Laptop Hijacked

I want you give you an important heads up so that you can tell your friend. This is very important if the PC was being used for anything financial related (internet banking, purchasing online, credit card stuff etc).

Start by Uninstalling the below software from Add/Remove Programs:
J2SE Runtime Environment 5.0 Update 6
Search Assist
Viewpoint Media Player

Now install the current version of Sun Java from: Sun Java Runtime Environment

Now continuing by downloading a tool we will need- Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.

Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.

C:\Documents and Settings\Paul Chatham\Yinstall.exe
C:\dfndrff_e24.exe
C:\kybrdff_e23.exe
C:\nwnmff_e24.exe
After killing all the above processes, click Back.
Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Paul Chatham\Yinstall.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e24.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e23.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e24.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\\Program Files\\Common Files\\{CC134C90-063B-1033-0609-06002c}\\Update.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll
C:\Documents and Settings\Paul Chatham\Yinstall.exe
C:\dfndrff_e24.exe
C:\kybrdff_e23.exe
C:\nwnmff_e24.exe
C:\otwlkons.exe
C:\ovvpecjh.exe
C:\pmmbhym.exe
C:\teqnsq.exe
C:\nwnmff_e23.exe_tobedeleted
C:\WINDOWS\system32\drsmartload1135a.exe
C:\WINDOWS\system32\loadadv455.exe
C:\WINDOWS\system32\Yinstall.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folders and delete them if found:
C:\Documents and Settings\All Users\Application Data\McAfee
C:\Documents and Settings\All Users\Application Data\McAfee.com
C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\McAfee
C:\Program Files\McAfeeSearchAssist
C:\Program Files\Common Files\{3C134C90-063B-1033-0609-06002c}
C:\Program Files\Common Files\{3C134C90-063C-1033-0609-06002c}
C:\Program Files\Common Files\{CC134C90-063B-1033-0609-06002c}
C:\Program Files\Common Files\{CC134C90-063C-1033-0609-06002c}
C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033

Also delete all files in the below folder except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Paul Chatham\Local Settings\Temp

Now attach a the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!
Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
3. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and enable System Restore to create a new clean Restore Point.
4. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Goto Add/Remove programs and uninstall the below (let me know if they uninstall properly):
DeluxeCommunications
Java 2 Runtime Environment, SE v1.4.2_03
Search Bar

You need to install and run ShowNew and GetRunKey properly as instructed in the download links and then attach new logs! You are not running them properly!

You also did not follow directions in the READ ME completely. The copy of Spybot you are using has not been used in about two years. Uninstall it and install the proper version.

 

Okay we will come back to these later!

Also will be addressed later.

Did you read the information on the download page for both GetRunKey and ShowNew?? Please read it and follow the directions.

 

Let's see if we can get started fixing some malware based on what info we have thus far.

Start by downloading a tool we will need- Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [1pop06apelt2] C:\WINDOWS\elitepop06.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mmohsix.com
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.elitemediagroup.net/cabs/eliteview.cab
O20 - AppInit_DLLs: dxclib303562752.dll

NOTE: HJT will popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\Downloaded Program Files\CONFLICT.10\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.11\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.8\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.9\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\speedtest2.dll
C:\WINDOWS\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\system32\ObjSafe.tlb
C:\WINDOWS\elitepop06.exe
C:\Program Files\DeluxeCommunications\Dxc.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.
After reboot locate the below folder and delete it if found:
C:\Program Files\DeluxeCommunications

Now attach a the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Print or save the below instructions locally because you will need to close all browser windows to continue.

Close all browser windows (Including the one you are reading this in)

Goto Add/Remove Programs in Control Panel

Find DeluxeCommunications in the list and double click on it to invoke the uninstaller.


If there is no Add or Remove Programs entry for this program, Goto Start-->Run, type in C:\Program Files\DeluxeCommunications\Dxc.exe /u and hit enter.


The DeluxeCommunications uninstall program will load and you will ask you to enter a security code. Do as instructed and enter the security code it displays and click ok.

The uninstaller will then Display a dialog saying that all browser windows will be closed if you continue. Click Yes to continue.

Finally, It will display a dialog asking you if you want to reboot. Click Yes and let your computer boot.

Boot into Normal Mode

Download the FixDC.zip attached to this post and save it on your desktop.

Extract the contents of FixDC.zip to your desktop.

Run FixDC.reg from your desktop by double clicking on it and click yes to allow it to merge with the registry.

Now to cleanup some remaining files.

Click Start and select Search
Now Select All files and folders
Enter the Dxcknwrd.dll in the "All or part of the file name:" box
Now select "More advanced options"
Make sure the following check boxes are checked:

• Search system folders
• Search hidden files and folders
• Search subfolders

Then click the Search button.

If the search finds the file then Delete it by right clicking on them and selecting Delete

Repeat the same search and delete procedure for Dxccwrd.dll instead of Dxcknwrd.dll

Now attach new logs from ShowNew and HJT.

How are things working now?

 

Please download the attached ShowNDC.zip file. Extract the ShowNDC.bat file from it into the same folder where you have previously extracted ShowNew.bat. Then run the ShowNDC.bat file and attach the log from it. The log is still named newfiles.txt.

This one should give me some additional information that I need! Besides the DeluxeCommunications issue you have a bunch of other malware that may be making removal more difficult that normal.

 

In message # 15 I asked you to fix the below line. I still see it in your log!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac

Did you forget to fix it? Or is it something you need and therefore skipped it? You did not have this setting on your other PC!


Run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Documents and Settings\Campbell Chatham\Application Data\
C:\Documents and Settings\Campbell Chatham\Application Data\dxccwrd.dll
C:\Documents and Settings\Campbell Chatham\Application Data\Dxcdmns.dll
C:\Documents and Settings\Campbell Chatham\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Campbell Chatham\Application Data\Dxcuknwrd.dll
C:\Program Files\em\dohancer\webinstaller.exe
C:\Program Files\em\dohancer\whCC-GIANT3.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folders and delete them if found:C:\Program Files\em

Now attach a the below new logs and tell me how the above steps went.

1. ShowNew
2. HJT

Make sure you tell me how things are working now! If Spybot is still finding something that it cannot remove, attach a log from Spybot.

 

Please download and install Registrar Lite Make sure you select a Majorgeeks download link and not the Authors!

Run Registrar Lite navigate to the following key and take ownership of it (I explained how to do that further down).

HKEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar


To take ownership of the key do the following:

• Copy & Paste the registry key from above into the Address bar of Registrar Lite and hit the enter key. This will bring you to the registry key.
• Click-on Security in the top Menu
• Select Take Ownership
• Now leave RegistrarLite running and continue
• Now run the fixME.reg REGISTRY PATCH below in this message.
• Tell me the results. Any error messages?
• Now in RegistrarLite click View and then Refresh
• Now navigate back to the above key we took ownership of to make sure that the YourSiteBar key has been deleted.
• If the key still exists, right click on it and select Delete. Let me know if you have to do this and if you get any error messages at this point.

Here is the Registry Patch

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Then reboot your PC!

Now run Spybot and see if it still detects YourSiteBar.

Now let's do some cleaning!

• Now run Pocket Killbox and select File, Cleanup, Delete All Backups
• go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
• Then reboot and enable System Restore to create a new clean Restore Point.

Now attach a new log from ShowNew (not ShowNDC). Tell me how things are working now.

 

You can delete the file yourself manually but make sure all browsers are closed. Also doing a Reset of Web Settings on all user accounts should normally cleanup stuff like this. If you don't know how to Reset Web Settings, here's how:

Remaining problem from previous steps:

One of the files I asked you to delete (back in message # 15) with Pocket Killbox, is still there. You need to delete this using Pocket Killbox. You will not be able to locate it or delete it from Windows Explorer or Windows Search so make sure you use Killbox as given in message # 15 and delete the below file:
C:\WINDOWS\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe


Yes you should work on other user accounts but only one at a time. How many are there? Pickone and post the below 3 logs while logged into that user account:
- GetRunKey
- ShowNew
- HJT

 

Why do you say that? You don't really have any major problems remaining.

This is just due to the sites you or someone else is accessing. I doubt this is a serious problem anyway. You could look at the file in an editor to see what is in it. As you saw already, it is easy enough to remove. Real malware is alot more difficult.

Actual the Username that you posted logs for is Neil but the UserProfile being used is still Neil.CHATHAMRACING. That's because you did not delete the account. You just renamed it which does not remove the user profile information. You could rename the user account name to anything you want but the user profile would still remain. To truly get rid of the account, you must delete the account. I would then reboot and after reboot delete anything that may remain for that account.

You cannot use Reset Web Settings in an account that does not have administrator priviledges. The easiest way around that is to change the account to be an admin account while you work on it and then change it back to a restricted account afterwards.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\Downloaded Program Files\axo.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.12\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

I'm not sure what you are referring too. I did not ask you to delete any files here.

 

The only account that has anything additional to cleanup is the one associated with the "T" logs (the account named Champ). Log into this account and do the below:


Copy the bold text below to notepad. Save it as fixWLK.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Then use Pocket Killbox to delete the below file:
C:\WINDOWS\Downloaded Program Files\motorsix.ocx


Other than that your logs were clean. How is everything working?

 

But you did not say exactly what and where. You need to give the exact name of the file and the full path to it. You may be able to just use Killbox on it.

 

Has "Champ" (whoever uses that account) been doing any surfing while you are not working on fixing the PC? If so, perhaps you need to find out what sites are being accessed. You could look in the Internet Explorer History.

Do you know if Internet Explorer Default Page which shows in your installed programs list is part of Tiscali? It seems suspicious!


Now Copy the bold text below to notepad. Save it as fixWLK.reg to your desktop (Yes! Overwrite the previous file). Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Delete the below file if found (use safe mode or Killbox if necessary):
C:/WINDOWS/system32/atl.dll

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Okay please run the below procedure and attach the requested log (you will need a second message to attach this fourth log):

Using Sophos Anti-Rootkit

 

Please delete the below folders? Note that the Questionmarks represent unprintable characters that were found during the scans, but they may appear to you as normal characters when you locate them using Windows Explorer. I will add comments in RED next to each item. Note the date of the folders which will help you to locate them:

Code:

"C:\Documents and Settings\The Champ #1\Application Data\"
CROSOF~1.NET  21 Sep 2006              "??crosoft.NET"
WNSXS~1       16 Sep 2006              "W?nSxS"

No! It is part of Microsoft Malicious Software Removal Tool! I don't recommend that you experiment in the registry on your own unless you are an expert. Doing the wrong thing can make your PC unusable and non-recoverable.


Download The Avenger ( http://swandog46.geekstogo.com/avenger.zip ) by Swandog46, and save it to your Desktop.
Extract avenger.exe from the Zip file and save it to your desktop
Run avenger.exe by double-clicking on it.
Check the 'Input script manually' box.
Click on the magnifying glass icon.
Copy the quoted bold print below and paste it in the box that opens from Avenger:

Now click the 'Done' button.
Click on the traffic light icon and OK the prompt.
You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it.
A log file from Avenger will be produced at C:\avenger.txt, please post that log here in your next reply.

Now Uninstall this: Internet Explorer Default Page


You need to take a serious look at the log from Sophos Anti-Rootkit. The things being download with Ares (and probably other similar P2P tools) are the source of most infections that we fix. If it were my PC, Ares and any other P2P program would be uninstalled and their folders and all contents deleted.



I will be away for 9 days! Hopefully one of the other helpers here can continue to help you! Or you will have to wait until I get back!

 

Sorry to hear that you had to format the drive. Make sure you follow the tips in the How to Protect yourself from malware! link I gave to you in message number 5.