Derbiz

Discussion in 'Malware Help (A Specialist Will Reply)' started by hackley, May 25, 2005.

  1. hackley

    hackley Private E-2

    I've done the 'read this first b4 asking 4 help' and downloaded everything you have recommended I think. I don't know all of the technical jargon so please take it easy with me. I think I am ready for 'Hijack This' but have no idea what I'm doing.

    Hackley's girlfriend on his behalf!!
     
    hackley, May 25, 2005
    #1
  2. jeff6303j

    jeff6303j Private E-2

    Please follow the steps below, if you have ran all the steps in the first part ignore and go onto the HJT part. Make sure you have done all the first part before proceding:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
    jeff6303j, May 25, 2005
    #2
  3. jeff6303j

    jeff6303j Private E-2

    Oooohhh noo, I jsut relized my links where niot working :p

    sooo...

    Please follow the steps below.

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
    jeff6303j, May 25, 2005
    #3
  4. hackley

    hackley Private E-2

    Hi

    I ran all of the tests and software i downloaded (recommended) and I did the online scans recommended. The programms found lots of trojan virus and dialers. Should i attach the two reports I was able to copy?

    Hackley's Girlfriend (Nikki)
     
    hackley, May 25, 2005
    #4
  5. jeff6303j

    jeff6303j Private E-2

    If you have ran all the tests then please make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post)
     
    jeff6303j, May 25, 2005
    #5
  6. hackley

    hackley Private E-2

    I have saved the logs that I could from earlier scanning. Shall I attach them for you? If yes, how do I attach them (sorry!). I have also now run Hijack this and am just waiting for you to tell me when I can send it to you (and how to sorry)

    Thanks

    Nikki
     
    hackley, May 25, 2005
    #6
  7. jeff6303j

    jeff6303j Private E-2

    You may attach by saving the log some where on your computer where you will beable to find, example desktop, and then clikc the reply button, under additional options there is a manage attachments button. Click that and brouse to where your log is saved. once you select the log, click upload and post it. Please do upload the log I will look at it :)

    If you need any more help let me know.

    Thnx

    gl hf
    jeff
     
    jeff6303j, May 25, 2005
    #7
  8. hackley

    hackley Private E-2

    Hi JEFF

    Thanx for your help! Attached are the HJT log and the list of virus' etc on my pc.


    Nikki
     

    Attached Files:

    hackley, May 26, 2005
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\uk_nm.exe -N
    O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.41optYplkOmji/SpySpotterCabInstall.cab


    After clicking Fix, exit HJT.

    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\uk_nm.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.


    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

    Now we need to Reset Web Settings:
    1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
    chaslang, May 27, 2005
    #9
  10. hackley

    hackley Private E-2

    Hi

    Really sorry about the new thread thing. It won't happen again. :eek:

    I've followed most of the instructions and have attached the new HJT log. The only step not followed was:

    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\uk_nm.exe

    because it wasn't there?!?. Everything seems to be fine though, there's no sign of the dreaded Derbiz.

    Cheers

    Nikki
     

    Attached Files:

    hackley, May 28, 2005
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's because HJT was able to remove when it fixed the O4 line.

    You're log is now clean. Make sure you follow the steps in the below thread to help keep you clean:

    How to Protect yourself from malware!
     
    chaslang, May 28, 2005
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds