Novice in Ireland requires some help...

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis​

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy - only for Windows XP, 2K, & NT users
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

This is not what we requested in the READ ME. You installed BitDefender 10 Antivirus program which is a direct conflict with step 3 of the READ ME since you already have AVG installed. Uninstall this NOW. What was requested in step 6 of the READ ME was an online scanner. If you ever need to run these steps again, makes sure you follow the steps properly.

You need to run CounterSpy again (run it in normal boot mode) and this time have it fix what it found. There is no sense in running the scans if you tell them to ignore what they find. Then please attach a new log.


Also per the directions in step 6 of the READ ME, uninstall the below old versions of Sun Java:
Java 2 Runtime Environment, SE v1.4.2_03

Make sure you reboot after uninstalling the above!

Then install the below current version of Sun Java as requested: Sun Java Runtime Environment

Now run this Virtumonde aka Trojan Vundo Removal but run it multiple time until it comes up clean. Then attach the final log from VundoFix.


Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {1CD881E5-0D7E-4CC7-9B2F-DD558C17242A} - C:\WINDOWS\system32\mlljg.dll (file missing)
O2 - BHO: (no name) - {54CBB12C-3481-4C5D-942D-4976C0F0A406} - C:\WINDOWS\system32\jkkkifc.dll (file missing)
O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\system32\lfascfpl.dll (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: jkkkifc - jkkkifc.dll (file missing)
O20 - Winlogon Notify: mlljg - C:\WINDOWS\system32\mlljg.dll (file missing)
O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)


After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
double click it and allow it to merge with the registry.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. ShowNew
4. HJT

 

Not quite! Where is the new log from re-running CounterSpy!


Use Windows Explorer to delete the below file:
C:\WINDOWS\system32\drivers\cmblju^d.sys


Do you know what the below file that appeared on Jun 4th is for?

Code:

"C:\WINDOWS\system32\"
mvcerc~1.dll   4 Jun 2007          19  "mvcerc051010.dll"

How is everything working?

 

Put a copy into a ZIP file and attach the ZIP file here.

If you don't like BitDefender, stick with AVG. If you were happy with BD and pay to keep it updated, then uninstall AVG, reboot, and reinstall BD. It's your choice.


If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, and the C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you run Avenger, you can delete all files related to Avenger now.
7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
9. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Delete this file from your system32 folder.

When you complete my final steps and follow the instructions in the How to protect yourself link, you will see step 11 which is information about cookies.

 

If you read step 11 in that link you will see that you do not need to disable cookies and if you do, you will reduce your surfing pleasure and may not be able to access various websites properly. Cookies are not problems!

It's not a problem. Many websites only work properly with IE. Just like in step 6 of the READ ME where we say you must use IE. The link you gave for Kaspersky is the same. You must use IE.

 

You're welcome. Surf safely!