Help???

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by BBINDER, Dec 27, 2004.

  1. BBINDER

    BBINDER Private E-2

    I have some type of new virus (?). i cannot see any processes in task manager. My norton has been disabled,firewall disabled. If i try to go to any type of removal site, i.e. hijacker, it closes my browser page. I cannot even run hijack from a disk. Microsoft has not been any help nor has Norton. In my hosts files, any type of anti-virus or windows update automatically gets the i.p. address changes and doesn't work. I have tried to deleye it and re-save to no avail. Any thoughts would be greatly appreciated. :rolleyes:
     
    BBINDER, Dec 27, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I posted the below in the other thread you posted in:

    There are several types of trojans out there that cause these problems. For example see this.

    http://windowsxp.mvps.org/ToolsQuit.htm

    I have fixed quite a few problems like this our forum.

    As Turcoloco pointed out, you need to run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.
     
    chaslang, Dec 27, 2004
    #2
  3. BBINDER

    BBINDER Private E-2

    I have run everything that i can run from the list. I cannot run hijack this or process explorer. I have run all the latest from symantec and have checked and used evevrything that has been suggested. What next?? :rolleyes:
     
    BBINDER, Dec 28, 2004
    #3
  4. BBINDER

    BBINDER Private E-2

    ready to give up!!!!!

    ok, here's a recap. ran everything that i could that was recommended to run before asking for help.

    1) hosts files always come up with any anti-virus sight disabled. have fixed and resaved numerous times. was able to get to Symantecs sight. no threats found.
    2) cannot run regedit,msconfig nothing happens. Task manager shows nothing visible, but processes running. Hijack this will not run or install from a cd. If i try from a sight it just flashes and doesn't appear. Same happens if i try to run process explorer.
    3) Norton anti-virus will not run,wetherbug will not run,it just flashes, ink monitor on my printer will not run.
    4) i did manager to get AVG, it's running with no errors. Agian all of the programs that have been suggested to download, have been and run accordingly.

    :confused:

    What am i missing????????? i am so frustrated at this point, i'm ready to re-format. :mad:
     
    BBINDER, Dec 28, 2004
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: ready to give up!!!!!

    Do not have more than one antivirus application installed? You implied you have Symantec's? Is it up to date with current definitions? If so, have you run a full system scan from safe mode?

    Try renaming hijackthis.exe to myhjt.com (yes to .com) and see if that runs.

    Have you tried running the items in the section of the READ ME FIRST titles: Alternative Scans - If still having problems
     
    chaslang, Dec 28, 2004
    #5
  6. BBINDER

    BBINDER Private E-2

    i cannot run norton from my computer. I was able to get to there site and run it. I have done evevrything in both the read me and alternate files. I cannot rename hijack this, it still doesn't run. if i try to unzip it, it just flashes and closes. I have run AVG in safe mode no infections found, ad-aware is ok. norton,spybot and windows updates were all up to date as of the 20th when this happened. regit will not run,the only way i can get there is with registry command, which i got from this site.
     
    BBINDER, Dec 28, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What do yo mean you cannot rename hijack?
    When you say " if i try to unzip it, it just flashes and closes." do you mean you cannot extract it from the ZIP file?

    If that is the case, then you should not be saying you cannot run HijackThis, you should be saying you could not unzip it. What are you using to UNZIP files?

    Try WinZip

    What registry command are you talking about?
     
    chaslang, Dec 28, 2004
    #7
  8. BBINDER

    BBINDER Private E-2

    ok, i can rename it but it will not run. i do use winzip. wheni try to unzip it winzip "flashes" and goes away. Message inbound to you.
     
    BBINDER, Dec 28, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I'm still confused. If Winzip does not work, how did you extract the hijackthis.exe file in the first place.
     
    chaslang, Dec 28, 2004
    #9
  10. BBINDER

    BBINDER Private E-2

    i used another computer to download hijackthis to a disk. Winzip works fine on everything except for this program. I have:

    moved hijack this to my c drive. both in zipped and unzipped form. it will not let me run it from the cd, from the file on my computer,renamed or otherwise,it will not let me unzip it. it is as if this "virus" knows what i am doing and stops me from doing it. Just like not letting me send emails to symantec and constantly re-infecting my hosts file after i fix it.
     
    BBINDER, Dec 28, 2004
    #10
  11. BBINDER

    BBINDER Private E-2

    i tried something and finally got hjt to run.


    Edit by chaslang: Inline log deleted

    I hope this helps......
     
    Last edited by a moderator: Dec 28, 2004
    BBINDER, Dec 28, 2004
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! But you did not follow directions about posting HJT logs. They must be an attachment to your message and you must exit all browsers before running HJT. You had:
    C:\Program Files\Internet Explorer\iexplore.exe

    Also, it is now probably time to rename myhjt.com.exe back to the proper file name.
    Change this: C:\Program Files\myhjt.com\myhjt.com.exe
    So it reads: C:\Program Files\HJT\hijackthis.exe

    And you did not name it as I wanted it anyway. I said myhjt.com not myhjt.com.exe
     
    chaslang, Dec 28, 2004
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You still have components from Norton Antivirus and you are running AVG. You must only run one antivirus application. Finish the uninstall of the other Norton components. Or uninstall AVG and reinstall Norton because some it it appears to be missing.

    Goto Add/Remove programs and uninstall WeatherBug!

    My normal procedures usually include deletion of bad files at the end of HJT fixing, but I'm going to hold off on deleting some files until I'm suse you don't need them.


    Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
    C:\WINDOWS\system32\svcxnw32.exe
    C:\WINDOWS\twain_32\B6U12KF\WATCH.exe

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    O1 - Hosts: 127.90.165.62 www.symantec.com
    O1 - Hosts: 127.116.226.42 securityresponse.symantec.com
    O1 - Hosts: 127.66.92.252 symantec.com
    O1 - Hosts: 127.94.133.174 www.mcafee.com
    O1 - Hosts: 127.39.136.166 mcafee.com
    O1 - Hosts: 127.3.104.43 us.mcafee.com
    O1 - Hosts: 127.89.239.173 www.sophos.com
    O1 - Hosts: 127.117.4.193 sophos.com
    O1 - Hosts: 127.251.23.96 www.viruslist.com
    O1 - Hosts: 127.101.100.227 viruslist.com
    O1 - Hosts: 127.108.165.71 f-secure.com
    O1 - Hosts: 127.167.202.162 www.f-secure.com
    O1 - Hosts: 127.21.59.5 kaspersky.com
    O1 - Hosts: 127.30.229.199 www.avp.com
    O1 - Hosts: 127.205.138.43 www.kaspersky.com
    O1 - Hosts: 127.13.135.17 avp.com
    O1 - Hosts: 127.97.73.180 www.networkassociates.com
    O1 - Hosts: 127.56.33.63 networkassociates.com
    O1 - Hosts: 127.217.78.46 www.ca.com
    O1 - Hosts: 127.95.102.166 ca.com
    O1 - Hosts: 127.137.3.186 my-etrust.com
    O1 - Hosts: 127.252.231.130 www.my-etrust.com
    O1 - Hosts: 127.37.229.100 secure.nai.com
    O1 - Hosts: 127.72.145.76 nai.com
    O1 - Hosts: 127.61.213.133 www.nai.com
    O1 - Hosts: 127.239.68.176 trendmicro.com
    O1 - Hosts: 127.239.96.45 www.trendmicro.com
    O1 - Hosts: 127.5.3.0 housecall.trendmicro.com
    O1 - Hosts: 127.190.77.202 www.pandasoftware.com
    O1 - Hosts: 127.15.115.49 www.bitdefender.com
    O1 - Hosts: 127.195.10.129 www.ravantivirus.com
    O1 - Hosts: 127.68.149.202 www3.ca.com
    O1 - Hosts: 127.176.218.245 v4.windowsupdate.microsoft.com
    O1 - Hosts: 127.78.10.76 v5.windowsupdate.microsoft.com
    O1 - Hosts: 127.107.198.120 v5windowsupdate.microsoft.nsatc.net
    O1 - Hosts: 127.58.67.250 windowsupdate.microsoft.com
    O1 - Hosts: 127.33.200.209 www.windowsupdate.com
    O1 - Hosts: 127.79.98.10 windowsupdate.com
    O4 - HKLM\..\Run: [IPConfig] svcxnw32.exe
    O4 - HKLM\..\Run: [mswnvmx32] winclk4.exe init
    O4 - HKLM\..\Run: [DLLStat] vxdload16.exe -services
    O4 - HKLM\..\RunServices: [DLLStat] vxdload16.exe -services
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
    O4 - HKCU\..\Run: [IPConfig] svcxnw32.exe
    O4 - HKCU\..\Run: [DLLStat] vxdload16.exe -drivers
    O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\B6U12KF\WATCH.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
    O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://210.80.76.119/object/Dldrv.ocx
    O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/mini...ransporter.cab?

    After clicking FIX, exit HJT.

    Boot into safe mode and use Windows Explorer to delete:
    c:\windows\system32\svcxnw32.exe
    c:\windows\system32\winclk4.exe
    C:\Program Files\AWS <--- the whole folder if still there
    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
    chaslang, Dec 28, 2004
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds