Ezula and startup problem

Discussion in 'Malware Help (A Specialist Will Reply)' started by ninit, Apr 2, 2005.

  1. ninit

    ninit Private E-2

    Hi, Norton turned up Ezula on my system but couldn't delete/uninstall it. Also, it took me 3 tries to boot up yesterday--first 2 times I was told a file in Windows\system32...(didn't write it down!) was corrupt or missing and I needed to reinstall with the original disk. On 3d attempt to start, all was normal. Found some info on how to delete azula online but I'm a novice and it went over my head. Any help with this HJT log would be great.

    I've cleaned up with adaware, spybot, & msn antispyware. The post-clean-up log is below. I also posted this on another forum and was advised to delete the following, but I'd be grateful for a 2d opinion. I searched through other posted HJT logs for similar items to see if they were told to delete and found some discrepancies.

    Told to delete:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    ----
    Edit by chaslang: Unrequested, old version, inline log removed
     
    Last edited by a moderator: Apr 2, 2005
    ninit, Apr 2, 2005
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please do not post HJT logs unless requested and do not post them inline. Also your HJT version is out of date.


    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
    chaslang, Apr 2, 2005
    #2
  3. ninit

    ninit Private E-2

    OK, I followed all the instructions on the before you post sticky (sorry for not doing so before--checked the FAQ section for posting rules but didn't notice the stickies).

    Anyway, I did every scan and the cleaning, but I could not do scans in safe mode because my cursor froze, so all were done in normal mode. Nothing was found (pbly because I've already done a lot of scrubbing) except the Ezula found by Norton that I posted about originally. Also tried ADS SPY and no alt data streams were found.

    Basically, I'm looking for help on how to uninstall Ezula, which Norton antiV turned up before my first post. Some sites suggest using add/remove to get rid of TopText, it's other name, but it wasn't there. I found some other removal info, but it went over my novice head. Here's a site that seems helpful, but I don't even know how to get into dos mode to do this: http://www.whirlywiryweb.com/removeezula.htm.

    Thanks in advance for any help you can provide.
     
    ninit, Apr 2, 2005
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you have run all of the READ ME, complete the last part of my instructions on how to post a HijackThis log and post one as an attachment.
     
    chaslang, Apr 2, 2005
    #4
  5. ninit

    ninit Private E-2

    HJT log is attached. Thanks for your help.
     

    Attached Files:

    ninit, Apr 3, 2005
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure viewing of hidden files is enabled (per the tutorial).

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
    C:\WINDOWS\ALCXMNTR.EXE

    Note There is really nothing bad about the R1 & R0 lines but having such complex look pages with redirects in them is not typically needed. So below I'm going to have you fix the entries and later reset your web settings to system defaults. You can them choose what you want for a home page.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE


    After clicking Fix, exit HJT.

    Now we need to Reset Web Settings:
    1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working. Anymore error messages? If so, write down the exact message.
     
    chaslang, Apr 4, 2005
    #6
  7. ninit

    ninit Private E-2

    Re: Ezula still present

    Thanks for all the help so far. Did as was told and new HJT log is attached. As for startup problems, haven't had anymore. As for Ezula, it's still present and Norton again failed to delete it.
     

    Attached Files:

    ninit, Apr 4, 2005
    #7
  8. ninit

    ninit Private E-2

    Got rid of Ezula, all done, thanks

    OK, here's an embarrassing update. Since Norton said the ezula was in programfiles\onlineservices\peoplepc\altbrowser.exe, I just dropped the whole peoplepc folder in the trash and emptied it (I don't use peoplepc, the folder came on my pc uninstalled). Anyway, a rescan w/ Norton didn't turn up ezula again. Guess I should have done that in the first place.

    Thanks for all the help with the other stuff though.
     
    ninit, Apr 4, 2005
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: Got rid of Ezula, all done, thanks

    Good job! Sounds like your problems are all resolved then?
     
    chaslang, Apr 4, 2005
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds