Netfixer Pop-Up

The steps in the link that brought you here will fix your problems too. You just need to substitute in your info in place of what was use in that thread. If you feel up to the challenge of doing it on your own, below are some pointers. if you cannot figure it out, let me know and I will work up a procedure for you.

Your DLL file is: vtstr.dll

Your HijackThis lines to Fix are:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\system32\vtstr.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O20 - Winlogon Notify: vtstr - C:\WINDOWS\system32\vtstr.dll


Your registry key name is vtstr
This is what you put in the below entry inplace of vtutr
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtutr]


The files to delete with killbox are:
C:\WINDOWS\system32\rtstv.ini
C:\WINDOWS\system32\rtstv.ini2
C:\WINDOWS\system32\rtstv.bak
C:\WINDOWS\system32\rtstv.bak2
C:\WINDOWS\system32\rtstv.tmp
C:\WINDOWS\system32\vtstr.dll

 

I thought you read thru the other thread. It is all covered there (including Pocket Killbox). Just fixing the lines with HJT will not fix the Virtumundo problem. Steps like the other thread are necessary. We can work up a fix for you, however, the first thing that must be done is to work through ALL the steps below and then to post (as an attachment) a current HJT log:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

We do not recommend using those hosts files that basically ban the Internet. They are not really of much use because any of the smarter malware programs (and there are many of them) will just change your hosts file to what they want anyway. Even if you make it READ ONLY, they will remove the READ ONLY and change it. Plus if you put literally hundreads if not thousands of lines in your hosts file, you will never be able to ID the one or two lines that a piece of malware may have inserted there. The best thing to do is to make you hosts file the default and then you always can easily tell if it has been changed. The below application can do this for you.


Download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster
• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program

You did not post the HJT log I requested that you post after running the READ ME FIRST. I need it to work up a fix.

 

I'm sorry about that! I did not even see it. But I would like a new one now after running Hoster. But wait until you do the below too before posting a new HJT log.

And while your problem is very similar to the one in the link you gave below, it is not exactly the same. And the fix must be exact. You can run the steps in that link relating to the CWShredder service.

 

Okay let's get start on the Virtumundo problem by downloading two tools we will need:

- Process Explorer 9.2

- Pocket KillBox

Extract them to there own folder somewhere that you will be able to locate them later.

Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of vtstr.dll once and then click the kill button. After you have killed all of the vtstr.dll under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of vtstr.dll and kill it.

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\system32\vtstr.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O20 - Winlogon Notify: vtstr - C:\WINDOWS\system32\vtstr.dll

Copy the bold text below to notepad. Save it as fixVundo.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.


C:\WINDOWS\SYSTEM32\rtstv.ini
C:\WINDOWS\SYSTEM32\rtstv.ini2
C:\WINDOWS\SYSTEM32\rtstv.bak
C:\WINDOWS\SYSTEM32\rtstv.bak1
C:\WINDOWS\SYSTEM32\rtstv.bak2
C:\WINDOWS\SYSTEM32\rtstv.tmp
C:\WINDOWS\SYSTEM32\vtstr.dll

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

 

You probably had a lot of temp file too clean.

Your Virtumundo problems is fixed. You should be able to tell the difference already. How is it working?

 

Great! So now your learned a few things too!

Yes! Enable System Restore and make sure you work thru the below to help keep you clean.

How to Protect yourself from malware!

 

MS Java is no longer supported and full of security wholes. You need to remove it. There will be time when you need to use IE. Many sites (especially Microsoft) require it.

 

You're welcome! Glad to hear you got everything you need. Surf safely!