I followed the guides and this is what i have left(hijack log inside)

metalmilitia · Apr 12, 2006

I followed the guides pretty closely and went into safe mode and ran all the spyware programs and the virus scans but the virus scans couldnt remove it all. So this is what I have left. Can you please tell me what I need to do here.

chaslang · Apr 13, 2006

Welcome to Majorgeeks!

Please complete step 6 of the READ ME. You skipped PandaActiveScan. You must run Panda and attach the requested log.

Also please follow the directions in step 7 exactly and install HijackThis correctly as requested. Also as indicated in step 7, HijackThis logs must be posted from normal boot mode.

Then read the Special Removal Procedures link that was given in the READ ME and run the Look2Me VX2 Removal procedure and attach the requested log.

Now attach a new (properly installed) HJT log and let me know how things are working.

metalmilitia · Apr 13, 2006

I couldn't get panda scan to work for some reason, it just wouldn't work. So i did trendmicro anti virus scan instead. I'll try the panda scan in normal mode but it wouldn't work for sure in safe mode w/networking i tried and then i rebooted and tried again and still no.

metalmilitia · Apr 13, 2006

ok here's a my panda scan log file and a new hijack this, i see what you mean i had it installed under my documents so i reinstalled it.

chaslang · Apr 13, 2006

metalmilitia said:

i see what you mean i had it installed under my documents so i reinstalled it.
Click to expand...

Where is the log from Look2Me-Destroyer?

You still did not install HijackThis in the recommended folder. While this is not always 100% necessary, it will prevent some of our canned procedures and other tools from working properly since they will not be able to find HijackThis.exe. It is highly recommended (even by the developer) to install it as requested.

metalmilitia · Apr 14, 2006

OK i reinstalled HJT to the exact location you wanted it and i did run the Look2MeDestroyer program twice and it didn't save any log into the C:/ dir and it didn't give me any option that i could see to save a log. It also didn't appear to find any Look2Me infections on my computer, it would list them in the window if it found it right? Well it didn't list anything, but i hit remove anyways and it did it's thing and restarted my computer.
My antivirus is picking up something called win32/Canbede with 4 instances of it and one other virus called win32/SillyDI.AHO

chaslang · Apr 14, 2006

metalmilitia said:

and i did run the Look2MeDestroyer program twice and it didn't save any log into the C:/ dir and it
Click to expand...

It automatically creates this file --->>> C:\Look2Me-Destroyer.txt

I have run it at least 50 to 100 times and it has always been created. If it has not been created then the procedure did not complete or something else went wrong (maybe a new form of infection - but this would be the first time).

Are your copies of CounterSpy and Ewido paid versions or are the free trial versions? How long ago were they installed?

I highly recommend against using ALL these online poker and casino games. You should uninstall them using Add/Remove programs and fix any remaining lines in your HJT log. But this is your decision if you are will to live with the malware problems they may give you.
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Program Files\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Program Files\Titan Poker\casino.exe
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe
O9 - Extra button: Aztec Riches Poker - {7FCF69CA-B1D5-4b13-A6B0-31020DD5A976} - C:\Program Files\aztecrichesMPP\MPPoker.exe
O9 - Extra button: River Belle Poker - {83F8B625-1B04-4c35-8BA1-6DB4D7EDBADF} - C:\Program Files\riverbelleMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Absolute Poker - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing)
O9 - Extra button: POKER - {FB389F33-303A-4490-9E18-B301A493FBF2} - C:\Program Files\PokermMPP\MPPoker.exe
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\poker.exe (HKCU)
O16 - DPF: {012F24D4-35B0-11D0-BF2D-0000E8D0D156} (InstallControl Class) - http://activex.casinosupportservice.com/Version3.0/InstallHelper.cab

Make sure viewing of hidden files is enabled (per the tutorial).
Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://142.36.244.87:8888/kxhcm10.ocx
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O20 - Winlogon Notify: Media Center - C:\WINDOWS\system32\k626lgfs1626.dll (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\newname.dat
C:\Documents and Settings\Jason\Local Settings\Temporary Internet Files\Content.IE5\WPQF4LQ7\AppWrap[1].exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.

Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

metalmilitia · Apr 14, 2006

Hi, first off let me thank you for all the time you are taking to help me fix this!

OK so I double checked for the Look2MeDestroyer log and there is none, i even did a search of my entire computer for it and no results.

Counter Spy and Eweido are both trial versions that I downloaded 3 days ago after my computer was infected.

I removed the things you told me to in HJT besides the poker things because I do play a lot of online poker and they don't cause any major issues to my computer. I did notice that the R1 thing came back in my next HJT this log after reboot, new log is posted below.

deleted all cookies and files etc and rebooted and i haven't had any popups yet(i turned off eweido and counterspy and disabled AV to make sure they weren't blocking any). So I think i'm pretty close to being disinfected however I still notice my computer takes longer to reboot now and it takes longer for certain programs open than it used to.

chaslang · Apr 14, 2006

metalmilitia said:

however I still notice my computer takes longer to reboot now and it takes longer for certain programs open than it used to.
Click to expand...

Everytime you load programs like Ewido, CounterSpy and any similar full blocking programs (this also includes antivirus and firewall applications) there will be a noticeable hit in boot time and in possible overall performance. It is a necessary sacrifice of performance for security.

Since Ewido and CounterSpy are only trials, you should uninstall them since they will expire any way in about 10 days. Only one such program like this should be installed anyway. If you are not going to buy one, the free alternative is Microsoft Windows Defender.

You could get some help in improving boot time and other overall improvement in performance by not loading the below at startup. They are not necessary and some are resource hogs. You can just have HijackThis fix those lines.

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Are you having any other malware issues? If not, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

I followed the guides and this is what i have left(hijack log inside)

metalmilitia Private E-2

Attached Files:

bdos.txt

hijackthis2.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

metalmilitia Private E-2

metalmilitia Private E-2

Attached Files:

Activescan.txt

hijackthis.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

metalmilitia Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

metalmilitia Private E-2

Attached Files:

hijackthis4.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member