Malware removal help "Enter" dialer

Discussion in 'Malware Help (A Specialist Will Reply)' started by redjordi, Oct 9, 2006.

  1. redjordi

    redjordi Private E-2

    Hi,

    I have a dialer pop up regularly when I am using the browser (both Firefox and IE). The dialer is called "ENTER".

    I have followed the instructions and I have all the logs.

    If I can get some help that would be much appreciated.

    jordi
     

    Attached Files:

  2. redjordi

    redjordi Private E-2

    and here is the HJT log
     

    Attached Files:

  3. redjordi

    redjordi Private E-2

    and here is the Panda Activescan report (i had forgotten)
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Uninstall the below old versions of software:
    Java 2 Runtime Environment, SE v1.4.1_01

    Now install the current version of Sun Java from: Sun Java Runtime Environment


    Make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - (no file)
    O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\system32\maxspeed.exe (file missing)
    O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\system32\maxspeed.exe (file missing)
    O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\Documents and Settings\All Users\Start Menu\Online Security Guide.url
    C:\Documents and Settings\All Users\Start Menu\Security Troubleshooting.url
    C:\Documents and Settings\layret\Application Data\dm.ini
    C:\WINDOWS\SYSTEM32\AVWAV084.exe
    C:\WINDOWS\system32\maxspeed.exe

    C:\Program Files\ScanSpyware v3.8.0.4 <--- the whole folder
    C:\Program Files\Common Files\{68340004-07C9-1033-1217-02040920002c} <--- the whole folder:

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).

    Now reboot in normal mode

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\layret\Local Settings\Temp

    Now attach a the below new logs and tell me how the above steps went.

    1. ShowNew
    2. HJT


    Make sure you tell me how things are working now!
    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.g WinXP or WinMe.
     
  5. redjordi

    redjordi Private E-2

    Hi chaslang,

    Thanks a lot for your help.

    I followed your instructions. The only thing I could not do was to delete:
    C:\WINDOWS\system32\maxspeed.exe

    Since I could not find that file. I also used the search to look for it but could not find it. One I was back on normal mode I did another search and could not find the file either. Only thing I found was three maxspeed.zip files in the SpyBot Search and Destroy Recovery folder.

    attached are the two logs you asked for

    Thanks

    jordi
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome!

    Your log is clean. If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    3. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and enable System Restore to create a new clean Restore Point.
    4. After doing the above, you should work thru the below link:
     
  7. redjordi

    redjordi Private E-2

    Hi there,

    I do not seem to have any problems, I enabled system restores, and I am very thankful for your help. I brought this malware onto myself by doing something stupid (even more so because I should know better).

    best

    redjordi
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds