Cleaned but Panda finds wintools searchexe

Discussion in 'Malware Help (A Specialist Will Reply)' started by RnJ, Dec 1, 2007.

  1. RnJ

    RnJ Private E-2

    I've followed the malware removal instructions, I unstalled bad programs, in Safe mode I ran Ccleaner, spybot, counterspy (and AVG anti-spyware), and superantispyware. In normal mode I ran adaware, ATF clean, BHOdmon, stopzilla, vundofix, onlne scanner bitdefender & Panda active scan, HJT, getrunkey and shownew. The network didn't work in safe mode, so bitdefender and Panda were done in normal mode. The only indication of an remaining problem s in the Panda scan finds wintools and searchexe in the registry. I've attached the HJT, getrunkey and shownew logs. What did I miss? Thank you for the help.!
     

    Attached Files:

    RnJ, Dec 1, 2007
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    I guess you started the procedure a number of days back. There is a new shorter and better version of the READ & RUN ME out now. You don't need to redo anything right now.

    You only needed to run CounterSpy or AVG AntiSpyware not both and you did not need to run SuperAntispyware.

    You missed attaching the below logs:
    • CounterSpy or AVG Antispyware
    • BitDefender
    • PandaActive Scan
    You also missed uninstall Viewpoint Media Player in step 0.
    You also missed uninstall all but on antiviruse program in step 3. You have Norton and McAfee installed.
    You also forgot to uninstall Java 2 Runtime Environment, SE v1.4.2 in step 6.

    If Panda is only saying something about those items being in the registry but not telling you where, you don't need to worry about them because they are benign, insignificant, registry entries that will not cause any issues.

    You do need to delete the below files though
    Code:
    "C:\WINDOWS\SYSTEM32\"
bsppdxvc.ini  Nov  8 2007      570952  "bsppdxvc.ini"
dkmspqew.ini  Nov  4 2007        1015  "dkmspqew.ini"
evoluhrx.ini  Jun  6 2007         535  "evoluhrx.ini"
fhfauknq.ini  Jun  6 2007         415  "fhfauknq.ini"
geyrnxxv.ini  Nov  7 2007      570592  "geyrnxxv.ini"
hsrakked.ini  Nov  6 2007      570410  "hsrakked.ini"
losyusun.ini  Nov  4 2007        1135  "losyusun.ini"
mcsjgwkf.ini  Jun  6 2007         715  "mcsjgwkf.ini"
midwkpvi.ini  Jun  6 2007         835  "midwkpvi.ini"
mkljhkgu.ini  Jun  6 2007         595  "mkljhkgu.ini"
nlupjrwc.ini  Nov  8 2007      570772  "nlupjrwc.ini"
otpdiodc.ini  Jun  8 2007         774  "otpdiodc.ini"
ovkvgyrl.ini  Jun  6 2007         655  "ovkvgyrl.ini"
oxnevplc.ini  Jun  6 2007         775  "oxnevplc.ini"
thcbgbek.ini  Jun  5 2007         535  "thcbgbek.ini"
vehijcep.ini  Apr  8 2007     1246581  "vehijcep.ini"
vkaoojut.ini  Jun  6 2007         835  "vkaoojut.ini"
wbrratbi.ini  Jun  5 2007         655  "wbrratbi.ini"
    Let me know if you have any problem deleting these.
     
    chaslang, Dec 1, 2007
    #2
  3. RnJ

    RnJ Private E-2

    Chaslang,

    Thank you for your quick response. Yes this cleaning has taken me a while. I'm trying to cleanup after someone else tried and failed. I did some cleaning with freeware before finding yuour forum, so some scans were "duplicates". I needed to run windows updates and installing SP2, and correct the machine date, it was 6 months behind.
    It appears I was sloppy in cleaning. I have removed the 18 files, Viewpoint (that one tricked me), and Java. The Norton is a problem.
    The last person must have tried to install Norton Internet Security, but there are no icons or entry in start\prgrams. There is a folder under program files. I tried to remove the Norton internet with control panel programs add/remove but no go! It goes to the Nortn website and an error pops up. I also tried HJT to remove it, no luck.
    Should I remove the folder/files manually and use HJT or other software to clean the registry?
    The CounterSpy and Bitderfender found nothing, thats why I didn't attach logs. I'll attach the Panda scan and after removng Norton run new scans. Thanks for your help!
    RnJ

    Incident Status Location Adware:adware/wintools Not disinfected Windows Registry
    Adware:adware/searchexe Not disinfected Windows Registry
     
    RnJ, Dec 2, 2007
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try using the below to get rid of Norton.

    Norton Removal Tool (SymNRT)

    Those are exactly what I said, benign entries that you don't need to worry about.
     
    chaslang, Dec 2, 2007
    #4
  5. RnJ

    RnJ Private E-2

    Chaslang,

    I found the symantec removal tool. The internet security and update were removed. I've attached new logs again. Is there anything else to remove or is it pretty clean?

    Thanks SO much! RnJ
     

    Attached Files:

    RnJ, Dec 2, 2007
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just some minor things. Some performance related.


    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.


    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    After clicking Fix, exit HJT.

    You can delete the below left overs from Symantec.
    Code:
    "C:\Documents and Settings\Deloris proctor\Local Settings\Temp\"
sym114.tmp    Dec  2 2007      170876  "Sym114.tmp"
symnrt~4.log  Dec  2 2007    13777124  "SymNRT 12-2-2007 21h15m30s.log"

    If you are not having any other malware problems, it is time to do our final steps:

    1. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    2. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    3. After doing the above, you should work thru the below link:
     
    chaslang, Dec 3, 2007
    #6
  7. RnJ

    RnJ Private E-2

    Chaslang,

    All these last steps went well. Thank you for all your help, knowledge and insights. I didn't know about the messenger or registry entries. I guess this is my last chance for questions. Why not empty the temp and temporary internet folders for safety, knowing some preferences and passwords saved for convenience will be lost?
    I Also removed some startup items and defragged the hard drive and did the windows updates earlier.
    The user for this machine is not computer savy, so I was going to setup automatic updates for all of these protection software programs, that have it.

    The protect from malware page lead me to downloading these;
    for AV the McAfee was already installed
    Firewall - Comodo PF
    ASpyware - Comodo BOClean AM
    Spyware Blaster

    I am wondering if I should put Spybot back on for the immunize feature (without Teatimer)? Or does this conflict with Comodo BOClean, being 2 AntiSpywares? The Comodo would be realtime which I like because the user would have problems running the Spybot SD.
    Again thankyou so much for sharing your expertise. :)

    RnJ
     
    RnJ, Dec 3, 2007
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    When you ran Ccleaner in the READ & RUN ME, you did this.

    There will be no conflict without Teatimer. You will note that in the How to protect thread Spybot is recommend to be installed.
     
    chaslang, Dec 4, 2007
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds