Major IE problem, may be related to spyware, need help ASAP.

My stepdad and I have been trying to fix a major problem our main computer has been having, without any avail, and I am 98% certain that it's somthing to do with the spyware that is either still on this computer, or that we have removed using the directions given on this website's forum (the problems started immediatly after we returned to normal mode through the safe mode after removing the spyware). It seems to be wanting to restart spontaniously whenever ANY web browser is opened (IE, Netscape, Firefox, etc. NO browser has been safe). Even turning on our Comcast modem box has led to it just restarting without any warning. Furthermore, the Microsoft Anti-Spyware program we are now using would delete all of the spyware on our comp if it wouldn't insist on stopping on a certain file in the registry and locking up, causing it to stop responding every single time we've tried it (about five or six times now). We are totally lost as to what is causing the problems with either of these two issues.

Finally, now even System Restore is refusing to work (it keeps saying "Restore Incomplete" everytime we try THAT now), with no real reason why any of this is happening. Can ANYONE help us out in fixing all of this? Any help will be appreciated.

 

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:


http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Thatnks for the help. Unfortunatly, this sticky thread is the one I was talking about in the previous thread when saying that we've already performed all of what it has said. We are still getting the problems, every single one still that I've outlined here. I think we have a major trojan on here that isn't being detected by anything that can take care of it (as I said, the MS Spyware Blast seems to not want to continue the scan past the registry file HKEY_CLASSES_ROOT/clsid/{CABCF5E7-0C79-4F1C-909D-B9CF68FED746} ). I've attached the HJT log in this post so you can see it for yourself. Please help, as this is really getting irritating really quick.

 

• Download LSP-Fix

• After download is complete, Run LSP-Fix

• Check the Box labeled "I know what I'm doing" and then click on the files aklsp.dll & dolsp.dll (in the “Keep” section) to select them.

• Then, Select the >> button to move aklsp.dll & dolsp.dll into the Remove section.

• Now, click the Finish Button. When the Repair Summary box appears, click OK.

• (Note: If the files aklsp.dll & dolsp.dll are already in the remove section, then just click FINISH.)

Please look in Add or Remove Programs for the following and Uninstall them if found:

Viewpoint

MBKWBar

WeatherBug

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see them, try to END them:

iexplore.exe <-- End every instance of this process or this will be difficult to remove!

kzkpmn.exe

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)

O2 - BHO: (no name) - {00000000-DD60-0064-6EC2-6E0100000000} - (no file)

O3 - Toolbar: Microbuddy - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - C:\Program Files\MBKWBar\IEToolBar.dll

O4 - HKLM\..\Run: [KavSvc] C:\WINNT\System32\kzkpmn.exe
O4 - HKLM\..\Run: [vaet] C:\WINNT\System32\kulet\vaet.exe

O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML

O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ComcastHSI - {4D3CF926-481E-4093-9DE0-292314A335C3} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Help - {7E0BBF44-F4C5-4366-81C4-C64C0C4D1FE3} - http://online.comcast.net/help/ (file missing) (HKCU)
O9 - Extra button: Support - {AF5D2B34-087D-48E9-858F-D3429D891064} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)

O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0034.exe
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
O16 - DPF: {C0B285F6-DB2B-4908-9C58-F6D95397D747} - http://www.pacimedia.com/install/pcs_0011.exe

O23 - Service: vaetkulet - Unknown owner - C:\WINNT\System32\kulet\vaet.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\Viewpoint ←–– Delete this whole folder if it exist!

C:\Program Files\MBKWBar ←–– Delete this whole folder if it exist!

C:\Program Files\AWS ←–– Delete this whole folder if it exist!

C:\WINNT\System32\kulet ←–– Delete this whole folder if it exist!

C:\WINNT\System32\kzkpmn.exe

C:\WINNT\System32\dolsp.dll

C:\WINNT\System32\aklsp.dll

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing ALL of the above,
Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Halliyuyah (sp?)!

I'm not taking anything for grantd just yet because I just did everything on that list about 5 minutes befor posting this, but as of right now, everything seems to be on the up and up. The HJT log (the updated one you asked) is attached to this post. Hopefully this is not a falsehood and it's still on here, but you guys are the best. Thanks.

 

Download Pocket KillBox
(Don't run it yet though)

Before we finish up with the cleaning, run these online scans:

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After you run these online scans procede with the following,

Now, Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled

Now scan with HijackThis and Check the Boxes for the following:

O4 - HKLM\..\Run: [KavSvc] C:\WINNT\System32\kzkpmn.exe

Make sure All Browser Windows are Closed when you Click FIX.

NOW:
Locate PocketKillbox

Now, Copy and Paste C:\WINNT\System32\kzkpmn.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINNT\system\lphmbowu.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES.

After you reboot into Normal Mode run CCleaner and then scan with HJT and attach the new log.