need some help

Kizer · Jul 12, 2006

Hi all. I'm new to the forums and well I'm making this post since I have a serious problem. Recently, after downloading an infected file and letting it execute (it was called Microsoft Office 2003 Generic Fix V2) I've been in quite a bit of trouble. I feel the worst is behind me since the file's execution caused my desktop and toolbars to be invisible. Following the advice in the "READ & RUN ME FIRST" post, I was able to fix that. However, I've been having some other problems. Norton and Windows Defender constantly bring these alert messages up. So far, Norton has brought up messages for Trojon.Dropper (files names as: webnexmk[1].exe, webnexmknew.exe, numbsoft[1].exe, numbsoftnew.exe, Mendoza1.exe ), bloodhound.morphine, Downloader (i.e. wd7gi8n.exe) and dialer.Trojan. Defender has brought up messages for Adware.cmdService,Adware-Qoologic,Adware.cmdService, and Monnet. I could have also sworn I saw a few others laying around (espeically after restarting the comp). Windows Defender also keeps prompting me to reboot (every time I start) and gives me this error "encountered an error: 0x80501001.One or more actions could not be completely successful". Lastly, I have a great deal of pop ups (many with advertisements to this antivirus product called Winantivirus) and an error msg which comes up every 10 minutes or so saying "Unexpected error;qutting" (the source seems to be a file called "sunthreatengine.exe"). So far, I've done a few scans and deleted some files through windows defender. However, the problems seem to persist . I'm currently following the other procedures listed in the "READ & RUN ME FIRST" guide. Anyways, does anyone have any suggestions or have had a similar case? Thank you.

Kizer · Jul 12, 2006

Help. Please. i've followed majority of the read and run me guide but to no avial. I still have norton/windows defender messages coming up like every second. Not only that, these pop ups keep coming up on their own. I've used adware and have deleted a great deal (a few were quarantined). Please help. I've been at this for 3 days now! Please (I apologize for begging). I just want to get my system back in good working condition and get on with my life.

Shadow_Puter_Dude · Jul 12, 2006

If you have complete the steps in the Read Me. Then please post the required logs as attachments.

Kizer · Jul 13, 2006

Hey. Thank you so much for replying. I've attached my HJT log and my BDSCAN log. Unfortunately, my previous problem with the desktop icons arose. Then to make things worse, whenever I load my admin account for windows, I get a message saying corrupted profile or profile is in use(it still loads but with majority or desktop items gone or not present). Please note, the HJT log is from the other windows account, not the admin. Also, thanks again for the reply.

Shadow_Puter_Dude · Jul 16, 2006

Download
- Pocket Killbox

Read and understand how to do the following:
How to view hidden, system files & folders!
Searching for Hidden Files on WinXP

Empty the Norton AV Quaratine Folder
Empty the Norton Protected Recycle Bin
Emtpy the Recycle Bin
Empty the Browser Cache for both Internet Explorer and Firefox.

Run CCleaner

Using Add or Remove Programs in the Control Panel; uninstall the following:
ViewPoint
MyWebSearch
New.net or New Dot Net
ViewPoint (Everything)
WeatherBug
WhenUSaveNow
WildTangent (Everything)

<< The installed version of Java on this compter is out-dated. Install version 1.5.0_07 available from http://www.java.com/en/download/manual.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

Download DelDomains and unzip it to your desktop.

Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.

Afterwards run Spybot and make sure you re-Immunize immediately. Then run a full system scan. If you get any reported problems, attach the log from Spybot.

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.

On the page that opens, scroll down to Command Service or cmdService (Whichever is present) ... right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

Next, run HJT, but instead of scanning, click on the 'None of the above, just start the program' button at the bottom of the choices. At the lower right, click on the 'Config' button, and then the 'Misc tools' button ... select 'Delete an NT Service' ... copy/paste the following into the box that opens, and press 'OK':

Command Service or cmdService (Whichever you found above)

Repeat the process for the following Services:

NTBOOTMGR or NTBOOT (Whichever is present)
Click to expand...

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
C:\WINDOWS\IA\command.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\taskmgr.exe
Click to expand...

Choose Kill Process

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: WeatherBug Browser Bar - powered by MyWebSearch - {8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\2.bin\W6BAR.DLL
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKLM\..\Run: [defender] C:\\dfndre_5.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrde_5.exe
O4 - HKLM\..\Run: [newname] C:\\nwnme_5.exe
O4 - HKLM\..\Run: [akgb5353] RUNDLL32.EXE w1c18f38.dll,n 001b5352000000031c18f38
O4 - HKLM\..\Run: [ckgb5355] RUNDLL32.EXE w1c2135c.dll,n 001b5354000000031c2135c
O4 - HKLM\..\Run: [f89247e9.exe] C:\WINDOWS\system32\f89247e9.exe
O4 - HKLM\..\Run: [ACTX1] C:\WINDOWS\v1201.exe
O4 - HKLM\..\Run: [DaemonTools_WhenUSaveNow_Installer] C:\Program Files\DaemonTools_WhenUSaveNow_Installer\DaemonTools_WhenUSaveNow_Installer.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [f89247e9.exe] C:\Documents and Settings\Owner\Local Settings\Application Data\f89247e9.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} - http://cabs.media-motor.net/cabs/joysavsht.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O20 - AppInit_DLLs: repairs303169590.dll,logonui.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\IA\command.exe
O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\626_101new.exe
C:\ac3_0003.exe
C:\dfndre_5.exe
C:\drsmartload1.exe
C:\drsmartload45y.exe
C:\drsmartload45z.exe
C:\drsmartload46y.exe
C:\drsmartload46z.exe
C:\drsmartload849a.exe
C:\drsmartload849y.exe
C:\drsmartload849z.exe
C:\installerwnusnew.exe
C:\kybrde_5.exe
C:\MTE3NDI6ODoxNgnew.exe
C:\NNSCAA638.EXE
C:\nwnme_5.exe
C:\RDFX4.exe
C:\SS1001new.exe
C:\stub_113_4_0_4_0new.exe
C:\VSL.dl_
C:\warebundle2.exe
C:\warebundlenew.exe
C:\Documents and Settings\cubix\Local Settings\Temp\cmdinst.exe
C:\Documents and Settings\cubix\Local Settings\Temp\f145921.exe
C:\Documents and Settings\cubix\Local Settings\Temp\f152187.exe
C:\Documents and Settings\cubix\Local Settings\Temp\f152937.exe
C:\Documents and Settings\cubix\Local Settings\Temp\f607140.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\f89247e9.exe
C:\Documents and Settings\Owner\Local Settings\Temp\temp.fr306D
C:\Documents and Settings\Owner\Local Settings\Temp\temp.fr81D2
C:\Documents and Settings\Owner\Local Settings\Temp\temp.frC132
C:\Program Files\DaemonTools_WhenUSaveNow_Installer\DaemonTools_WhenUSaveNow_Installer.exe
C:\Program Files\Mozilla Firefox\plugins\npzango.dll
C:\Program Files\NetPumper\ZM\NP_0020_1.exe
C:\WINDOWS\cfg32s.dll
C:\WINDOWS\MTE3NDI6ODoxNg.exe
C:\WINDOWS\v1201.exe
C:\WINDOWS\IA\command.exe
C:\WINDOWS\system32\akgb5353.dll
C:\WINDOWS\system32\ckgb5355.dll
C:\WINDOWS\system32\ddband.dll
C:\WINDOWS\system32\dglphimm.dll
C:\WINDOWS\system32\dmonwv.dll
C:\WINDOWS\system32\f89247e9.exe
C:\WINDOWS\system32\logonui.dll
C:\WINDOWS\system32\rrcss.dll
C:\WINDOWS\system32\sndoclc.dll
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\uvdmxfrm.dll
C:\WINDOWS\system32\w1c18f38.dll
C:\WINDOWS\system32\w1c2135c.dll
C:\WINDOWS\system32\winrkp32.dll
C:\WINDOWS\system32\dllcache\win32\csrss.exe
C:\WINDOWS\system\DRIVER\ntuser.exe
C:\WINDOWS\system\DRIVER\setup.bat
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\626_101new.exe <<=== Delete the File
C:\ac3_0003.exe <<=== Delete the File
C:\dfndre_5.exe <<=== Delete the File
C:\drsmartload1.exe <<=== Delete the File
C:\drsmartload45y.exe <<=== Delete the File
C:\drsmartload45z.exe <<=== Delete the File
C:\drsmartload46y.exe <<=== Delete the File
C:\drsmartload46z.exe <<=== Delete the File
C:\drsmartload849a.exe <<=== Delete the File
C:\drsmartload849y.exe <<=== Delete the File
C:\drsmartload849z.exe <<=== Delete the File
C:\installerwnusnew.exe <<=== Delete the File
C:\kybrde_5.exe <<=== Delete the File
C:\MTE3NDI6ODoxNgnew.exe <<=== Delete the File
C:\NNSCAA638.EXE <<=== Delete the File
C:\nwnme_5.exe <<=== Delete the File
C:\RDFX4.exe <<=== Delete the File
C:\SS1001new.exe <<=== Delete the File
C:\stub_113_4_0_4_0new.exe <<=== Delete the File
C:\VSL.dl_ <<=== Delete the File
C:\warebundle2.exe <<=== Delete the File
C:\warebundlenew.exe <<=== Delete the File
C:\Documents and Settings\cubix\Local Settings\Temp\cmdinst.exe <<=== Delete the File
C:\Documents and Settings\cubix\Local Settings\Temp\f145921.exe <<=== Delete the File
C:\Documents and Settings\cubix\Local Settings\Temp\f152187.exe <<=== Delete the File
C:\Documents and Settings\cubix\Local Settings\Temp\f152937.exe <<=== Delete the File
C:\Documents and Settings\cubix\Local Settings\Temp\f607140.exe <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Application Data\f89247e9.exe <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\temp.fr306D <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\temp.fr81D2 <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\temp.frC132 <<=== Delete the File
C:\Program Files\DaemonTools_WhenUSaveNow_Installer\DaemonTools_WhenUSaveNow_Installer.exe <<=== Delete the File
C:\Program Files\Mozilla Firefox\plugins\npzango.dll <<=== Delete the File
C:\Program Files\NetPumper\ZM\NP_0020_1.exe <<=== Delete the File
C:\WINDOWS\cfg32s.dll <<=== Delete the File
C:\WINDOWS\MTE3NDI6ODoxNg.exe <<=== Delete the File
C:\WINDOWS\v1201.exe <<=== Delete the File
C:\WINDOWS\IA\command.exe <<=== Delete the File
C:\WINDOWS\system32\akgb5353.dll <<=== Delete the File
C:\WINDOWS\system32\ckgb5355.dll <<=== Delete the File
C:\WINDOWS\system32\ddband.dll <<=== Delete the File
C:\WINDOWS\system32\dglphimm.dll <<=== Delete the File
C:\WINDOWS\system32\dmonwv.dll <<=== Delete the File
C:\WINDOWS\system32\f89247e9.exe <<=== Delete the File
C:\WINDOWS\system32\logonui.dll <<=== Delete the File << We want to delete the .dll not the .exe!
C:\WINDOWS\system32\rrcss.dll <<=== Delete the File
C:\WINDOWS\system32\sndoclc.dll <<=== Delete the File
C:\WINDOWS\system32\taskmgr.exe <<=== Delete the File
C:\WINDOWS\system32\uvdmxfrm.dll <<=== Delete the File
C:\WINDOWS\system32\w1c18f38.dll <<=== Delete the File
C:\WINDOWS\system32\w1c2135c.dll <<=== Delete the File
C:\WINDOWS\system32\winrkp32.dll <<=== Delete the File
C:\WINDOWS\system32\dllcache\win32\csrss.exe <<=== Delete the File
C:\WINDOWS\system\DRIVER\ntuser.exe <<=== Delete the File
C:\WINDOWS\system\DRIVER\setup.bat <<=== Delete the File

C:\WINDOWS\Temp\TMP000000383B1C67F0F761D082 <<=== Delete the Folder
C:\WINDOWS\Temp\TMP00000041E2C61BEA02E1A172 <<=== Delete the Folder
C:\WINDOWS\Temp\TMP0000004FC8EDF485FEC1807C <<=== Delete the Folder
C:\WINDOWS\Temp\TMP00000054B6D3682D3EAE8457 <<=== Delete the Folder
Click to expand...

Using the Search function in the Start Menu; search for repairs303169590.dll; delete every occurance.

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

Kizer · Jul 19, 2006

Thank you from the bottom of my heart. Thank you for your time, effort and enourmous help. My computer is back up and running. Oh yeah, almost forgot to mention that the rest of the problems were handeled by a friend of mine, so no worries. Many many thanks.

Log in or Sign up

need some help

Kizer Private E-2

Kizer Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

Kizer Private E-2

Attached Files:

BDSCAN.txt

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

Kizer Private E-2