Help with HJT log files -- bad spyware/trojan problem

bbklarinette · Mar 28, 2005

I have done everything that I know to rid myself of these pop-ups, etc. I ran every program in "READ ME FIRST BEFORE ASKING FOR SUPPORT...." and to no avail. I even downloaded the 30-day trial of "Trojan Remover" only to reboot and all my problems commence.

Every program tells me that I am free of viruses; however, Trend Micro's Online Virus Scan found 13 Trojan files. Trojan Remover refers to some of these same files as "Adware/spyware" so I'm not really sure what they are. I have also found a program running several times called "BMan" and "BMan1" which I feel are related to my problems. Spybot S&D supposedly fixes all my problems but when I reboot or reconnect to the internet the problems return.

I have run HJT and fixed a few issues that I could clearly see were not right, but I am unsure of some of the other files listed and need some expert advice.

I need help please, because I am at wit's end and am making no money since I need this confounded contraption for my income!

bbklarinette · Mar 28, 2005

Sorry. I noticed there were a few more things that you needed to know in order to help. I have Windows XP as my operating system. Pentium 4, 2.20 GHz, 256 MB RAM. I have a DSL internet connection, and in case this helps it is a DELL.

chaslang · Mar 28, 2005

First please do the following: download and update Microsoft® Windows AntiSpyware but do not run a scan yet. Now boot into SAFE MODE and run a full scan with MS Antispyware. It should find and fix some of your problems.

Now boot in normal mode and post a new HJT log attachment.

bbklarinette · Mar 28, 2005

Ok. I ran MS AntiSpyware and it removed 38 problems. When I rebooted into normal mode some things tried to reinstall and they were blocked, but I did still get a pop-up while my settings were still being loaded.

Here's my latest HJT log.

Thanks

chaslang · Mar 29, 2005

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\Program Files\c6b624kl\c6b624kl.exe
C:\WINDOWS\SysCheckBop32.exe
C:\WINDOWS\ms0691820-10643.exe
C:\WINDOWS\System32\irizmk.exe
C:\Program Files\c6b624kl\47692889.exe
C:\PROGRA~1\COMMON~1\kqmu\kqmum.exe
C:\PROGRA~1\COMMON~1\kqmu\kqmua.exe

After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [c6b624kl] C:\Program Files\c6b624kl\c6b624kl.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32
O4 - HKLM\..\Run: [ms0691820-10643] C:\WINDOWS\ms0691820-10643.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\irizmk.exe <--- this one is going to be a problem to remove!!!
O4 - HKCU\..\Run: [aircity] C:\WINDOWS\System32\aircity.exe
O4 - HKCU\..\Run: [kqmu] C:\PROGRA~1\COMMON~1\kqmu\kqmum.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4019/ftp.coupons.com/v3123/cpbrkpie.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/4007/ftp.coupons.com/r3120/cpbrxpie.cab

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\c6b624kl <---- the whole folder
C:\Program Files\Common Files\kqmu <---- the whole folder
C:\WINDOWS\SysCheckBop32.exe
C:\WINDOWS\SysCheckBop32 <--- also see if there are other files with SysCheckBob32 in there names. Even a folder.
C:\WINDOWS\ms0691820-10643.exe
C:\WINDOWS\System32\irizmk.exe
C:\Program Files\Common Files\kqmu

Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

bbklarinette · Mar 29, 2005

Ok. I have not had any pop-ups yet. (Knock on wood.) I did have a few problems with those steps below, though. First, when I ran HJT C:\PROGRA~1\kqmu\kqmum.exe and kqmua.exe were not there to be killed.
They were also not found in the scan. I did, however, find them in Windows Explorer, but it would not let me delete it. It said that the disc could not be accessed. These are what came up to match that search: kqmu (C:\Program Files\Common Files, C:\Windows, C:\Windows\kqmu (DAT file), and 3 Prefetch files.) I also had Prefetch files for 3 other things you told me to delete and I deleted those as well. I also noticed that KavSvc was still on my new HJT log even though it was removed previously.

Here goes.

Misty

chaslang · Mar 29, 2005

bbklarinette said:

I also noticed that KavSvc was still on my new HJT log even though it was removed previously.
Click to expand...

I mentioned that it is going to be a problem. There is no know fix for this yet. Still working on it.

Do you recognize the below item? Is this really something for you modem?
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\NetWaiting.exe

Please download: Generic Detection Tool - NT/2000/XP

Extract all the files from the Generic Detection Tool into its own folder.
Then run find.bat. Post the log it creates back here as an attachment. It takes awhile for this to run so give it time. A notepad file names output.txt should open when finished.

Also download the below tools but only run what I specify. We may be using these to track down this KAVsvc problem.

- ProcessExplorer for Win NT/2K/XP
- Filemon for WinNT/2K/XP
- Regmon for WinNT/2K/XP

1) run ProcessExplorer -
Click View and select Show Lower Pane. And where it says "Lower Pane View" make sure DLL's is checked. Now also under the View menu choose "Select columns" and put a check mark on "Image Path".

Now click on C:\WINDOWS\System32\irizmk.exe. Now click on File and then Save As. And save the process list. Post it back here as an attachment.

From now on, ProcessExplorer to observe what processes are running and to kill them rather than Task Manager or HijackThis's process manager. We will also watch ProcessExplorer to see if we can determine if any other processes run to restart the C:\WINDOWS\System32\irizmk.exe process.

bbklarinette · Mar 30, 2005

My computer is acting much better now. I have not had a pop-up all day. (Still crossing fingers.) Can you tell me what KavSvc is? I am attaching my output.txt.

I downloaded ProcessExplorer and got the following message: "Symbols are not currently configured. You must configure symbols in order to view thread start address and stack information. Install the Microsoft Debugging Tools for Windows Package and configure a symbol server address in the Options/Configure symbols dialog for the best symbol support." Then ProcessExplorer opened and I did what you instructed only there was no irizmk.exe listed. Should I run HJT again to see if it is still there or reboot again and then try ProcessExplorer again?

By the way, I do have a program on my computer called NetWaiting and it came with my computer. I never use it, though. I believe it is supposed to answer your calls or something while you're online but I have DSL and don't need it.

If you have any more info on the KavSvc I would appreciate it. It does not appear to be causing any problems at present, but I also do not want my privacy to be compromised either.

chaslang · Mar 30, 2005

Download and install Microsoft's Debugging Tools for Windows 32-bit Version:
http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.4.7.2.exe

Then try my directions again for ProcessExplorer. That process is definitely there and you should be able to see it.

bbklarinette · Mar 31, 2005

I'm not sure if this attachment will work, but irizmk.exe is still not showing up in ProcessExplorer. I tried to save everything that was on there but I am not sure if it worked.

chaslang · Mar 31, 2005

You should kill the below process and fix any reference to starting it in HijackThis (probably one of the O4 entries):

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rdra.exe

Then boot into safe mode and delete the file.

Now boot into normal mode and run HijackThis and get a new log to post. If the irizmk.exe process shows in HijackThis, leave HJT running and run ProcessExplorer and capture a new process list from it like your laste one. Now post the HJT log and the ProcessExplorer log.

bbklarinette · Mar 31, 2005

Ok. I fixed the rdra.exe and when I booted into safe mode it didn't show up. Then when I booted into normal mode it tried to start and I blocked it with Microsoft Anti-Spyware. It is now showing as a running program in HJT. Also, irizmk.exe is back on HJT but is still not showing on ProcessExplorer.

Another note: When I booted back into normal mode Trojan Remover gave me a message that I had spyware "C:\WINDOWS\System32\dcdarmr.exe" and I needed to run Trojan Remover to get rid of it. Do you know what this is?

bbklarinette · Mar 31, 2005

Ok.. for some reason it is giving me an upload error and won't let me attach my hjt log.

bbklarinette · Mar 31, 2005

FINALLY! Here's the HJT log.

chaslang · Mar 31, 2005

Hmmm! It almost looks like rdra.exe is the real process name for irizmk.exe.

How big are these two files (if you can actually locate them)?

PhilliePhan · Mar 31, 2005

chaslang said:

Hmmm! It almost looks like rdra.exe is the real process name for irizmk.exe.
How big are these two files (if you can actually locate them)?
Click to expand...

Hey Chas,
Looks like this baddie is giving you headaches in a couple threads! Let me know if you need a hand - I've had some success killing this!

PP

chaslang · Mar 31, 2005

PhilliePhan said:

Hey Chas,
Looks like this baddie is giving you headaches in a couple threads! Let me know if you need a hand - I've had some success killing this!

PP
Click to expand...

Sure jump in anytime. I have a few threads going where I believe I have found some related hidden files but the users have not been back yet.

bbklarinette · Mar 31, 2005

I did a search and found irizmk.exe (C:\Windows\Prefetch) 12KB.

When I searched rdra I found rdra.ex$ (C:\Windows\system32) 32KB as an EX$ File.

Also under the rdra search came up "StatusBarDrawItemEvent.class" 1KB CLASS File in Folder com/ms/wfc/ui, and "StatusBarDrawItemEventHandler.class" 1KB in the same folder. Both of those items had dates of 4/1999 on them and I haven't had this computer that long. I don't know if that is related because it would not let me open the file.

chaslang · Mar 31, 2005

Ignore these two:

StatusBarDrawItemEvent.class
StatusBarDrawItemEventHandler.class

it is matching on the rdra in BarDraw.

chaslang · Mar 31, 2005

Please download L2MeFix Tool

Disconnect from the internet and close all browsers and run the below!

Then move the L2MeFix Tool to your Desktop and DoubleClick l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix Folder on your Desktop. DoubleClick l2mfix.bat and Type 1 and ENTER to select Option #1 for Run Find Log . Allow it as much time as it needs to run until NotePad opens with a log.

Now reconnect and come back here and post as attachments the l2mfix log

bbklarinette · Mar 31, 2005

Ok, here it is.

chaslang · Mar 31, 2005

Nothing in that log! I did not really expect it to show anything but wanted to check.

chaslang · Mar 31, 2005

Looks like my fixes in Major Cleanup Headache have worked! We found the hidden files!

I would try the below:

Download Generic Detection Tool - NT/2000/XP

Extract all the files from the Generic Detection Tool into its own folder.
Then run find.bat. Post the log it creates back here as an attachment.

PhilliePhan · Apr 4, 2005

**** Hey Chas, you probably ought to doublecheck that other thread with the scans below! I have to run, but if you find any other hidden baddies, just KillBox them! Look for * ad-behNior.com and * ad-beh!
I imagine you'll be good to go once you see those logs . . . . . But, if you need me to talk you through it, let me know!

Hi bbklarinette,

In addition to what Chaslang has asked of you, please do the following:

1 - Please EXTRACT the attached Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

2 - Please EXTRACT the attached RKFILES Tool to its own folder - C:\Program Files\RKTOOL.
Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.

Then, please give us a fresh HJT log and we will see where you stand. You will need to post twice to attach all three logs.

PP

chaslang · Apr 1, 2005

PhilliePhan said:

**** Hey Chas, you probably ought to doublecheck that other thread with the scans below! I have to run, but if you find any other hidden baddies, just KillBox them! Look for * ad-behNior.com and * ad-beh!
I imagine you'll be good to go once you see those logs . . . . . But, if you need me to talk you through it, let me know!
Click to expand...

Funny! I've been to busy to do any research lately! Between playing here, doing income taxes and real work (14 hr days), my eyes are killing me. Braindrain too!

bbklarinette · Apr 1, 2005

Here is the Find-It log and the Qoologic log.

bbklarinette · Apr 1, 2005

Here is the RKTOOL log and the HJT log. I was unsure if you wanted HJT ran in safe mode so I rebooted and did it in normal mode.

chaslang · Apr 1, 2005

Something does not look right in the Qoologic output to me please do the following.

I want to download the tool from another place and run it. For now we will leave the folder you previously created (C:\Program Files\QoologicFinder ) and we will make a new one.

Download FindQoologic-Narrator.zip to its own folder - C:\Program Files\FindQoologic

Extract (unzip) the files inside the ZIP into the folder. Open the FindQoologic folder. Locate and double-click the Find-Qoologic.bat file to run it. It should produce a log - Please attach that with your next post!

bbklarinette · Apr 1, 2005

I'll add the new file but I don't think it is going to be right either. I keep getting an error message when I start either program that reads, "Cannot find script file "C:\Docume~1\[myname]\Locals~1\Temp\Activesetup.vbs".

chaslang · Apr 1, 2005

Please click Start, Run, and enter cmd and click OK.
Now in the command prompt window enter the below command and tell me what you get for a response.

echo %temp%

bbklarinette · Apr 1, 2005

C:\Docume~1\[myname]\Locals~1\Temp

chaslang · Apr 2, 2005

Look in the folder where you unzipped it to, do you see the below file names:
Activesetup.vbs
AN.EXE
FGREP.COM
Find-Qoologic2.bat
getstarts.exe
XFIND.COM

Also you must not allow MS Antispyware to block the running of the script!

If you get this error message again. Try running the script again a second time immediately.

bbklarinette · Apr 2, 2005

I do have all of the files that you listed. This time I did not get that message either. This time I got a message that read,
"16bit MS-DOS Subsystem
C:\Windows\system32\cmd.exe
C:\Windows\system32\autoexec.nt The system file is not suitable for running MS-DOS and Microsoft Windows application. Choose "Close" to terminate the application."

I tried both clicking ignore and clicking close and either way a message comes up on the DOS screen that says, "The process cannot access the file because it is being used by another process."

chaslang · Apr 2, 2005

Check this out and see if we can fix that problem:

http://support.microsoft.com/default.aspx?scid=kb;en-us;324767

bbklarinette · Apr 3, 2005

As soon as I find my stupid Windows XP cd I will try to fix this. I am sorry for my slowness in responding. I have found every cd for MS Office, etc, but no Windows XP. I think I may have to call DELL and find out which one of these dumb cds they put this on. I'm so frustrated with this whole thing. Don't think I'll be doing any more Google searches after this!

chaslang · Apr 3, 2005

Try looking on your PC for an i386 folder where you can do the same process from rather than from the CD. In some cases you may be able to just copy the files and not even need the expand command as the files may not be compressed in the i386 folder on you PC. The compressed ones end with the underscore. Like config.nt_ , autoexec.nt_ , and command.co_
Whereas uncompressed they will be:
config.nt , autoexec.nt , and command.com

Help with HJT log files -- bad spyware/trojan problem

bbklarinette Private E-2

Attached Files:

bbklarinette Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

bbklarinette Private E-2

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

PhilliePhan Guest

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

PhilliePhan Guest

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bbklarinette Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member