Hijacked Desktop Background and Internet Access

Discussion in 'Malware Help (A Specialist Will Reply)' started by jaweibel, Aug 27, 2008.

  1. jaweibel

    jaweibel Private E-2

    Hi, I'm actually not new to the forum and this will be the second time I have had to run the READ & RUN ME FIRST malware removal guide due to a hostile PC takeover. Previously it was due to flec006 and now I have no idea.

    First, a description of the problems I am experiencing....

    My desktop background currently shows a message warning that I have been infected with spyware and should install a program to solve this problem. Also, every time I restart my computer I am presented with a message to download and install "Antivirus XP 2008" from a company called Pandora Software. The name of this process in the task manager is ".tt5BP.tmp.exe". I also have a screensaver that comes up with the blue screen of death and fakes restarting windows. I have found hitting escape will get me out of this screen saver.

    My internet access is limited as certain sites (such as majorgeeks.com) are being blocked. Also, originally I was having the problem where none of my usb drive or cd drives would be recognized and I could not enable the broadband connection from the network connections menu. Since running some of the read and run me first software and restarting my PC I can now use the USB and internet (but still with limited access).

    My original course of action was to run malwarebytes and super anti spyware on my own before I knew the severity of the problem. These logs are attached with the logs from running a second time according to the read and run me first in addition to the MGtools.zip file. I could not run spybot because presumably my internet connection was preventing me from downloading the program through the .exe file. I have had the same problems while trying to download the necessary files to run combofix. I am typing this message on a separate computer that allows access to the internet.

    If you could please review the log files and recommend future actions to be taken. I have avenger already installed on my PC from a previous time when I had a flec006 problem.
     

    Attached Files:

    jaweibel, Aug 27, 2008
    #1
  2. jaweibel

    jaweibel Private E-2

    MGtools.zip file attached
     

    Attached Files:

    jaweibel, Aug 27, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    First, what is this:
    C:\Documents and Settings\Justin\Desktop\jtk374en

    Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now use windows explorer to find and delete:
    C:\WINDOWS\system32\lphcvq1j0ecf9.exe
    C:\Documents and Settings\Justin\Local Settings\Temp\.tt5BD.tmp.exe

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

    Be sure to tell me how things are running.
     
    TimW, Aug 28, 2008
    #3
  4. jaweibel

    jaweibel Private E-2

    I'll complete this when I leave work and get back to my home PC.

    I wanted to post and just answer the first question you had. That process is a program called Joy to Key that maps keyboard functions to external joypad buttons. I don't think it is the cause of any of the new current problems as I have had it on my PC for about a year.
     
    jaweibel, Aug 28, 2008
    #4
  5. jaweibel

    jaweibel Private E-2

    attaching the MGlogs.zip file after performing these steps.

    I no longer have the problem of a pop up in windows asking me to download the Windows XP Antivirus.

    I am still having two of the original problems including

    1) Background changed to "Warning! Spyware detected on your computer!" without the window in the desktop property menu that would allow me to change the background

    2) Some websites that are intended to fix malware problems (including majorgeeks.com) will not load or re-direct me to other ad sites.

    Additionally, I noticed when deleting the .exe file from the localsettings/temp folder there are additional .tt temp and script files. Should I delete them as well?
     

    Attached Files:

    jaweibel, Aug 28, 2008
    #5
  6. jaweibel

    jaweibel Private E-2

    now in addition to certain site being blocked it looks like any google search result links take me to random ad websites
     
    jaweibel, Aug 28, 2008
    #6
  7. jaweibel

    jaweibel Private E-2

    I have done some searching on my own and believe this may be a go.google spywareware problem in addition to the previous problem. Things are clearly not correct as recently I got a web browser popup that brought up a download location for mor antivirus 2008 software
     
    jaweibel, Aug 28, 2008
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just wanted to know what it was. :)

    Your logs are clean.....however, do this:

    Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

    * Double-click ATF-Cleaner.exe to run the program.
    * Under Main choose: Select All
    * Click the Empty Selected button.

    If you use Firefox browser

    * Click Firefox at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    * Click Opera at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main ATF Cleaner menu to close the program.

    Now re-run both SAS and MWB's and attach the logs.
     
    TimW, Aug 29, 2008
    #8
  9. jaweibel

    jaweibel Private E-2

    It appears that the newest update versions of these two program versions found a bunch of the new problems I was having and I think that everything is cleared up at this point. I have posted the logs again. Let me know if there are any more final cleanup steps to be taken and if I should post an mglogs.zip file with these newly corrected problems.
     

    Attached Files:

    jaweibel, Aug 30, 2008
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes.....attach a new MGLogs.zip ......:(
     
    TimW, Aug 30, 2008
    #10
  11. jaweibel

    jaweibel Private E-2

    here is the log
     

    Attached Files:

    jaweibel, Aug 31, 2008
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You ducked the bullet again ...:)

    Those logs are clean....so I would suggest that you run SAS and MWB's on a regular basis, depending on your surfing habits.

    If you are not having any other malware problems, it is time to do our final steps:
     
    TimW, Aug 31, 2008
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds