helping a friend with no browser, full of malware

jukes · Mar 31, 2005

A friend online's computer is in such bad shape, he cannot even bring up a browser. (winXP) Sometimes he cant access his email, and about the only thing that works is the Instant Message function. Through great difficulty over the phone I discovered a malware that had not come up on any of the online scans I sent him to do a couple weeks ago, nor in his spybotS&D scan. He kept getting a popup for SearchMiracle, and I looked that up here and found to search for kalv found many instances. Deleting each did little good, they came back.

He tried downloading hijack this from your site, but everything froze up again. I was finally able to send him the hijackthis.exe through the aim window itself, and had him install it, run a scan and painstakingly send me the results four lines at a time.

I wanted to be sick when I saw smss, lsass.exe, winlogon.exe, svchost.exe, and a bunch of other stuff that is over my head. If his scan results are needed, I can clean this up of the distracting screen name every four lines and post as an attachment.

If utilities are required for him, I pray that I can send them through the aim as files as I did with the hijackthis.exe, because he cannot maintain a browser window to click links and download anything. If a tool or utility is needed that cannot be sent through aim, then I would hope I could burn it to CD and mail it or something. This person cannot afford to take the machine to a shop.

Please help? and thank you in advance!

jukes · Apr 1, 2005

unfortunately tonight when I tried to send him the aawsepersonal through the aim (the size is over 2682 kbs) his machine froze at 26% and I dont think he can even go online now.

chaslang · Apr 1, 2005

jukes said:

I wanted to be sick when I saw smss, lsass.exe, winlogon.exe, svchost.exe, and a bunch of other stuff that is over my head. If his scan results are needed, I can clean this up of the distracting screen name every four lines and post as an attachment.
!
Click to expand...

What are you talking about???? Those are all valid processes.

jukes · Apr 1, 2005

chaslang, it's over my head. Something has gummed up the machine.

I've cleaned up the logfile of the screen name and time stamp every four lines and I have it ready to attach.

chaslang · Apr 1, 2005

jukes said:

chaslang, it's over my head. Something has gummed up the machine.

I've cleaned up the logfile of the screen name and time stamp every four lines and I have it ready to attach.
Click to expand...

Okay! This is a rather unusual way to work but since your friend cannot get on line, post the HJT log. I hope it is from version 1.99.1 and is from normal boot mode.

Please attach the log to you message. Do not paste it inline.

jukes · Apr 1, 2005

my most humble appreciation the txt file is attached.

Edit by chaslang: Made HJT log readable

jukes · Apr 1, 2005

in case that one isn't readable

chaslang · Apr 1, 2005

jukes said:

in case that one isn't readable
Click to expand...

No it was not but I edited it to make it readable. We hate Word files. .txt or .log files are much better.

I reattached a readable file to your first message with an attachment.

chaslang · Apr 1, 2005

It would be better if HijackThis were not installed where it is installed but your friend may not be able to handle fixing that right now.
If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe

After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll (file missing)
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [antiware] C:\windows\system32\elitexay32.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O21 - SSODL: mtklef - {739D4042-1866-4EEC-60AC-491596982899} - C:\WINDOWS\System32\wfiutk32.dll (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\EliteSideBar <--- the whole folder
C:\Program Files\WildTangent <--- the whole folder
C:\windows\system32\elitexay32.exe <--- also look for other files beginning with elite and ending in .exe Sometimes there could be upto 10 of them.

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

jukes · Apr 1, 2005

thank you, we'll do as best we can and hope that something can get him a browser. At this point when he phones again, I'll be reading him these directions over the phone. I also hope that his machine didn't freeze up completely when I was trying to send him aawsepersonal through the IM, and that I'd be able to send him the CC cleaner through the aim. Otherwise I guess the next step would be send it on a CD. He has winxp sp2, and I did have him disable system restore, and show the hiddens. He was also able to read the text only email I sent him with the tutorial steps, however with no browser, unable to install the utilities himself.

chaslang · Apr 1, 2005

Make sure he has enable viewing of bot hidden and system files. And also that that he UNCHECKED the option to Hide extension for known file types. Many people forget to do these last two items and that results in messages like "I could not find the file".

jukes · Apr 1, 2005

I sure will, and I'll let you know. I'm concerned that when sending the aawsepersonal, it froze at 26% and then he didn't come back online last night. I need to find out if he'd made emergency boot discs when he first installed Norton. I can only hope so. thank you again

jukes · Apr 3, 2005

ty anyway for your time chaslang, he's not been in touch, but I have all the directions in case he is.

chaslang · Apr 3, 2005

You're welcome! Just let us know what happens when you finally get in touch with him.

Log in or Sign up

helping a friend with no browser, full of malware

jukes Private E-2

jukes Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jukes Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jukes Private E-2

Attached Files:

hjt1.txt

jukes Private E-2

Attached Files:

hijackthisN.doc

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jukes Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jukes Private E-2

jukes Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member