me know if you can get to the internet through this browser.

3) When you ran SuperAntiSpyware, did you do this step: (if not, please go back and complete that)

Repair broken Network Connection ?

4) Please do the following

Reset Web Settings:
Right-click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

Next right-click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Let me know how this goes.
abri

 

Hi Abri,

I get the message for every site I try to open. Its as if the pc is not connected to the net. However, I can open g-talk and msn without a problem. I also tried using the apple safari browser but still couldnt open any site. Will try the suggested methods and will reply with outcome. Thanks

 

Hi Abri,

I've followed the steps suggested by you. I'm still not being able to open any website from the internet browsers. Have tried with explorer,firefox and safari. It looks as if there is some set-up that is blocking the browsers from accessing websites. The browsers run but when i enter a website i get the same error as if the internet was not connected.There is however no other problem i'm experiencing. Instant messengers continue to work fine. Would appreciate your advice. Thanks!!

 

Hi ArjunMaharaj,

Chas noticed that some drivers were removed from your system in your first run of Combofix which may be related to your internet connection.

Please go to C:\Qoobox and look for the following. They should be in one of the quarantine or backup files. If you find them, restore them.

C:\WINDOWS\system32\driver\bcm43xx.cat
C:\WINDOWS\system32\driver\RNDISMP.sys
C:\WINDOWS\system32\driver\RNDISMPK.sys
C:\WINDOWS\system32\driver\usb8023.sys
C:\WINDOWS\system32\driver\usb8023k.sys

Additionally, I had you remove C:\WINDOWS\system32\BUFADPT.SYS which was simply a mistake. See if you can get it at this website:

http://www.runscanner.net/files/sys/bufadpt/bufadpt.sys.aspx

There is also one HijackThis entry which may need to be restored, but I need to get back to you about this.

Let me know how this all goes.
abri

 

Hi,

Request you to kindly advice how to restore the system32 files. I just copy pasted the mentioned files from the quarantine folder to their original folders, is that what needs to be done?. Request you to also advice how to restore "O4 - Global Startup: Bluetooth.lnk = ?". My pc still doesnt let me access internet sites via any browser..pls assist. All the other issues that I was getting as a result of malware have been resolved. Thanks!!

 

Hi Chas,

I'm sorry..but I'm just a lil confused with all this system stuff . I actually cut the files from the quarantine folder and pasted them back in the original folders..so now they dont exist in the quaratine folder. Is there anything else that needs to be done with the system32 files?

I'll run the MGtools and restore the mentione O4 start-up and will also try using the IP address and will revert.
Thanks

 

Hi,

I made the changes as suggested and restored the files..however..still no luck. I decided in addition to run a network diagnostic scan and i got the attached report.I can see some errors but have no clue what it means. could these be the problem for the internet explorer not opening any websites. I know the network connections are fine cos g-talk and msn seem to be working just perfect. Pls advice. Thanks!

 

Guess i forgot to mention, but I've tried even using IP addresses too, however still no luck.

 

Hi Chas,

Intially I was logging on to the internet via a wifi router. But about a month back, when my router was giving me problems, i started connecting via a broadband internet cable (dial-up conncetion). I had also switched off my wifi and bluetooth applications since i've started using the dial-up connection. I will try the steps as suggested by you and revert with outcome. Meanwhile do I need to do anything to remove the wifi connections i installed earlier and if so how do I go about it? Thanks a ton!

 

Arjun,

Just for clarification because I think the terminology may cause some confusion in the discussion:

dial-up refers to an analog modem where your computer dials in to your ISP. You can't use your telephone at the same time you use the internet when you use dial-up. It is not broadband.

DSL is a broadband connection which utilizes the same line as your telephone, but does so without you having to dial in to your I'SP. You can use your telephone at the same time you use DSL. With DSL, you can use both a wifi connection which is wireless and you can also connect directly to the modem with a telephone wire.

A cable broadband connection refers to the use of a cable television line. It doesn't use anything related to your telephone.

wifi is a means of having your computer hook up into an existing internet connection via a remote sensing device. It's used to gain access to the internet remotely (without requiring a wire between your computer and the modem).

Bluetooth is used for transmitting information between devices (printers, computers, cell phones, GPS). Whether your Bluetooth is operating or not should not affect your ability to load webpages.

When you refer to a broadband cable connection that is dialup, this leads to some confusion. It sounds like you may be using a DSL connection, but rather than using the wireless (wifi) connection you're now using a connection which requires running a wire from the computer to the modem. Is this correct?


abri

 

Hi Abri,

My technical terminology is horrible. Just to clarify.. yes i'm using a DSL connection, but rather than using the wireless (wifi) connection I'm now using a connection which requires running a wire from the computer to the modem. Hope this clarifies. Thanks!!!

 

Hi Arjun,

Were you able to do the instructions Chaslang posted in his post 26? I am curious as to the results you might have gotten.

abri

 

Hi Abri,

I'm actually working out of my office pc. I'll run the instructions as per posting 26 once I'm home and will post the outcome here for further review. Thanks!!!

 

Hi Abri,

I ran the below instructions as per posting 26.

Go into Control Panel -->Network Connections.
Right click on your connection
and click Properties.
On the Properties page, highlight Internet Protocol(TCP/IP)
Click Properties. This will bring up another page.
Make sure Obtain an IP address automatically is selected
Also make sure Obtain DNS server address automatically is selected
Click the ok button. The page will close.
Press ok on the page in front of you.
Restart the computer.
Reconnect to the Internet using Internet Explorer

The settings were already as per the above, so i didnt have to make any changes. My internet explorer was still not able to open a webpage. I keep getting the error "address not valid". So I went to the second step as follows:

click Tools, Internet Options
Select the Connections tab
Select the LAN Settings button
on the Local Area Network (LAN) settings form is anything checked?
under the Proxy Server area is there a check mark in the box to Use a proxy server?

On the LAN settings form no option is currently checked and there is no check mark in the box to use a proxy server. I also noticed that under my netwrok connections I had four connections reflecting.

1.the broadband connection which I double-click to connect and reflects as connected when I'm online. it has something like "PPoE" as part of its name.
2. another connection which reflects "Intel(R) PRO/100 VE Network Connection" as part of the name which also gets automatically connected when i log on to the above connection. If i disable this connection, even the broadband gets disconnected.
3. There is another connections which reflects "net adapter" in its name. It always reflects as disconnected and even if i enable it, there is no change to the performance and
4. It is the wifi connection which reflects as disabled.

 

Hi Arjun Maharaj,

Please start a thread in the Networking Forum and include a brief description of the problem (IE pages don't load but messenger works) along with the link to this thread which will be http://forums.majorgeeks.com/showthread.php?t=156433. Additionally, put the contents of your last post here with us into a quote box in the new thread you're starting. You can do this by putting [quote*] and [/quote*] at the beginning and the end of your text, but leave out the * inside the brackets.

Thanks.
abri