Cws

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by soulpincher, Oct 18, 2004.

  1. soulpincher

    soulpincher Private E-2

    Hi I have the CWS or similar bug and I have gone through your Spyware, Trojan And Virus Removal thread. I have scanned and found virus with Ad-aware 6 and CW shredder but it keeps coming back. Problem is, when I tried to install the alternative spyware programs you recommended they won't install, it just shuts down before installation is complete. I have not tried Hijack this. Please help I am clueless what to do?
     
    soulpincher, Oct 18, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you went thru our tutorial you would not be using Ad-aware 6. Please run the full tutorial in the order specified making sure you use the programs and versions that are in the links provided.
     
    chaslang, Oct 18, 2004
    #2
  3. soulpincher

    soulpincher Private E-2

    I did go through the tutorial and followed the steps not only concerning the programs but also regarding system restore and more. Problem is that I cannot install a newer version of Ad-aware nor another program, and I suspect this has to do with the virus. So my only option is to ask for advice. How can I get rid of this bug that hinders me from installing programs? What other things can I do?

    really appreciate any help
     
    soulpincher, Oct 19, 2004
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! I had understood differently because you said "when I tried to install the alternative spyware programs" that is a special section of the tutorial and does not contain Ad-aware. If you are not able to install application you need to tell us exactly which items in the tutorial were you able to complete? And if you do not have current versions of any other items, we need to know that too. Please list what items in the tutorial you were able to run and the result? Right now it appears you only ran:
    Ad-aware 6
    CWShredder

    Is your problem, only during installation of the programs or during download?
    Do you try the online scans?
    What OS do you have?
    Do you have a full virus protection application on your PC.
    Do you have HijackThis and if so, what version? Does it run? If so, get a log and post it here as a .txt file attachment.
     
    chaslang, Oct 19, 2004
    #4
  5. soulpincher

    soulpincher Private E-2

    This is what I was able to do from the tutorial:

    1. I disabled system restore.
    2. I checked the services - no one was showing.
    3. I enabled viewing of hidden files.
    4. I scan my computer with Ad-aware 6, (since I was unable to install others) log enclosed.
    5. I did online scan in safe mode at:
    - Symantec which failed since it complained over my activeX and script settings . I checked those three times and they were according to Symantecs specs - so something odd there.
    - Trend Micro's - was unable to install their software - could not find plugins even though they were where they were supposed to be..
    - Bitdefender - log enclosed
    - Trojan online scan - halted mid through scan, could not gain access to my harddrive C: It said "C:\WINDOWS\system32\?? - Incorrect syntax for file name, catalog name or volume etikett.
    6. Tried Windows update, get redirected to this search page which also appears when I open Explorer.
    7. I am not running Microsoft Java, but Sun Java instead.

    Thanks a lot
     
    soulpincher, Oct 20, 2004
    #5
  6. soulpincher

    soulpincher Private E-2

    I can download programs, but when I start to install them the install window shuts down. I am running Windows XP professional and Pc-cilllin which licence have run out so last update was in February I am afraid. I don't have Hijackthis installed, I tried to but it wont install (latest version). I also seem to get a upload error when I try to upload my logs.

    thanks
     
    soulpincher, Oct 20, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to rename your log files so they have .txt extensions instead of .log.

    HijackThis does not require an install. It just needs to be unzipped (assuming you dowloaded it from us, from the link in the tutorial). If it will not run after unzipping, rename hijackthis.exe to myhjt.com
    and then double click on myhjt.com. Post a log as a .txt file attachment. Make sure browsers are closed before scanning.
     
    chaslang, Oct 20, 2004
    #7
  8. soulpincher

    soulpincher Private E-2

    I just ran hijackthis, enclosing the log. The other logs does say. txt but I dont seem to be able to upload them, but the hijackthis.txt went ok.
    thanks
     

    Attached Files:

    soulpincher, Oct 20, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    When you finish getting the present problems resolved, you need to goto Windows Update and get your PC updated. You are seriously out of date.

    Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).
    First goto Control Panel, Add/Remove Programs and see if there is an uninstall for ISTbar, or MYWay, or MYBar. If so, uninstall them and some of the lines I ask you to fix below with HJT and files to delete may not be necessary if they already get removed.


    Click Start, and then click Run. (The Run dialog box appears.)
    Type, or copy and paste, the following text:
    regsvr32 /u C:\Program\SideFind\sidefind.dll
    then click OK. If a dialog box confirming this action appears, click OK.

    Click Start, and then click Run. (The Run dialog box appears.)
    Type, or copy and paste, the following text:
    regsvr32 /u C:\WINDOWS\System32\m2rglz9x1pc1.dll
    then click OK. If a dialog box confirming this action appears, click OK.

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below process and End it if found:
    sgnlybi96rj7i9.exe


    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://super-spider.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://super-spider.com/sp.htm?id=9
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://super-spider.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://win-eto.com/hp.htm?id=9
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\m2rglz9x1pc1.dll
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
    O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program\ISTbar\istbar.dll
    O4 - HKLM\..\Run: [Network Security Guard] C:\WINDOWS\System32\sgnlybi96rj7i9.exe
    O4 - HKLM\..\Run: [cleaner] C:\WINDOWS\System32\cl2tl1a302t3.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program\SideFind\sidefind.dll
    O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
    O20 - AppInit_DLLs: 3dg61otselarm.tlb 79gileo3w8v.tlb pibss3gwotls5w.tlb d68wjxlka5j83r.tlb


    Did you add the below item to your trusted zone? If not, fix the O15 line too.
    O15 - Trusted Zone: *.greg-search.com

    The two Ip addresses ( 81.216.65.11 and 81.216.65.12 ) found in the below O17 lines belong to iggypop1.siwnet.net
    Unless you recognize this as something valid for you to use, I would fix the below 3 lines too.
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0DD156F3-C706-4A46-B9D1-56DA45315434}: NameServer = 81.216.65.11,81.216.65.12
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0DD156F3-C706-4A46-B9D1-56DA45315434}: NameServer = 81.216.65.11,81.216.65.12
    O17 - HKLM\System\CS2\Services\Tcpip\..\{0DD156F3-C706-4A46-B9D1-56DA45315434}: NameServer = 81.216.65.11,81.216.65.12
    Boot into safe mode and use Windows Explorer to delete:
    C:\Program\ISTbar <--- the whole directory if still present
    C:\Program\MyWay <--- the whole directory if still present
    C:\Program\SideFind <--- the whole directory if still present
    C:\WINDOWS\System32\sgnlybi96rj7i9.exe
    C:\WINDOWS\System32\cl2tl1a302t3.exe
    C:\WINDOWS\System32\m2rglz9x1pc1.dll
    C:\WINDOWS\System32\3dg61otselarm.tlb
    C:\WINDOWS\System32\79gileo3w8v.tlb
    C:\WINDOWS\System32\pibss3gwotls5w.tlb
    C:\WINDOWS\System32\d68wjxlka5j83r.tlb

    Look around and tell me if you see any other strangely named files in C:\Windows\System32.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
    chaslang, Oct 21, 2004
    #9
  10. soulpincher

    soulpincher Private E-2

    Hi again, I went through your list and deleted what I could. I have a program MySearchBar in the unistall list but it could not be uninstalled, a blank internet explorer window just opens with the header "res://C:?program?myWay?myBar?1.bin?mybar.dll/101
    Anyway I was able to delete some of the folders you listed in windows/system32 folder. Enclosing my log again, and I think some things are still there :(

    Thanks
     

    Attached Files:

    soulpincher, Oct 21, 2004
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please try giving this 15 day trial version of GIANT Antispyware a run. (Download the GIANT AntiSpyware Free trail)

    Save any logs you can from it and post them back here as an attachment. Also post a new HJT log after running.
     
    chaslang, Oct 21, 2004
    #11
  12. soulpincher

    soulpincher Private E-2

    I have run the GiANT antispyware and if found a lot of infected files and registry keys. I dont think it is possible to save a log from it, I didn't find such a feature. There seems to be one bug that is especially nasty and which comes back and every minute I get a GIANT AntiSpyware alert (popup) which says that Trojan.Small is trying to install a Browser Helper Object. I have clicked remove about 10 times now and it never seems to stop. But it is always a different file name which is deleted.
    I also ran a scan with HJT and the log is enlcosed. What can you make out of it?
    Thanks
     

    Attached Files:

    soulpincher, Oct 21, 2004
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hit CTRL-ALT-DEL to bring up Task Manager and click Processes. Is the follow process actually running and running multiple times:
    sgtat8cs8ir668.exe

    If so try, end each of them with Task Manager and the run HJT this and fix the below lines. Make sure no browser (IE) windows are open when fixing:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=9
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\zgt3ji9glr.dll
    O4 - HKLM\..\Run: [Network Security Guard] C:\WINDOWS\System32\sgtat8cs8ir668.exe
    O20 - AppInit_DLLs: e92bj76sk4arm6.tlb ayv7yc5vph4o.tlb ll9csx9x29w15.tlb gt6a3wv1v6j.tlb 3dgofifwl2.tlb wm46g84x44w5.tlb 19bl77och8h4im.tlb js1lnyk9f2ey7.tlb c2vah0pkvlj.tlb omzxxt3yiw5zgi.tlb 4v8gc0yjhau3.tlb 51l1m18kp6imre.tlb r0o2mncav3m.tlb

    Now run a Giant Software scan followed by Ad-aware SE. You should have the Ad-Aware VX2 Cleaner plug-in installed too, so run it

    Who do those IP address belong to on the O17 lines: 81.216.65.11, 81.216.65.12
     
    chaslang, Oct 21, 2004
    #13
  14. soulpincher

    soulpincher Private E-2

    About the ip's 81.216.65.11, 81.216.65.12, sorry I forgot to mention that they are my ISP's DNS servers.

    I found the processes sgtat8cs8ir668.exe (3 of them) and shut them down. Then I ran hjt and found and deleted all those files you listed. I ran a Giant Software scan followed by a full scan with Ad-aware SE with the plug-in. The log with critical items was quite long (over 100 items) and I deleted all critical. Then I ran a quick scan with Ad-aware once more and got 11 more critical item, all cool web search key values.

    I have identified a process sg6zd9rvmwt.exe that keeps coming back after I close it in task manager. If I close it and then run Ad-aware SE I get no bugs but if I then run Ad-aware once more after the process has reappeared then I get these 11 critical CWS items (see log).

    Also this process is causing a netword error. I get this windows pop-up stating "Network Security Guard has encountered a problem and must be shut down" (translated from swedish).
    Question is what can I do to make this process go away, it seems like it is the last bug? Or is it?

    thanks,
     
    soulpincher, Oct 22, 2004
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is it always the same name process (sg6zd9rvmwt.exe) that keeps coming back?
    Try killing it an immediately run CWShredder and select FIX.
    Also try running Ad-aware SE VX2 cleaner plug-in.

    Can you locate the file using Windows Explorer and delete it from safe mode?
     
    chaslang, Oct 22, 2004
    #15
  16. soulpincher

    soulpincher Private E-2

    Yes at the moment if is the only process that keeps coming back after I close it. I am certain it has to do with the my start page in IE because I managed to change the start page once i killed the process but as soon as it started up again it immidiately redirected my IE to this search page. I will try running hjt after closing it. I have already tried running Ad-aware SE VX2 cleaner plug in and when the process is killed I get no bugs but If I run it when the process is running I get 11 CWS bugs. Maybe a should just run a seach for the process and then delete it. Get back to you soon.

    Thanks
     
    soulpincher, Oct 22, 2004
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you use Search, you need to do the following:
    Click Search and the Select "All files and folders"
    Enter the filename in the "All or part of the file name:" box, so enter sg6zd9rvmwt.exe
    Now select "More advanced options"
    Make sure the following check boxes are checked:
    - Search system folders
    - Search hidden files and folders
    - Search subfolders

    Then click the Search button.

    Make sure when trying to remove these files and or trying to fix with anything (including scanners) that no browsers (IE, FireFox etc) are running. It may also be a good idea to have no access to the Internet available (disconnect cables).
     
    chaslang, Oct 22, 2004
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If still having problems, please give the below 15 day trial a run.

    http://www.giantcompany.com/download.aspx?prodID=70
    GIANT Company Software - Download

    We have been seeing some good results using this program. It would be good to see if it helps here.
     
    chaslang, Oct 22, 2004
    #18
  19. soulpincher

    soulpincher Private E-2

    Oboy this is a tough one. There is actually a new process which keeps coming back now sga3hcxc2dru.exe. The one I mention earlier sg6zd9rvmwt.exe does not appear anymore.

    I was able to find this new sga3hcxc2dru.exe when i did a search in safe mode, it was in windows/system32. when I deleted it, it just came back. BUT if I disconnected from the internet and deleted it it did not come back. During this time no new strange processes started and no critical files could be found when I ran a scan.

    From this I think I know what bug is causing the problems, it is the Trojan.Small (trojan downloader), see log.
    As soon as I connected to the Internet again, Trojan.Small was trying to install a Browser Helper Object on mycomputer. What I don't understand is that even though I removed Trojan.Small and every other critical item found with both GIANT Antispyware and Adaware SE with VX2-cleaner and manually deleted the program sga3hcxc2dru.exe they all came back once I opened my connection to the internet.

    Have you any ideas?
     
    soulpincher, Oct 22, 2004
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Boot into safe mode and have no internet connection available again. Run Task Manager and kill any of those strange processes. Run all the scanning tools (accept the online scans). Make sure you run CCleaner and Stinger. Manually go into C:\windows, C:\Windows\system32, and C:\Documents and Settings\George\Lokala inställningar\Temp and look for any of the strangely names files. Don't just look for .EXE types. Look for anything like those weird names. Remove them. While in safe mode, run HJT again and fix any of those lines that we have been fixing (obviously the names may have changed). While in safe mode and with no physical ability to connect to the internet, open up one Internet Explorer session even though it cannot connect anywhere. See if any of the strange proesses came back in Task Manager or are list in a new HJT scan. Also check the directories again to see if any files respawned.

    Now reboot in normal mode and post a new HJT log. Tell me what happened with all the above and where things stand right now.
     
    chaslang, Oct 22, 2004
    #20
  21. soulpincher

    soulpincher Private E-2

    I have a lot of strange .exe-files like 0huzybpsh5.exe, stop.00009_2.exe, root9i1gwv.exe or wmwh1owess.exe under C:\Windows\system32
    I would estimate the number of .exe programs under C:\Windows\system32 to be around 100.

    What can I delete and what is dangerous to delete, I am afraid I will make even more damage?
     
    soulpincher, Oct 23, 2004
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well none of those files you mentioned are valid. You can sometimes right click on the file and select Properties and then the Version tab and go thru the list of Item names to see who it belongs to. Many times there are no version tabs. That is an indication that it could be malware but not definitely. A suggestion I would make would be to either move all the suspected files to a different folder (like create one called c:\junk32). That way you could copy them back if you made a mistake. Also only move 10 or so at a time. I would expect that anything with extremely random names like 0huzybpsh5.exe are bad. You may also have other extension types like .dll and .dat that are bad too.

    Another approach could be to leave the files in the system32 directory and rename all of them (do all of them). Rename them to something you no how to recover from. For example rename:
    0huzybpsh5.exe to 0huzybpsh5.badexe (do not use 0huzybpsh5.bad.exe)
    badfile.dll to badfile.baddll
    123456.dat to 123456.baddat
     
    chaslang, Oct 23, 2004
    #22
  23. soulpincher

    soulpincher Private E-2

    So far so good no Trojan.Small starting to download stuff...
    I have managed to delete a lot of bad .exe files both under c:\windows and c:\windows\system32. One file (.tlb) I was not able to delete so I changed the filename and filetype to bad_vkip52dx36by_bad.badtlb. Enclose my HJT just in case.

    Thanks a lot!
     

    Attached Files:

    soulpincher, Oct 23, 2004
    #23
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your log looks clean. Hopefully your trojan problems are now gone. You need to now get your system updated since you are seriously out of date. Please see: How to Protect yourself from malware!
     
    chaslang, Oct 24, 2004
    #24
  25. soulpincher

    soulpincher Private E-2

    My system works fine now, I have patched it up and will upgrade the anti-virus and firewall as well. I have used Zone Alarms firewall before so I know I works well, but which of the three listed antivirus software would you recommend?

    Thanks
     
    soulpincher, Oct 25, 2004
    #25
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    They are all pretty good. Personal preference of mine and many others is Avast.

    And you're welcome.
     
    chaslang, Oct 25, 2004
    #26

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds