Need Help With Trojan

quick6763 · Jan 26, 2007

I have followed all of the steps, could someone please look over my logs.
I could not find where to copy the files with Counter Spy But i wrote it down.

Counter Spy
1) Trojan.syddldg.4EBA5B48
C:\windows\system32\yayvspm.dll
2) Hocus
C:\Documents and Settings\Administrator\Local Settings\A

bjgarrick · Jan 27, 2007

Welcome to MajorGeeks.com, please follow our standard cleaning procedures:

http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..

http://www.majorgeeks.com/images/grenade.gifWhen you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

quick6763 · Jan 27, 2007

I did follow all of the steps but something is still redirecting me when i try to search. Here are the other Logs. Thanks

quick6763 · Jan 27, 2007

New to this so work with me. I was not sure that you got my last post so please review when you can.

bjgarrick · Jan 27, 2007

Please see the below thread on how to install and run Ewido Anti-Malware.

Running Ewido Anti-Malware...

quick6763 · Jan 30, 2007

I ran Ewido Here is the report. I also ran Counter Spy again and it is still finding -Trojan.syddldg.4eba5b48trojan. Seem like it has something to do with the yayvspm.dll. Whats next confused

Thanks in Advance!

chaslang · Jan 30, 2007

You need to set your system date properly! It is messing up all the scans. You have your PC set to the year 2000. Set it properly and then attach a new log from ShowNew. Make sure you get the the complete date and time set properly.

quick6763 · Jan 30, 2007

Ok, here it is!

quick6763 · Jan 30, 2007

chaslang, just to let you know i also have a bug that create random words when i create a new folder.

bjgarrick · Jan 31, 2007

Please download HOSTER and then follow the below steps.

Unzip HOSTER to a convenient folder such as C:\Hoster

Run Hoster.exe, click Restore Microsoft's Hosts File and then click OK.

Click the X to exit the program.

Once you complete this, attach a fresh HJT log.

chaslang · Jan 31, 2007

BJ,

Did you notice the below in the ShowNew log?

C:\WINDOWS\SYSTEM32\nnnmp.ini

"DisplayName"="Java 2 Runtime Environment, SE v1.4.2_06"
"DisplayName"="Spybot - Search & Destroy 1.3
Click to expand...

bjgarrick · Jan 31, 2007

No, I didn't, I briefly galnced thru the logs as I didn't have the time to do a full fix.

quick6763 · Jan 31, 2007

I ran Hoster, here is the new HJT Log.

Thanks!

bjgarrick · Feb 2, 2007

Download Pocket KillBox

Save it to your desktop or a place easy to find.

Do not run it yet

Please look in Add/Remove Programs for the following and uninstall them if found:

Spybot - Search & Destroy 1.3

Java 2 Runtime Environment, SE v1.4.2_06

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search /search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {59CD7310-98A4-48BF-BE77-C12032C98D31} - C:\WINDOWS\system32\yayvspm.dll
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - (no file)
O2 - BHO: (no name) - {7FE6296B-2824-435E-88C1-15B5A394D5F8} - C:\WINDOWS\system32\pmnnn.dll

O4 - HKLM\..\Run: [{4AA3331E-04E1-1033-1215-031101040001}] "C:\Program Files\Common Files\{4AA3331E-04E1-1033-1215-031101040001}\Update.exe" mc-110-12-0000272
O4 - HKLM\..\Run: [{4AA3331E-04E2-1033-1215-031101040001}] "C:\Program Files\Common Files\{4AA3331E-04E2-1033-1215-031101040001}\Update.exe" mc-110-12-0000272

O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} -

O20 - Winlogon Notify: pmnnn - C:\WINDOWS\system32\pmnnn.dll
O20 - Winlogon Notify: yayvspm - C:\WINDOWS\SYSTEM32\yayvspm.dll

O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)

Again, make sure ALL browser windows are closed when you click FIX.

Now Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.

On the page that opens, scroll down to COM+ Messages

Then right click the entry, select Properties and press Stop Service.

When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.

Click OK until you get back to Windows.

Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.

At the lower right, click on the Config button

Then click the Misc tools button

Select Delete an NT Service

Copy/pasteCOM+ Messages into the box that opens, and press OK

If you receive any error messages just ignore them and continue.

Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\Program Files\Common Files\{3AA3331E-04E2-1033-1215-031101040001} ← Delete this whole folder if it exist!

Next, run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

C:\WINDOWS\nvchost.exe

C:\WINDOWS\system32\nnnmp.ini
C:\WINDOWS\system32\yayvspm.dll
C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\system32\svchosts.exe
Click to expand...

If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, REBOOT and proceed with the rest of this fix...

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

Disable and Re-enable System Restore

Turn OFF System Restore to flush any bad Restore Points.

Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

quick6763 · Feb 4, 2007

Still getting redirected while surfing and when i create a "new folder" the folder is still being created with random words.

Again Thanks!

bjgarrick · Feb 5, 2007

First, let's uninstall ewido anti-spyware 4.0 and CounterSpy.

Let's start by downloading two tools we will need

- Process Explorer 10.21

- Pocket KillBox

Extract them to there own folder somewhere that you will be able to locate them later.

Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of [byayvspm.dll & pmnnn.dll[/b] once and then click the kill button. After you have killed all of the yayvspm.dll & pmnnn.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of yayvspm.dll & pmnnn.dll and kill it.

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {59CD7310-98A4-48BF-BE77-C12032C98D31} - C:\WINDOWS\system32\yayvspm.dll
O2 - BHO: (no name) - {BF928F45-3465-407C-9BC0-9554E84CC0AE} - C:\WINDOWS\system32\pmnnn.dll

O15 - Trusted Zone: http://www.iwon.com

O16 - DPF: {21C6245C-9408-11D7-BF3B-00E09876DF26} (WebTrain.ctlWebTrain) - http://www.webtrain.com/cabinet/wt0223.cab

O20 - Winlogon Notify: pmnnn - C:\WINDOWS\system32\pmnnn.dll
O20 - Winlogon Notify: yayvspm - C:\WINDOWS\SYSTEM32\yayvspm.dll

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\WINDOWS\SYSTEM32\mpsvyay.ini
C:\WINDOWS\SYSTEM32\mpsvyay.ini2
C:\WINDOWS\SYSTEM32\mpsvyay.bak
C:\WINDOWS\SYSTEM32\mpsvyay.bak1
C:\WINDOWS\SYSTEM32\mpsvyay.bak2
C:\WINDOWS\SYSTEM32\mpsvyay.tmp
C:\WINDOWS\system32\mpsvyay.dll

C:\WINDOWS\SYSTEM32\mpsvyay.ini
C:\WINDOWS\SYSTEM32\mpsvyay.ini2
C:\WINDOWS\SYSTEM32\mpsvyay.bak
C:\WINDOWS\SYSTEM32\mpsvyay.bak1
C:\WINDOWS\SYSTEM32\mpsvyay.bak2
C:\WINDOWS\SYSTEM32\mpsvyay.tmp
C:\WINDOWS\system32\yayvspm.dll

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

quick6763 · Feb 6, 2007

I got redirected while i was trying to post :cry . Here is the log

quick6763 · Feb 10, 2007

I posted the log, are we out of options or is there still hope?

chaslang · Feb 10, 2007

You must attach HJT logs from normal boot mode! Please attach a new one.

Also attach new logs from ShowNew and download the current version of GetRunKey and attach a new log from it. Also please describe any remaining problems and I will try to continue with what BJ started. It does not look like you followed his last instructions with Process Explorer properly. Did you have problems?

quick6763 · Feb 11, 2007

I went back and ran Process Explorer, I did make a mistake the first time......sorry! It look like it ran fine this time. Here are the logs, tell me what you think.

Thanks!

chaslang · Feb 11, 2007

You are still attaching your HJT log from safe boot mode. HJT logs must be attached from normal boot mode. DO NOT ATTACH one yet!

And it still does not look like you follow the instructions BJ gave you ! I'm going to write out new instructions in my next message which will be slightly different. Make sure you follow each step in the order written and do not skip anything.

chaslang · Feb 11, 2007

Okay I want to emphasize this again! Make sure you follow each step below in the order written and do not skip anything.

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.

On the page that opens, scroll down to SymWMI Service

then right click the entry, select Properties and press Stop Service.

When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.

Click OK until you get back to Windows.

Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.

At the lower right, click on the Config button

Then click the Misc tools button

Select Delete an NT Service

Copy/pasteSymWSC into the box that opens, and press OK

If you receive any error messages just ignore them and continue.

Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

Make sure you have rebooted in Normal Mode (do not open any other processes)
Also make sure that one and only one Internet Explorer browser is opened up

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of pmnnn.dll once and then click the kill button. After you have killed all of the pmnnn.dll under winlogon click ok. (If you do not find the dll, just continue on.)

Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
yyfudily.dll

Next double click on explorer.exe and again click once on each instance of pmnnn.dll and kill it. (If you do not find the dll, just continue on.)

Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
yyfudily.dll

Next double click on iexplore.exe and again click once on each instance of pmnnn.dll and kill it. (If you do not find the dll, just continue on.)

Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
yyfudily.dll

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {EEE654AA-0BA9-43A5-B5F2-FED0E6D3C4B9} - C:\WINDOWS\system32\pmnnn.dll
O4 - HKCU\..\RunOnce: [CounterSpyCleaner] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunASCleaner.exe
O20 - Winlogon Notify: pmnnn - C:\WINDOWS\system32\pmnnn.dll

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yyfudily]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnnn]
Click to expand...

Now run Pocket Killbox by doubleclicking on killbox.exe

select File, Cleanup, Delete All Backups (do not skip this!!!)

Choose Tools > Delete Temp Files and click Delete Selected Temp Files.

Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

Delete on Reboot

then Click on the All Files button.

Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\SYSTEM32\yyfudily.dll
C:\WINDOWS\SYSTEM32\nnnmp.tmp
C:\WINDOWS\SYSTEM32\nnnmp.ini
C:\WINDOWS\SYSTEM32\nnnmp.ini2

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folder and delete if found:
C:\Program Files\Common Files\Symantec Shared

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

GetRunKey

ShowNew

HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

quick6763 · Feb 11, 2007

When i post a HJT log i am in normal mode. I click the "do a system scan and save a logfile" after that i click on the problems, then click fix and then i close HJT.

When following you new directions: when i get to the SymWMI Service it is already stopped and disiabled. When i go to HJT and get to where i need to put in SymWSC to delete it i get " The service you entered is system-critical! It can't be deleted......?????

I want to get this right!

chaslang · Feb 11, 2007

quick6763 said: ↑

When i post a HJT log i am in normal mode.
Click to expand...

Only your logs up to message # 15 were from Normal boot mode. The others all appear to be from safe mode. Look at the difference. You will see many many processes not running in the new logs. If you are in normal boot mode, why are all the processes for your antivirus and everything else missing! Are you killing all of them before getting a log?

quick6763 said: ↑

When following you new directions: when i get to the SymWMI Service it is already stopped and disiabled. When i go to HJT and get to where i need to put in SymWSC to delete it i get " The service you entered is system-critical! It can't be deleted......?????

I want to get this right!
Click to expand...

I did say to ignore error messages! This is one of the reasons why! It is not a critical service! The software is not even installed anymore.

chaslang · Feb 11, 2007

quick6763 said: ↑

When i post a HJT log i am in normal mode. I click the "do a system scan and save a logfile" after that i click on the problems, then click fix and then i close HJT.
Click to expand...

By the way this is the wrong order. Fix the problems first, and then save a log. Otherwise what you fix will not show as fixed in the log.

quick6763 · Feb 11, 2007

There wasn't anything to delete in HJT. The two files that you mentioned that might have been in Regedit was not there. When i ran Killbox i saw all of the .dll's that you put in your post and i did delete them but i also saw nnnmp.bak1 and nnnmp.bak2 and was not sure if i should delete them so i didn't. I didn't recieve a PendingFileRenameOperations prompt.

Thanks!

chaslang · Feb 12, 2007

Now you have a HijackThis log from Normal Boot mode! I guess you figured out what you were doing wrong!

quick6763 said: ↑

When i ran Killbox i saw all of the .dll's that you put in your post and i did delete them but i also saw nnnmp.bak1 and nnnmp.bak2 and was not sure if i should delete them so i didn't.
Click to expand...

Yes delete those two files too. They don't appear in the ShowNew log. Probably because their file dates are older than what we look for.

Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.

If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.

If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.

If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created

If you are running Windows XP or Windows ME, do the below:

go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

quick6763 · Feb 19, 2007

Hey chaslang I think that my computer is fixed, I just wanted to tell you guys THANKS! very much for your time.

chaslang · Feb 20, 2007

You're welcome. Surf safely!

Need Help With Trojan

quick6763 Private E-2

Attached Files:

bjgarrick MajorGeeks Admin - Malware Expert

quick6763 Private E-2

Attached Files:

quick6763 Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

quick6763 Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quick6763 Private E-2

Attached Files:

quick6763 Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

bjgarrick MajorGeeks Admin - Malware Expert

quick6763 Private E-2

Attached Files:

bjgarrick MajorGeeks Admin - Malware Expert

quick6763 Private E-2

Attached Files:

bjgarrick MajorGeeks Admin - Malware Expert

quick6763 Private E-2

Attached Files:

quick6763 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quick6763 Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quick6763 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quick6763 Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quick6763 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member