DyFuCA and ISearchTech.SideFind

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by evilevets, Jun 2, 2005.

  1. evilevets

    evilevets Sergeant Major

    Hi there. Long time MG'er, first time poster in the Spyware Forums!

    Anyway, I've got a few stubborn items here. I have followed the Spyware Read Me First thread to the letter.

    Heres the deal...

    Spybot continually finds the following two items and cannot remove them:
    DyFuCA.Internet Optimizer
    ISearchTech.SideFind

    AdAware SE finds nothing.

    McAfee Avert Stinger finds nothing.

    Nortons finds the following and cannot remove them:
    rdriv.sys (Trojan Horse) C:\Windows\System32\rdriv.sys
    Powerscan[1].exe (Adware) (I manually deleted Powerscan by browsing to it's location in C:\Windows\System32\etc,etc...)

    AVG 7 finds the following and cannot remove them:
    C:\Windows\System32\ipsecs.exe:\install.exe (trojan horse) IRC/Back Door.sdBot.172.F
    C:\Windows\System32\ipsecs.exe:\install.exe (trojan horse) Downloader .lstbar.6.BU

    All versions are up to date, all definitions are up to date also.

    So, I guess I have a combination virus/spyware problem. Any help would be greatly appreciated.

    A hijackthis log is attached.

    Thanks!

    -Steve
     

    Attached Files:

  2. evilevets

    evilevets Sergeant Major

    bump!



    -Steve
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you sure you ran all steps in the READ ME. I see no signs of the online scanners being run and I'm surprised that none of the complained about 180solutions. Did you run AVG in safe mode? If not, you should have.

    Next time please do not post a HJT log unless it is requested.

    Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
    On the page that opens, scroll down to find either Workstation Service Library or Microsoft Locator Service which ever one you find, right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

    Now repeat the above but look for either Microsoft TaskManager Dll Starter or Microsoft TaskManager Dll

    Next, open up HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

    Workstation Service Library

    If the above does not work try using the short name: Microsoft Locator Service

    Now repeat the HJT step to Delete an NT Service on:
    Microsoft TaskManager Dll Starter or Microsoft TaskManager Dll

    After doing the above move on to the next message.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    After completing the steps in my previous message, continue with the below:

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
    C:\WINDOWS\System32\vdy.exe

    After killing all the above processes, click "Back".
    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [C.I.A] vdy.exe
    O4 - HKLM\..\Run: [ZhypH] C:\WINDOWS\tkdtki.exe
    O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
    O4 - HKLM\..\Run: [Microsoft TaskManager Dll Starter] mstskmngr32.exe
    O4 - HKLM\..\RunServices: [C.I.A] vdy.exe
    O4 - HKLM\..\RunServices: [Microsoft TaskManager Dll Starter] mstskmngr32.exe
    O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - C:\WINDOWS\wkssvc.exe
    O23 - Service: Microsoft TaskManager Dll Starter (Microsoft TaskManager Dll) - Unknown owner - C:\WINDOWS\System32\mstskmngr32.exe" -service (file missing)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    c:\program files\180solutions <--- the whole folder
    C:\WINDOWS\System32\vdy.exe
    C:\WINDOWS\tkdtki.exe
    C:\WINDOWS\wkssvc.exe
    C:\WINDOWS\System32\mstskmngr32.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

    Now we need to Reset Web Settings:
    1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds