Need help with Trojan Viruses and pop up's

I have dial-up at home and when I connect, I get this box which reads

"For quick access to the internet" Click yes, a pop up box which will disconnect me and make me reconnect through dial-up. Most of the time it won't pop up, but it is randomly popping up throughout the day when I am connecting to the internet.

Along with this box I get these viruses

Trojan horse backdoor.Small.23.ad
Trojan horse backdoor.small.29.ad
Trojan Horse collected.5.av
Trojan Horse downloader.dyfica.3.R
Trojan Horse downloader agent.6.BA
Trojan Horse PSW.dumarin.AM

They are about 14 in all with these similiar names.

I have already run AVG, Anti-Worm and still having the same problems. Anti-worm removed some old viruses which wasn't trojan related, but I am still having the same issue with connecting and that box.

Here is a HJT logfile, hope you all can help fix this issue.

 

Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:

• Click START > My Computer > Local Disc C: > Program Files
• Now, Right Click on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:

• Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
• (C:\Program Files\HJT) and click Next.

After you have completed the above steps to relocate HJT, run it from the new location. Please save your HJT log as a .txt file and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.


Download L2MeFix Tool and save it where you will be able to find it.

Please print out these instructions now or save locally so that you can operate with All Browser Windows CLOSED.

Exit Browsers now before continuing

Please move the L2MeFix Tool to your Desktop and DoubleClick l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix Folder on your Desktop. DoubleClick l2mfix.bat and Type 1 and ENTER to select Option #1 for Run Find Log . Allow it as much time as it needs to run until NotePad opens with a log. Save this log. You will need to post this log back here later when you come back.

Next DoubleClick l2mfix.bat and type 2 and ENTER to select option #2 for Run Fix. Then, press any key to Reboot your machine.

Your computer will go crazy for a bit, but just let it run. It should eventually spit out a log in Notepad. Please also attach this log to your next message.

Now open your browser and come back here and post the above two logs as attachments to your message. Also indicate your current status.


NOTE: Please do not run any other options or files in the l2mfix Folder!

 

I downloaded the fixittool and extrated HJT it's own folder.

Right when I dialed back in, I got he box again, so sorry it took me some time to get this to you.

I have all the logs and HJT file you wanted me to run. I got option 2 to work when I was running l2mfix.bat, but it said I need a password.

Here are the files you requested.

I am still havinga horrible time with this stupid pop up box disconnecting me.

 

here is the HJT file as well, couldn't put all 3 files at once.

Hope this helps fix the issue soon. This is annoying dealing with this problem

 

Please download Spy Sweeper

• Click the link above to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into notepad and save it as spysweeper.txt and attach it to your next post along with a fresh HJT log.

 

Okay, it took me a while to download the spy sweeper. However, it removed a lot.

Here are the logs from HJT and SpySweeper.

Thanks for helping me, hope you can continue to help, just let me know what else needs to be done.

It reported that it had taken the spyware that was hijacking my IE browser.

Here are the reports.

 

Download this trial version of Ewido Security Suite

• First, please download and run CCleaner to clean temp files, cookies, etc; to make the log shorter.
  
• Install ewido security suite
  
• When installing the program, under "Additonal Options" uncheck..
  
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should now be an icon on your desktop, double-click it.
• You will need to update ewido to the latest definition files:
  
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update ewido. Ewido Manual Updates

• Once the updates are installed, exit Ewido.
• Now print the below instructions or save them locally because I want you to have all browsers closed and also have no connection to the internet (unplug your cable) while doing the below:
• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine
• While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report[/size][/color]
• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.
• Reboot into normal mode and reconnect to the internet.

Once your machine reboots please attach the report from Ewido along with a fresh HJT log from normal mode.

 

Thanks for the help, I haven't had the problem since I ran everything you told me too.

If the problem occurs again in the future, I will repeat the processes.

Thanks a lot for your help.

 

Good, I would recommend attach a fresh HJT log to confirm your clean.

 

Okay, here is the HJT log you asked for. Hopefully everything is cleaned out.

If not, let me know what else needs done.

Thank for your time and patience.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Viewpoint

AVG AntiVirus or McAfee AntiVirus
(Uninstall one of these, running two will cause conflicts)

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

F2 - REG:system.ini: Shell=explorer.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/MyFunCardsFWBInitialSet up1.0.0.8.cab

O21 - SSODL: IJqRdpgl - {987711ED-32DD-BB47-15AE-8E6A95D18BC8} - C:\WINDOWS\System32\unw.dll (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Okay, I uninstalled Viewpoint and I removed McAfee anti-virus.

 

Did you complete the rest of the steps?

 

Yes, I am starting to do those steps right now, I will let you know what happens once I complete them.

Thanks

 

Okay!

 

Okay, now for some reason, things were working good after I ran everything.

However, now I get this anit-virus page that won't allow me to go to any other webpage.

Here is part of the message copied on the site.

Attention! Your system is under control of remote computer with IP address 227.4.167.118. The remote computer has access to the following folders on your PC:
- \WINDOWS\System32
- \Program Files\Internet Explorer
- \My Documents
- Drive C:\ files
Click here to download official anti-spyware software


Your private info is collected by W32.Sinnaka.A@mm
Your IP address: 12.162.187.32

Your Country: US, United States

They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)

Operation System: OS Windows

Risk status for futher investigation: VERY HIGH RISK

Time of investigation: Wed Dec 7 13:56:56 PST 2005

I hate that spyware exists and what they do to computers.

Here is the HJT report as well.