adsmsex infection BHO type

BtoHutch · Nov 19, 2007

Hi guys hope you can help me out here, I'm getting on my nerves with this, I always could remove any spy, malware or virus I found, but this one seems like is controlling my windows services, I cant do anything to eliminate it, I really really need help on this.

++Sympthoms:
- URL Redirection to (http://201.218.196.152/click.php?c=789b60e7040fff7ad06f4004&r=1)
- Systray Pop Ups advertising AVs and Porn Sites.
- Register as BHO with A attrib
- Unload and disable Spybot Searh and Destroy and AVG, Kapersky and Panda AV software at next reboot.
- None spy software could detected it, even online AV... and is not identified in any AV site.

Let me tell you what I have done; System restore disabled, Tried to delete key from Hijackthis on Secure mode... dont let me, Tried to remove C:\WINDOWS\system32\adsmsex.dll with Killbox on Secure Mode... dont let me, Tried to remove from CMD on Secure Mode... dont let me; Ran Spybot, ad-aware and DSPlguard wont detected it... , Ran onlince AV scan from Symantec, Panda, Kapersky, TrendMicro and wont detected it, Ran local AVs like AVG, Kapersky, Norton and wont detect it either... @"#$%#$&"@!!
I went into DOS using a CD-Boot image of Nero to try to delete it but wont let me, same with attrib cmd...

++Discovers:
1- If the IP 201.218.196.152 is blocked in thr Windows Firewall google redirection stops, but the yellow systray Pop up still showing...
2- If disabled the IExplorer complement on Tools menu the redirection stops, heres a sshot from my Complement window:
http://www.hutchinson.com.mx/graficos/complement.gif
3- AVZ Antivirus is the only app that might unload the dll from explorer and iexplorer, is even more efficient that the cmd regsvr32 /u; heres a link if anyone need it AVZ Topic Forum with link to download

Edit: Removed inline Hijackthis log Sorry admins, I just read the rules on forum, me bad...

Thanks in advance, I'll wait for any help on this.

DavidGP · Nov 19, 2007

Welcome to Majorgeeks!

I note you have tried many things that are already listed in our guide below, but these steps even trying to re-run them again plus our unique applications will give us some crucial logs, Hijackthis on its own will not highlight all, plus if its not renamed it will miss some of the newer varieties of malware.

Try as best as possible to get all the logs requested if you can, even if ther online scans wont remove it the logs maybe very telling as to where its hiding.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

BtoHutch · Nov 29, 2007

I want to get closed this Thread since I've got help from some where else.

Anyway I wanna thank you, for letting me post here.

CLOSED

Log in or Sign up

adsmsex infection BHO type

BtoHutch Private E-2

Attached Files:

hijackthis.log

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

BtoHutch Private E-2