Malware support needed

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.


​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

You are missing three log files:
- CounterSpy
- Bitdefender Online scan - and it appears that you did not follow the directions in step 6a. We did not tell you to install Bitdefender Antivirus (which would go against what we specify in step 3). We gave instructions to run Bitdefender Online scan which is totally differnet. UNINSTALL what you installed now.
- PandaActiveScan log

You also did not follow the directions in the READ ME for Spybot. You are running version 1.3 which has not been used in over two years. Uninstall it, reboot, and follow the directions in the READ ME for using the proper version of Spybot.

After attach the above logs and correcting the above issues continue with the below:

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

Do you still need the Windows 2000 tour to be loading at startup. I'm wondering why the below is in your startups.
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg

If you don't need this anymore, add it to the below list of things for fix with HijackThis.

Uninstall the below old versions of software:
Mozilla Firefox (1.0.2)

Then install the current version of FireFox from: Mozilla Firefox

Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [Xbgdmh] C:\Program Files\Gilpd\Mxpnkle.exe

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINNT\SYSTEM32\CNIYWG.EXE
C:\WINNT\SYSTEM32\ILWCI.DAT
C:\WINNT\SYSTEM32\ESFHHLX.EXE
C:\WINNT\SYSTEM32\IUHYNOJ.DLL
C:\WINNT\SYSTEM32\SWYDW.EXE
C:\WINNT\biofn.dll
C:\WINNT\system32\itiqnykq.dll
C:\WINNT\system32\dnpkugnh.dll
C:\WINNT\system32\ddccy.dll
C:\WINNT\system32\hngukpnd.ini
C:\WINNT\system32\yccdd.ini
C:\WINNT\Temp\$_2341234.TMP
C:\WINNT\c2hjYw\wZ13sT.vbs
C:\WINNT\RUNDLL.EXE
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\UUTAD.EXE
C:\Documents and Settings\reception.SHCC2K3\Local Settings\Temp\MMXSNET.EXE
C:\Documents and Settings\reception.SHCC2K3\Local Settings\Temp\YazzleBundle-1281.exe
C:\Documents and Settings\reception.SHCC2K3\Local Settings\Temp\WINUS.EXE
C:\Documents and Settings\reception.SHCC2K3\Local Settings\Temp\SPOOLSRV.EXE

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But if you do get this message, please let me know!)

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folder and delete if found:
C:\Program Files\Softwin

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

You did not answer my question:

Also here is another. What is the below for?
O4 - Global Startup: print.bat

What is in the file? Search for it and load it into notepad for viewing. Copy and paste it here.

 

Exactly when do these occur? Do they keep happen all the time you are using your PC.

When does this occur. Does the verctrl.exe file name mean anything to you. Search for it too and tell me where it is located.

 

Okay! Be sure to locate this thread and report your findings here. Remember to copy and paste in the contents of print.bat

 

You said "the user"! Which user account? Is it the account you have been posting logs for or is it another user account?

The account you posted logs for was only:
USERNAME=administrator
USERPROFILE=C:\Documents and Settings\Administrator.SHCC2K3


Click Start, and then click Run. (The Run dialog box appears.)
Type, or copy and paste, the following text:

regsvr32 /u ddccy.dll

then click OK. If a dialog box confirming this action appears, click OK. If you get any error messages, just OK it and continue.

Now repeat the above for the below files.
ddccy.dll
dnpkugnh.dll
cipmsg.dll
c_9svr.dll
C:\Documents and Settings\All Users\Application Data\autosearch.dll

Click Start and select Search
Now Select "All files and folders"
Enter the verctrl.exe in the "All or part of the file name:" box
Now select "More advanced options"
Make sure the following check boxes are checked:

• Search system folders
• Search hidden files and folders
• Search subfolders

Then click the Search button. Tell me if you find it now and where.


Download the current versions of ShowNew and GetRunKey (from links in the READ ME) and attach new logs.