Malware problem Help requested

Discussion in 'Malware Help (A Specialist Will Reply)' started by olephill2, May 31, 2006.

  1. olephill2

    olephill2 Private E-2

    Hello all, I'm new here. I have read through and followed every instruction in the "READ & RUN ME FIRST Before Asking for Support " thread, but am still having problems on my PC. I get recurring popups, mostly for WinAntiVirus2006, AdultFriendFinder, 888.com and others. I may have also received a few fake alerts from sysprotect. Additionally, my toolbars along the top of my internet browser keep getting placed out of order randomly, and sometimes the address bar disappears entirely despite me locking my toolbars. Also, my internet explorer browsers have been running EXTREMELY slow, and if I try to open and run multiple browsers, they often crash or freeze and I get the "send error report" message.

    For some reason my log files for HiJack This, Active Scan and the Bit Defender scan (which supposedly deleted around 19 trojans and viruses) are not attaching, so I will post them in the next post. Sorry for any inconvenience.

    Any help would be very much appreciated. I've spent most of the day trying to fix this annoying problem. Thanks!
     
    Last edited: May 31, 2006
    olephill2, May 31, 2006
    #1
  2. olephill2

    olephill2 Private E-2

    Again, sorry, but for some reason my computer would not allow me to place attachments.

    Here is my HiJack This log posting:

    Edit by chaslang: 3 Inline logs attached.

    Here is my Active Scan log file:

    Here is my bdscan result:
     

    Attached Files:

    Last edited by a moderator: May 31, 2006
    olephill2, May 31, 2006
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not empty your Norton Quarantine folder as the directions in step 0 of the READ ME request. Please do that now.

    Make sure viewing of hidden files is enabled (per the tutorial).
    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    O4 - HKLM\..\RunServices: [AOL Instant Messanger] aim.exe
    O4 - HKCU\..\Run: [AOL Instant Messanger] aim.exe
    O15 - Trusted Zone: *.musicmatch.com
    O15 - Trusted Zone: *.musicmatch.com (HKLM)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\windows\system32\aim.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).

    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, May 31, 2006
    #3
  4. olephill2

    olephill2 Private E-2

    Hi Chaslang, thanks for the response!

    I have followed all of your instructions, except one: when in safe mode, i browsed and searched for aim.exe in my c:\windows\system32 folder but that file did not exist. I wonder why? I did, however, follow each of your other instructions.

    Attached is my new HJT log file. So far (just in the last 5 minutes) I haven't received any popups, but my internet browsers are still running VERY slow when I open more than one at once. Multiple browsers seems to really cause problems (the opened browsers keep jamming up).

    Any more ideas?

    [EDIT] (5 minutes later): Just got my first popups, one for WinAntiVirus2006 and one for adultfriendfinder.
     

    Attached Files:

    olephill2, Jun 2, 2006
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you forget to fix the below line?

    O4 - HKLM\..\RunServices: [AOL Instant Messanger] aim.exe

    Try again and make sure it gets fixed by checking your log!

    Do you need/use the below?
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\Nike JogaTV\bin\NikeJogaTV.exe
     
    chaslang, Jun 2, 2006
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Run this: Virtumonde aka Trojan Vundo Removal

    And then attach the VundoFix log.

    Let's get an installed programs list from HijackThis too!
    • Run HijackThis, click Open the Misc Tools section
    • Click Open Uninstall Manager
    • Click Save List (generates uninstall_list.txt)
    • Click Save, to save it to a file where you can find it.
    • Attach the uninstall_list.txt file to your next message.
     
    chaslang, Jun 2, 2006
    #6
  7. olephill2

    olephill2 Private E-2

    Hi Chaslang!

    I did indeed forget to check and fix this:
    That has now been done.

    I use the Dell Media Experience one, but as for the rest, I don't use them. Should I delete those in HJT as well? Also, about the second one (DIGStream), I don't even know what that is. Should I delete it even though I'm not sure what it does?

    I also ran the VundoFix scanner and it fixed a few files. I'll attach the log of its activity, in addition to my newest HJT logfile and my installed programs list.

    Thanks again for your help, I'll look forward to your next response.
     

    Attached Files:

    olephill2, Jun 2, 2006
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Becareful when saying "delete". Programs should be uninstalled where possible. Deleting and uninstalling are not the samething. Uninstalling should remove all traces of the program from your registry and it should also delete the associated files. (I say "should" because many uninstalls work very poorly.) If you just delete files, the program will still actually be installed and registry keys will still exist. In addition, you will break the uninstaller making it impossible to uninstall.

    See the below about digstream:

    http://www.bleepingcomputer.com/startups/digstream.exe-1292.html

    Now what do you say? Just be aware that you have been saying your browsing has been running slow. This is not helping them run any faster.

    What do you need the Dell Media Experience\PCMService.exe for?


    Uninstall the below immediately! It contains bundled malware:
    LimeWire 4.8.1

    Also since you said you dod not need Nike JogaTV uninstall it too.

    You did not follow the READ & RUN ME correctly. You did not check each of the links and verify version info. You are running Spybot - Search & Destroy 1.3. This version has not been used in more than a year. Please uninstall and get the version from the READ ME.


    You have both Yahoo and Google Toolbars installed. Do you really use and need them?

    You also have Yahoo Antispyware installed. Do you use this?
     
    Last edited: Jun 2, 2006
    chaslang, Jun 2, 2006
    #8
  9. olephill2

    olephill2 Private E-2

    Hi Chaslang.

    I use the Dell Media Experience to watch DVDs. PCMService.exe is the executable used to launch the DVD, I believe.


    I seem to be having a problem uninstalling this. When I use add/remove programs and click "change/remove" on Nike Joga TV, nothing happens. When I try to open Nike Joga TV, nothing happens. How do I get rid of this?

    Done. Thanks.

    I just uninstalled the Yahoo toolbar and Yahoo antispy. I use the Google toolbar as a convenience so I've kept it.


    As an UPDATE, I ran the VundoFix program and it seems to have fixed all the problems I was having. Thank you so much. Can you explain why you had me delete the items you mentioned in HJT, particularly the aim.exe one? Also, now that my PC seems to be clean, what should I do about system restore? Do I need to disable and then re-enable?
     
    olephill2, Jun 5, 2006
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try using this Your Uninstaller! 2006 to uninstall it. The if the below are still in your HJT log, fix them:
    O4 - HKCU\..\Run: [mavenapp://maven.net/nike/jogatv] C:\Program Files\Nike JogaTV\bin\NikeJogaTV.exe
    O4 - Startup: Nike JogaTV.lnk = C:\Program Files\Nike JogaTV\bin\NikeJogaTV.exe
    O18 - Protocol: mav-8551 - {76DCBDE1-7167-444D-95BE-DE25DE6B23E8} - C:\Program Files\Nike JogaTV\bin\idsAX.dll

    And then delete the C:\Program Files\Nike JogaTV folder


    That is not the real AIM. Read the spelling: Messanger and also it is not running from the correct location. It was malware!

    We are not done yet. I think we have some minor cleanup to do after you completed the VundoFix procedure. Post anothe new HJT log so we can finish.
     
    chaslang, Jun 5, 2006
    #10
  11. olephill2

    olephill2 Private E-2

    Hi Chaslang. Attached is my newest Hi-Jack This log. Let me know if there's anything else I can/should do. And thanks for your help!
     

    Attached Files:

    olephill2, Jun 5, 2006
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I assume Your Uninstaller 2006 worked????


    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O2 - BHO: (no name) - {1D645DA3-8CFD-4934-877C-0F10056DA76E} - C:\WINDOWS\system32\ddabx.dll (file missing)
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    After clicking Fix, exit HJT.:
    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, Jun 5, 2006
    #12
  13. olephill2

    olephill2 Private E-2

    I indeed was able to uninstall Nike Joga TV. Thanks.

    And attached is my newest Hi-Jack This log, having followed your instructions. My computer also seems to be working just fine and my internet browsers have been stable and have been working at their normal speeds. Let me know if there's anything else I can do, and once again, thanks so much for your help! :)
     

    Attached Files:

    olephill2, Jun 5, 2006
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Jun 5, 2006
    #14

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds