hugely infected, please help

Welcome to Majorgeeks!

Please attach the other requested logs from:
- GetRunKey
- ShowNew
- HijackThis

 

We did not ask for a log from CCleaner and have no need for it.

NOTE: Trying to install SP2 while your PC is infected could make your PC totally unusable. Do not install SP2 until your PC is clean!

You attached a HijackThis log from Safe Boot Mode. You must remember to only attach HijackThis logs from Normal Boot Mode unless we ask for one from safe mode.

Also you are using MSconfig to control Startups. Please follow the directions in step 0 of the READ & RUN ME and select Normal Startup mode.


Now download the attached chodefix.zip file (see the bottom of this message) to your Desktop or someplace else you will be able to find it. The extract the two files from it. Then double click on the chodefix.bat file. This will try to fix some of the damage caused by the Chode infection that you have. You should see a message like the below when it finishes (in about 3 seconds).

Tell me if you see this message or not or if you get an error message instead. No matter what happens just continue on to the next steps.


Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.


Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\Common Files\{262916F0-0AE8-1033-0916-04102520003d}\Update.exe
D:\Program Files\Warez P2P Client\warez.exe
C:\WINDOWS\system32\qfcbcq\services.exe
c:\windows\system32\USTART.EXE
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\2searchinstaller.exe
c:\windows\NDNuninstall6_98.exe
C:\WINDOWS\NDNuninstall7_14.exe
C:\Documents and Settings\All Users\Documents\newWarezP2P.exe
C:\Documents and Settings\YVONNE\Local Settings\Temp\TCS2.EXE
C:\Documents and Settings\YVONNE\MC.EXE

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folders and delete if found:
C:\WINDOWS\system32\qfcbcq
C:\Program Files\Warez P2P Client
C:\Program Files\Warez P2P ClientIPGUARD.LOG
C:\Program Files\Common Files\{262916F0-0AE8-1033-0916-04102520003d}

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

Okay! Your infections could be getting in your way of running MSconfig.

Just attach the new logs when you finish. Then also after finishing the steps, see if you can now run MSconfig to select normal startup.

 

Please download the new version of chodefix.zip and extract the files to whereever you extracted the previous version. Then run chodefix.bat


Now uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 5
J2SE Runtime Environment 5.0 Update 6

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
F3 - REG:win.ini: load=C:\WINDOWS\system32\qfcbcq\services.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\qfcbcq\services.exe
O2 - BHO: (no name) - {B6CBC049-AADF-7FE5-AF99-2DF17C29F35B} - C:\DOCUME~1\yvonne\APPLIC~1\TRUSTT~1\flaw upload.exe (file missing)
O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{36291~1\Bar888.dll (file missing)
O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{36291~1\Bar888.dll (file missing)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [OnlineCdrom] C:\DOCUME~1\yvonne\APPLIC~1\ATOMDE~1\32third.exe
O4 - Startup: services.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN
O9 - Extra button: @C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll,-115 - {BB8A8834-A0A1-4d70-A21A-72FF89AA737A} - (no file)
O9 - Extra 'Tools' menuitem: ImageShack Toolbar - {BB8A8834-A0A1-4d70-A21A-72FF89AA737A} - (no file)

After clicking Fix, exit HJT.

Now we need to Reset Web Settings:

1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files"

Now click Start, Run, and enter regedit and click OK. This should open the Windows Registry Editor. In the Registry Editor click File and select Import. Navigate to the fixME.reg file on your Desktop and double click on it. Answer yes to the prompt to allow it to be added to the registry

Did you get a success message?


Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Documents and Settings\yvonne\Start Menu\Programs\Startup\services.lnk
C:\Documents and Settings\All Users\Application Data\mediamoveformulti\okaydent.exe
C:\Documents and Settings\yvonne\Application Data\ATOMDE~1\32third.exe
C:\Program Files\Block Checker\block-checker.exe
C:\Program Files\MessengerPlus! 3\MsgPlus1.exe
C:\Program Files\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\NEWDOT~1\\NEWDOT~2.DLL
D:\Program Files\Warez P2P Client
C:\Program Files\Common Files\{262916F0-0AE8-1033-0916-04102520003d}\Update.exe
C:\WINDOWS\system32\drivers\etc\hosts
C:\WINDOWS\system32\drivers\etc\hosts.msn
C:\WINDOWS\system32\drivers\pshook11.sys

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folder and delete if found:
C:\Program Files\Block Checker
C:\Program Files\MessengerPlus! 3
C:\Program Files\MYWEBS~1 <-- it will be something like My Web Search Bar if it exists
C:\Program Files\NEWDOT~1<-- it will be something like NewDotNet if it exists

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

You may have to uninstall AVG, reboot, and then reininstall to fix this.

The infection you had can break the Windows Firewall and part of ChodeFix.bat tried to fix some aspects of this. The Windows Firewall does not provide adequate protection anyway so don't worry about it being disabled. Install and use this: ZoneAlarmFree

I have no idea what this is but let's finish all fixing first before worrying about this.

They always did. You just never had done step 2 of the READ ME before. Thus you never saw the extensions. You should not really store Word Docs on you Desktop anyway. It increases clutter and makes an easier hiding place for malware. Also malware like to mess with your Desktop so this is not a safe place to store them if these files are important.

Anytime you open a Word file, Word creates a backup with like that. It goes away when you close Word down properly. Again you would never have noticed if you were not storing these on your Desktop.

I'm not sure what you mean!

tcpip.sys is a valid Windows system file which you need. It is not from that virus.

Not a big issue! The middle '1' is not a really too important.



Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [HPHUPD08] D:\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] D:\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [FOR MULTI OWNS TRANS] C:\Documents and Settings\All Users\Application Data\mediamoveformulti\okaydent.exe

After clicking Fix, exit HJT.

If you would like to enhance PC performance, also have HijackThis fix the below unnecessary startups:

O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


Now please download the new versions of GetRunKey and ShowNew just created tonight!

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

 

I'm not sure if you are confusing the use of the word delete with uninstall. Programs that you don't need should be uninstalled not deleted. Then after uninstalling you can cleanup any files/folders/registry keys etc hanging around after the uninstall. If you do it the other way around and start deleting things first and then attempt an uninstall, the uninstall will not work and you will probably have to reinstall the whole application in an attempt to get it uninstalled. Your other choice would be to try a program like below:

Your Uninstaller! 2006

Either way, problems with uninstalling or installing or using any of these programs is also not a topic for the malware forum.

Your log is clean. If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!