CoolWWW and other popups

If you have followed ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal and you still have a problem, follow the guidelines below.

Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT

 

Make sure you have viewing of hidden files enabled (per the tutorial).

Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
C:\WINNT\system32\wowrow.exe
C:\WINNT\System32\dpmw32.exe
C:\Documents and Settings\Bg10\Application Data\oete.exe
C:\WINNT\system32\l?ass.exe <--- note this is NOT lsass.exe


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [fwhbagbodtmzq] C:\WINNT\system32\jepoyz.exe
O4 - HKCU\..\Run: [cmpbk32] C:\WINNT\system32\cmpbk32.exe
O4 - HKCU\..\Run: [eBqtRWfnR] rsnfmon.exe
O4 - HKCU\..\Run: [winpack] C:\WINNT\system32\winpack.exe
O4 - HKCU\..\Run: [Casp] C:\Documents and Settings\Bg10\Application Data\oete.exe
O4 - HKCU\..\Run: [Akbeu] C:\WINNT\system32\l?ass.exe
O4 - HKCU\..\Run: [setupapi] C:\WINNT\system32\setupapi.exe
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4019/ftp.coupons.com/v3123/cpbrkpie.cab

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\WINNT\system32\wowrow.exe
C:\WINNT\System32\dpmw32.exe
C:\Documents and Settings\Bg10\Application Data\oete.exe
C:\WINNT\about.htm
C:\Program Files\CSBB <--- the whole folder
C:\WINNT\system32\jepoyz.exe
C:\WINNT\system32\cmpbk32.exe
C:\WINNT\system32\rsnfmon.exe
C:\WINNT\system32\winpack.exe
C:\WINNT\system32\setupapi.exe

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

The O1 - Hosts: lines will most likely all come back. They have been a big problem lately (Vx2 problems). If they do, you will have to download these tools:


Generic Detection Tool
http://www.downloads.subratam.org/DllCompare.exe
http://www.downloads.subratam.org/VX2Finder.exe
http://www.downloads.subratam.org/KillBox.zip
Then, unzip the Generic Detection Tool to a safe folder of your choice and run "findit.bat" - Allow it as much time as it needs to run. You may get an error message of "File Not Found," but just let it go.

The tool should generate a long text file. Please attach that to your next post.
Do not reboot after that because that can cause the files to mutate.

 

Windows 2000 also has a Task Manager in that first windows. Click on it and select the Processes tab.

 

Try this to bring up TaskManager. Click Start, Run, and enter taskmgr into the box and click OK.
If that, brings up TaskManager, select the Processes tab. You need to be able to end process or you will not be able to clean up these issues. You have big problems with VX2. You already have about 42 bad files in c:\winnt\system32 and it probably gets worse at each reboot.

By the way I noticed you are running multiple antivirus applications (McAfee and Avast). You must only run one. Choose which one you want to keep and uninstall the other. Do that now and reboot.

 

If you are now able to get to Task Manager's process list do the below.

If you still cannot get to Task Manager's process list, then use the one built into HijackThis. When HJT comes up, click the Misc Tools button. The clicl open Process Manager and use it to select each item I list to kill and then click the Kill Process button. Substitute that in where I say use TaskManager.

Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).

Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
wowrow.exe
dpmw32.exe


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe

Boot into safe mode and use Windows Explorer to delete:
C:\WINNT\system32\wowrow.exe
C:\WINNT\System32\dpmw32.exe

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Note this will not fix the O1 - Hosts lines but I need to make sure you have other items fixed first and that you have a means to kill processes.

 

After completing my instructions in message #11 and then #12, do the following.

Run PocketKillbox that I had you download.

Run Killbox again.
1) Click "Replace on Reboot" and check the "Use Dummy" box.
Paste the below file into the top "Full Path of File to Delete" box.

C:\WINNT\SYSTEM32\awsnw.dll

(Make sure you cut & paste in the filenames. If you try typing, you will get an error on the c: )

2) Click the "Delete File" button which looks like a stop sign.
3) Click "Yes" at the Replace on Reboot prompt.
4) Click "No" at the Pending Operations prompt.
5) Repeat steps 4-8 above for these files:

C:\WINNT\SYSTEM32\azas0i57e8.dll
C:\WINNT\SYSTEM32\d00m0ad1ed0.dll
C:\WINNT\SYSTEM32\dnnu0159e.dll
C:\WINNT\SYSTEM32\e8202ifmg82a2.dll
C:\WINNT\SYSTEM32\f42mlef11h2.dll
C:\WINNT\SYSTEM32\fp4203hoe.dll
C:\WINNT\SYSTEM32\fp6803jue.dll
C:\WINNT\SYSTEM32\fpjs0317e.dll
C:\WINNT\SYSTEM32\fprs0397e.dll
C:\WINNT\SYSTEM32\g8lmli3118.dll
C:\WINNT\SYSTEM32\i424lefq1h2e.dll
C:\WINNT\SYSTEM32\i460lejm1hoa.dll
C:\WINNT\SYSTEM32\ir46l5hs1.dll
C:\WINNT\SYSTEM32\ir88l5lu1.dll
C:\WINNT\SYSTEM32\j4n2le5o1h.dll
C:\WINNT\SYSTEM32\jr4025hmg.dll
C:\WINNT\SYSTEM32\jt2007fme.dll
C:\WINNT\SYSTEM32\k008ladu1d08.dll
C:\WINNT\SYSTEM32\k462lejo1hoc.dll
C:\WINNT\SYSTEM32\k8440ihqe84e0.dll
C:\WINNT\SYSTEM32\kt2ol7f31.dlll
C:\WINNT\SYSTEM32\ktr0l79m1.dll
C:\WINNT\SYSTEM32\l4p2le7o1h.dll
C:\WINNT\SYSTEM32\lv8009lme.dll
C:\WINNT\SYSTEM32\lv8u09l9e.dll
C:\WINNT\SYSTEM32\lvnq0955e.dll
C:\WINNT\SYSTEM32\m028lafu1d28.dll
C:\WINNT\SYSTEM32\m0nqla551d.dll
C:\WINNT\SYSTEM32\m2rm0c91ef.dll
C:\WINNT\SYSTEM32\mv88l9lu1.dll
C:\WINNT\SYSTEM32\mvn2l95o1.dll
C:\WINNT\SYSTEM32\mvp0l97m1.dll
C:\WINNT\SYSTEM32\nwdsetup.dll
C:\WINNT\SYSTEM32\o8ns0i57e8.dll
C:\WINNT\SYSTEM32\o8nsli5718.dll
C:\WINNT\SYSTEM32\p0r4la9q1d.dll
C:\WINNT\SYSTEM32\q068laju1do8.dll
C:\WINNT\SYSTEM32\q0psla771d.dll
C:\WINNT\SYSTEM32\q8860ilse8q60.dll
C:\WINNT\SYSTEM32\t48u0el9ehq.dll
C:\WINNT\SYSTEM32\tukwks.dll

Still in Killbox
Make sure you still have "Replace on Reboot" and check the "Use Dummy" box.
Paste the below file into the top "Full Path of File to Delete" box.
C:\WINDOWS\System32\Guard.tmp

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Replace on Reboot prompt.
Click "Yes" at the Pending Operations prompt to restart your computer.

After your PC reboots run find.bat again and post the new output.txt (you will have to rename it to output2.txt to upload it).

 

Okay! Don't worry about the popups! We are not done fixing the VX2 issues yet. We have a ways to go. We did not get all the files on the first attempt:

Run Killbox again.
1) Click "Replace on Reboot" and check the "Use Dummy" box.
Paste the below file into the top "Full Path of File to Delete" box.

C:\WINNT\SYSTEM32\grkrsrc.dll

(Make sure you cut & paste in the filenames. If you try typing, you will get an error on the c: )

2) Click the "Delete File" button which looks like a stop sign.
3) Click "Yes" at the Replace on Reboot prompt.
4) Click "No" at the Pending Operations prompt.
5) Repeat steps 1-4 above for these files:

C:\WINNT\SYSTEM32\dnl2013oe.dll
C:\WINNT\SYSTEM32\l04q0ah5ed4.dll
C:\WINNT\SYSTEM32\j4l40e3qeh.dll
C:\WINNT\SYSTEM32\wzv9vcm.dll
C:\WINNT\SYSTEM32\kt2ol7f31.dll

Still in Killbox
Using Standard File Kill" Paste the below file into the top "Full Path of File to Delete" box. C:\WINNT\SYSTEM32\Guard.tmp

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Pending Operations prompt to restart your computer.

After your PC reboots run find.bat again and post the new output.txt (you will have to rename it to output3.txt to upload it).

Also use Windows Explorer and please Navigate to C:\winnt\SYSTEM32 and look for a file named guard.tmp. I want to make sure it is gone.

Make sure you tell me if there are any errors or problems along the way.

 

Also after your machine reboots, run DLL Compare – Click Run Locate.com then click the Compare button. Follow the prompts and allow time for it to complete and make a log. Please attach that Log.

 

Sometimes this requires repetition and a few extra twists. This time make sure you are physically disconnected (unplug cable) from the internet during this whole procedure until I have you reboot an come back here. So print this instructions of save them locally since you must be offline.

Run Killbox again.
1) Click "Replace on Reboot" and check the "Use Dummy" box.
Paste the below file into the top "Full Path of File to Delete" box.

C:\WINNT\SYSTEM32\wvuspol.dll

(Make sure you cut & paste in the filenames. If you try typing, you will get an error on the c: )

2) Click the "Delete File" button which looks like a stop sign.
3) Click "Yes" at the Replace on Reboot prompt.
4) Click "No" at the Pending Operations prompt.
5) Repeat steps 1-4 above for these files:

C:\WINNT\SYSTEM32\kt0ol7d31.dll
C:\WINNT\SYSTEM32\lvl8093ue.dll
C:\WINNT\SYSTEM32\gprml3911.dll

Still in Killbox (we have to check again, it may come back)

Copy and Paste C:\WINDOWS\SYSTEM32\guard.tmp into the box – If it exists, it will show up in Blue underneath the filename box. Check the option to Use Dummy and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your machine to reboot Normally.

After your PC reboots run find.bat again and post the new output.txt (you will have to rename it to output4.txt to upload it).

Also use Windows Explorer and please Navigate to C:\winnt\SYSTEM32 and look for a file named guard.tmp. Tell me if it is still gone.

 

You need to repeat the process with Killbox on the below files and finish of with fixing of guard.tmp again. Do not run any other scanners of process while trying to fix this. Also avoid reboots except when told. These will cause mutation.

c:\windows\system32\wyvdmod.dll
c:\windows\system32\irj6l51s1.dll
c:\windows\system32\sfscrap.dll
c:\windows\system32\gpjsl3171.dll

Then Copy and Paste C:\WINDOWS\SYSTEM32\guard.tmp into the box – If it exists, it will show up in Blue underneath the filename box. Check the option to Use Dummy and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your machine to reboot Normally.

After that post a new findit.bat log and also run DLLcompare and post a log.

 

Yes delete it! If you cannot delete it with explorer, do the below

Run Pocket KillBox and Copy and Paste the Following into the box: C:\WINNT\System32\guard.tmp
Select Standard File Kill - Click Red X to delete it.

Then do the following steps:

Run Pocket KillBox and Copy and Paste the Following into the box: C:\RECYCLER\Desktop.ini - Click Red X to delete it using Standard File Kill.

NOW:

Open VX2Finder and Click the Restore Policy Button.

Then, use the UserAgent$ Button to remove the UserAgent from the registry.

NEXT: Run findit.bat (Generic Detection Tool) and attach that Log and a fresh HJT Log

We are almost there! As long as it does not respawn! Be careful what you run. Do not run any other tools.

 

Using START > RUN > regedit, please open the registry editor and navigate to the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings

Backup this key by clicking File, Export and then enter a File name and save it somewhere you can find it (if needed). Do the Export before doing the following:
RightClick on the above registry key (the Internet Settings one - make sure the bottom of the regedit window shows the full reg key as shown above in bold) and select DELETE.


We don't seemed to need any fixes in HijackThis . The O1 - Hosts lines are gone.

After doing the above you should be clean! Let me know.
Make sure you check this thread out: How to Protect yourself from malware!

 

You're welcome! Stop back and let me know how it's working.