I did the "do this first" and...

First issue was that it said to run the scans in regular and safe mode, but while in safe mode, i could not access the scans because they run on Internet Explorer. After completing everything else and rebooting in regular mode, my computer is now getting stuck constantly. It took 25 minutes to log in and load my desktop and takes about 5 minutes to open anything. when I DO get things open, they tend to freeze after a few minutes. I don't know where to go from here.

 

I am really starting to freak out and wonder if something that shouldn't have been deleted was? I can boot under safe mode still but when I am in regular mode, the whole thing freezes. I followed every instruction, I ran 3 of IE based scans, all of the downloads recommended (Spybot and the like), fixed what was recommended, etc and now I can't do ANYTHING. I am writing this (and my previous post) from my roommate's computer.

For the record, I have had Winfixer popping up, plus frequent slowing and freezing of programs which is what promted me to do all this. One of the IE based scans found winfixer, but I am not sure if the removal was successful since after using safe mode and rebooting into regular, I haven't been able to do anything on my computer. Please help!

 

Can you download some items and move them to your computer?

 

I can download to a disk, but don't know if I will be able to get them onto my computer, the way it's going. It's worth a try. What would you like me to download?

 

Download the following utilities on a disk and transfer them to your computer. If you have to you can do this in Safe Mode. Make sure you have System Restore disabled.

Hijack This 1.99.1

Ad-Aware SE
Ad-aware SE referencefile SE1R71 19.10.2005

Spybot S&D
Spybot Search and Destroy Detection Update 10\21\05

Ewido Security Suite
Ewido-signatures-full-10-22-05

TrendMicro System Cleaner
Sysclean Package
Pattern.zip

After you have downloaded each program and update, save them to individual folders to make it easier. After you have completed everything above, please see the thread below to get me a HJT log.

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

 

I'm about to throw the thing out the window and have to get up early for my son's soccer game so I'm going to do this in the morning when hopefully I'll be less frustrated...I've been working on this for 9 hours today. Do you want me to run them after they are downloaded and saved or just get that done and then run the HJT?

 

Here's my hijack log

 

Oh hell, it doesn't seem to open. What do I need to do differently? Argh.

 

Now that I have confirmed your infections I want you to go ahead and run a full scan with Ewido. Follow the steps below to do this...

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

After you complete the above scan with Ewido please follow the below...

Locate the 2 files you download for the TrendMicro System Cleaner, make sure both files are in the same folder, right click and extract the contents of the Pattern.zip file into the same folder,REBOOT INTO SAFE MODE!

Once in Safe Mode double click the file sysclean.com. When the system cleaner loads, click SCAN to start the scanner. After you complete the scan reboot and attach a fresh HJT log.

 

Will do. It may take awhile to get the new HJT log up, as it is now taking about an hour to boot in normal mode.

 

Do all of the scans in Safe Mode and if possible the fresh HJT log from normal mode, if you have problems just get it from Safe Mode as well.

 

I did everything, but cleansystem came up with a bunch of files that it said it couldn't access. Things are now worse than ever. I can log in under regular mode if I wait an hour for it to load, but then everything freezes. I ran a new HJT scan, but it froze. I tried to get online, it pulled up the page but then froze. Over and over. I am going to reboot again, but I don't expect much different and it will still take an hour at least to boot up. What the heck is going on? What virus did you see in my HJT log? Why is it that before I did all this, I was running a little slow and had a WinFixer pop up constantly, occassionally froze, but at least I could use my computer...but now that I've done what I was supposed to to fix it, it is shot to hell? Is there any hope? I am about to break down. My dad passed away 2 months ago and there are pictures of him on my computer that only exist there. I can't get the damn thing to save them to a disk. I don't care if I lose everything else on my computer, but I don't want to lose those pictures. Any ideas? Suggestions? Light at the end of the tunnell?

 

Okay, go into Safe Mode. Once in Safe Mode complete the below:

Click Start > Run > type in msconfig

When the System Configuration Utility loads click on the box next to "Selective Startup" and uncheck the box "Load Startup Items". Afterwards click OK and yes to reboot.

Doing the above will kill the startup entries and should allow you to work somewhat better in normal mode. You must be patient and not give up, we specialize in the removal of these pest. We WILL clean your system, it will take some time and work. As long as you follow my post carefully you will sucessfully remove everything.

After doing the above, try to get me an updated HJT log from either mode.

 

Ok, wow. It took 10 minutes to load each page. This is nuts. I got the HJT done and I'll try to attach the log. I am losing my mind. lol

 

If you can run this fix in normal mode then please do so, if you can't then run it in Safe Mode!

Download Pocket KillBox
(Don't run it yet)

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo. com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\System32\ddaby.dll
O2 - BHO: (no name) - {7A1693A1-AFAF-4F1E-9B05-EEC38A85FBF3} - C:\WINDOWS\system32\3ac.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\RunOnce: [jmcrq03.exe] C:\WINDOWS\System32\jmcrq03.exe /k
O4 - HKCU\..\RunOnce: [jmcrq03.exe] C:\WINDOWS\System32\jmcrq03.exe /k

O8 - Extra context menu item: iGive - file://C:\Program Files\iGiveShoppingWindow\System\Temp\igive_script2.htm

O9 - Extra button: iGive - {987D0E71-6CAD-11d5-AA37-0001028DF1BC} - file://C:\Program Files\iGiveShoppingWindow\System\Temp\igive_script2.htm (file missing) (HKCU)

O20 - Winlogon Notify: ddaby - C:\WINDOWS\System32\ddaby.dll

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

C:\WINDOWS\System32\ddaby.dll
C:\WINDOWS\System32\3ac.dll
C:\WINDOWS\System32\jmcrq03.exe

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, reboot and attach a fresh HJT log.

 

Ok, I did it all and am now waiting for my computer to boot in normal so I can run the HJT and attach it. It is still going just as slow. All these scans seem to be doing well, AdAware and Spybot didn't even find anything this time. But still the computer won't boot in less than an hour and then runs at the speed of molassess. Any ideas why? Did something vital possibly get deleted? I'll post the HJT log at some point tonight if the darn thing ever starts running.

 

Here's the log, hopefully it works. I had to save it to a disk and load it here on my roomie's computer. My computer seems to be running marginally faster than earlier today, but the internet still won't work. Also, the ddaby.dll is still showing on my HJT and I KNOW I followed your instructions. It must be stubborn.

 

We're getting there!

Your HJT log is clean, now all thats left is cleaning up junk files and the Vundo infection! Please follow the below...

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning.
  It should look like this

• At this point press enter one time.
  
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\System32\ddaby.dll​

• Press Enter to continue with the fix.
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\ybadd.*​

• Press Enter to continue with the fix.
• The fix will run then HijackThis will open, if it does not open automatically please open it manually.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\System32\ddaby.dll
O20 - Winlogon Notify: ddaby - C:\WINDOWS\System32\ddaby.dll ​

• After you have fixed these items, close Hijackthis.
• Press enter to exit the program then manually reboot your computer.

Once your machine reboots please attach a fresh HJT log from normal mode.

 

Oh wow. It booted right up into normal mode after that! Yea!!! I ran a HJT log in safe mode after all the vundofix stuff. It didn't find the O2-BHO entry on that scan, but did find the O20 -Winlogon. When I rebooted into normal mode and ran the scan, I got both of them on the log, did the fix again. Ran another scan, they were gone. But I haven't rebooted again. Might they come back again? Here's the log. After all of this, what do I need to do to fix my startups and do I need to turn System Restore ON? I am afraid to turn off my computer now or reboot because I am just so glad it's running!

 

Your HJT log is clean, however two problems still remain that you need to address.

1. You have two antivirus programs installed, this is NOT recommended as they will cause conflicts. Pick ONE and uninstall the other!
2. The second thing is your OS is out dated, you need to update to Windows XP Service Pack 2 for security purposes.

Before you do ANY of the above, please follow the below instructions very closely!

Click Start > Run > type in msconfig and press ENTER.

On the General Tab select "Normal Startup" and click OK, but DO NOT REBOOT!!

After you complete the above, attach a fresh HJT log so we can cleanup any leftovers.

After you do this, please do NOT reboot as it probably will try and load some things that will slow you down!

 

I deleted and uninstalled several things I don't use, and should only have AVG running now for antivirus, let me know if you see something else...in case you haven't noticed, I am not very computer savvy. lol I did the msconfig thing and here's the new HJT log.

 

Shoot, sorry, the update wasn't done yet when I did that scan and I had a browser open. Here's a new one. One more question for whenever: what is a good pop-up blocker to put on my computer? I am afraid to download anything, but if you can recommend one that would be fabulous!

 

bump

Still need to know what to do so that I can feel safe turning off the computer and/or rebooting.

 

I apologize for the delay, I have been extremely busy this week at work. To finish the cleaning on your pc, please follow the below...


Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

O4 - HKLM\..\Run: [oyanejlqj] C:\WINDOWS\System32\hueeqq.exe
O4 - HKCU\..\Run: [mshtmled] C:\WINDOWS\System32\mshtmled.exe
O4 - Startup: AutoTBar.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\System32\hueeqq.exe

C:\WINDOWS\System32\mshtmled.exe

NEXT:
Run CCleaner to clean up cookies and temp files.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.

 

I appreciate your help SO MUCH! Here's a new log.

 

Your HJT log is clean, I still would like two more scans to confirm your clean, so please run the below...

Panda Online Scan.

After you complete the above scan, save the log and attach it to your next post along with the log from the next scan.

Download the following utility:

TrendMicro Spyware Cleaner

1. Click the above to download utility
2. Select Run
3. Click Scan to begin spyware detection, and follow prompts.

Note: To use this tool, you must agree to the terms of the end user license agreement. Your computer may also display a warning that the tool is attempting to run. Click Yes to proceed.

After the scan completes, reboot and run CCleaner once more and attach both logs and let me know how things are running.