loadingwebsite strikes again!

Hi All,

Proper hoping you can help me out. I thought I was security conscious and haven't had a major problem since I started surfing over 10 years ago - guess I was wrong!!!

I've managed to pick up what I think is a trojan which keeps bringing up the loadingwebsite pages - I've read a few other posts on this so I know it's fixable - I'm just not experienced enough to do this alone.

I've read and done all I can from you "DO NOT POST UNTIL YOU HAVE READ THIS: How to: Spyware, Trojan And Virus Removal " post, but to ensure we get off to the right start, this is exactly what I've done:

Disabled System Restore

I've looked for:

Network Security Service
Workstation Netlogon Service
Remote Procedure Call (RPC) Helper

none of these were running.

Hidden / System files were already visible, but double checked anyway - this is fine.

I already had an up-to-date version of Ad-Aware, so I just downloaded the VX2 Cleaner Plug In, installed it, double checked updates - all fine.

Downloaded and installed CCleaner

I already had Spybot - checked updates - fine

Downloaded and installed SpywareBlaster, updated it - fine

Downloaded McAfee AVERT Stinger

Already had CWS Shredder - got rid of it and downloaded it again from your link to be sure (You did have a newer version than mine!)

Downloaded Kill2me

Downloaded about:buster

Downloaded HSRemove

Booted into Safe Mode, but was unable to do so with Network Settings present, so carried out steps 2 -3 of your guide and then for good measure, I ran all of the above programs in safe mode

The booted into normal mode and ran Trend online scanner as well as the symantec security check

Ran all the programs again

Whilst still in normal mode, tried the Bitdefender online scan from your link but couldn't get it running

Ran the RAV Antivirus online scan - nothing found

Next I ran the online TrojanScan from your link - no malware found

I also run Norton AntiVirus 2004, TDS-3 and Webroot SpySweeper - all fully updated

I did have the free version of ZoneAlarm too, but found it intrusive (if not obstructive) on safe sites, even when configured properly, so I uninstalled it months ago and turned on the Windows Personal firewall instead (D'oh!)

I'm running Windows XP Home Edition Version 5.1 (Build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2) on a Mesh PC with an AMD Athlon 2800+ chip.

To add insult to injury, while I've been typing this up, that poxy bug keeps popping up offering me Free Spyware Removal Tools - if I could get my hands on whoever wrote the script...!

So, as requested, I haven't posted a Hijack This log yet, but will check back over the weekend to see if you're able to help.

If possible, in addition to any removal advice you may be able to give, I'd really appreciate some tips on preventing reinfection.

Many thanks in advance for having read this,

jfish

 

http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

You guys should check out this search i found a link to, it really helps:

http://www3.ca.com/securityadvisor/

 

OK - here we go - all apps, browsers etc.. closed, and HJT run from C:\Program Files\HJT - log attached as requested...

 

jfish,

Download the following tools:

L2MeFix Tool

Generic Detection Tool - NT/2000/XP

VX2.BetterInternet Finder XP/2k - Version Msg126

Pocket KillBox

DO NOT USE ANY OF THESE TOOLS UNTIL TOLD TO!

Please move the L2MeFix Tool to your Desktop and DoubleClick l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix Folder on your Desktop. DoubleClick l2mfix.bat and type 2 and ENTER to select option #2 for Run Fix. Then, press any key to Reboot your machine.
Your computer will go crazy for a bit, but just let it run. It should eventually spit out a log in Notepad. Please attach that log along with a fresh HJT log.

Please don't run any other files in the L2MFix folder.

 

Hi bjgarrick,

All done as requested - l2m log and fresh HJT log attached.

Cheers,

jfish

 

Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

O3 - Toolbar: AZE Search - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - (no file)

O4 - HKLM\..\Run: [tsvcin] C:\WINDOWS\system32\n20050308.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\system32\n20050308.exe

NEXT:
Run CCleaner

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

NOW:

Unzip the Generic Detection Tool to a safe folder of your choice and run "find.bat" - Allow it as much time as it needs to run. You may get an error message of "File Not Found," but just let it go.

The tool should generate a long text file. Attach this log as an attachment to your next post along with a fresh HJT log.

 

OK, so far so good - here's the Generic Detection Tool Log and the fesh HJT log.

Thanks,

jfish

 

Your logs are clean! There is only one last thing to do, follow below:

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file VX2FIX.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the VX2FIX.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES!

Are you having any further problems?

 

That's it - the little bugger has gone!

All I can say is a big thank you - your help has been very much appreciated.

jfish

 

Your Welcome!

You should see this article on How to Protect yourself from malware!