Okay...this is weird

Just a dropping a note to msbehavin. You should have followed the directions I gave you in message # 23 back in your previous problem thread: http://forums.majorgeeks.com/showthread.php?t=56632

You never followed those steps. You still do not have a real firewall.

Also note: you have not recently run the READ ME FIRST. No signs of the online scanners are showing.

 

BJ is correct.

msbehavin, see the note at the end of step 3 in the How to Protect thread.

Which online scanners do you think you ran? None of them seem to have been run.

 

BJ,

A suggestion to try and make some headway here. Ignore the nail/aurora problem for now. Also the VX2 infection seems to be some what hidden from HJT's perspective but it does seem to be very bad. Also ignore it for the moment.

First focus on the below items and give msbehavin a fix for these. Hopefully they get fixed and do not return. If they do come back, I would install a real firewall first (and disable Win XP SP2's firewall) and then repeat fixes.

Here is what I would fix first:

C:\WINDOWS\system32\wintask.exe
C:\WINDOWS\eyhfdll.EXE
C:\WINDOWS\lleyenc.EXE
c:\windows\system32\bpxggo.exe
C:\WINDOWS\htyesvc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [eyhfdll] C:\WINDOWS\eyhfdll.EXE
O4 - HKLM\..\Run: [lleyenc] C:\WINDOWS\lleyenc.EXE
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [icegzr] c:\windows\system32\bpxggo.exe r
O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\htyesvc.exe <----- this is Win32.Agent.mu Worm

 

Okay since BJ seems to be gone right now and msbehavin is back. Here is what I was asking BJ to have you fix first.

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to Windows VisFx Components Then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

Next, open up HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

Windows VisFx Components

You may be told to reboot at this point. Do not reboot just exit HijackThis and we will be restarting it with different options in a moment.


If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\system32\wintask.exe
C:\WINDOWS\eyhfdll.EXE
C:\WINDOWS\lleyenc.EXE
c:\windows\system32\bpxggo.exe
C:\WINDOWS\htyesvc.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [eyhfdll] C:\WINDOWS\eyhfdll.EXE
O4 - HKLM\..\Run: [lleyenc] C:\WINDOWS\lleyenc.EXE
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [icegzr] c:\windows\system32\bpxggo.exe r
O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\htyesvc.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:C:\WINDOWS\cfgmgr52.dll
C:\WINDOWS\dsr.dll
C:\WINDOWS\eyhfdll.EXE
C:\WINDOWS\lleyenc.EXE
C:\WINDOWS\htyesvc.exe
C:\WINDOWS\dinst.exe
C:\WINDOWS\system32\wintask.exe
c:\windows\system32\bpxggo.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


Now reboot in normal mode and post a new HJT log.

 

To help things keep moving a long for BJ do a few more things in the below order:

1) Run the Nail/Bolder/Aurora Remover 0.3.3 Beta tool again. See message # 4 for how to do this in safe mode.

2) Run the Panda Online Scan and attach the log once its complete.

3) Since it has been awhile since you were last here it would be a good idea to post a new HJT log to make sure things have not changed.

 

You HJT log must be from normal boot mode.

You have a load of things that should be removed from the Panda scan. Boot into safe mode and delete the below files and folders. Make sure you tell us what you can and could not delete.

C:\x.bat
C:\x.html
C:\TEMP\salm.log
c:\windows\system32\fvdues.exe
C:\WINDOWS\SYSTEM32\DrPMon.dll
C:\WINDOWS\SYSTEM32\winupdt.008
C:\WINDOWS\system32\bccnnnx.exe
C:\WINDOWS\system32\Cache\20001.exe
C:\WINDOWS\system32\Cache\dr.exe
C:\WINDOWS\system32\cngrqp.exe
C:\WINDOWS\system32\dffggga.dll
C:\WINDOWS\system32\fvdues.exe
C:\WINDOWS\system32\iroc\imaaalsl.exe
C:\WINDOWS\system32\jddnn.dll
C:\WINDOWS\SYSTEM32\CACHE\mswinstall.exe
C:\WINDOWS\a95kfrhe.exe
C:\WINDOWS\abiuninst.htm
C:\WINDOWS\cfgmgr52.ini
C:\WINDOWS\usta33.ini

C:\PROGRAM FILES\Aprps <--- the whole folder
C:\PROGRAM FILES\MySearch <--- the whole folder
C:\PROGRAM FILES\sf <--- the whole folder
C:\PROGRAM FILES\WeirdOnTheWeb <--- the whole folder
C:\WINDOWS\SYSTEM32\cache32dsrf4535dfs
C:\WINDOWS\EliteToolBar <--- the whole folder
C:\Program Files\3839ieoj <--- the whole folder
C:\WINDOWS\system32\ahxhkgwc <--- the whole folder

Additional step to delete files in the C:\WINDOWS\DOWNLOADED PROGRAM FILES folder. You have three there.
- Click Start, Run, and enter cmd in the box and click OK. This opens a commend prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\Downloaded Program Files\
attrib -r -h -s ActiveX.ocx
del ActiveX.ocx
cd CONFLICT.1
attrib -r -h -s HDPlugin1019.dll
del HDPlugin1019.dll
cd ..
cd CONFLICT.1
attrib -r -h -s HDPlugin1019.dll
del HDPlugin1019.dll
exit

Also look for the below!
C:\WINDOWS\system32\??anregw.exe <--- I am not sure what the ?? may actually show as so just look in this folder and tell us what you find that ends with "anregw.exe"

Do you know what this ASHeuristic folder is for?
C:\WINDOWS\Temp\ASHeuristic\imaaalsl.exe.vir
C:\WINDOWS\Temp\ASHeuristic\prsxt.exe.vir

Now reboot in normal mode and post a new Panda log. There was a trojan in your last log that we need to fix. Now move on to my next message.

 

Let's try the below steps to remove Nail.exe

- Click Start > Run and type: cmd and then click OK! This brings up a command prompt window.
- At the command prompt opens, type the below command and then hit the enter key:

nail.exe /FullRemove

Close the command prompt window and reboot.


I'm not sure if that trojan I mentioned will still be the same after doing any reboots but let's assume for now that it did not change and complete the steps below.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.

c:\windows\system32\uingzt.exe

After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50171
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O4 - HKLM\..\Run: [rtbvfty] c:\windows\system32\uingzt.exe r


After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\Nail.exe
c:\windows\system32\uingzt.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.


Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Do the below steps with no physical connection available (unplug your cable) and with no browsers running.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).


Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\DOCUME~1\Allison\LOCALS~1\Temp\XBT\aurareco.exe
C:\WINDOWS\system32\idjcwy.exe


After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [zzbgha] C:\WINDOWS\system32\idjcwy.exe r


After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\DOCUME~1\Allison\LOCALS~1\Temp\XBT\aurareco.exe
C:\WINDOWS\system32\idjcwy.exe
C:\WINDOWS\Nail.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.


Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.


Now reboot in normal mode and post a new HJT log. And tell us how things are working. Do not reboot or power down at this point!!!!!!

 

We are may have to use Pocket Killbox to delete the below items. Do you still have Pocket Killbox.

C:\WINDOWS\SYSTEM32\winupdt.bin
C:\TEMP\salmau.dat
C:\WINDOWS\Nail.exe
C:\WINDOWS\etb
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1019.dll
C:\WINDOWS\system32\idjcwy.exe
C:\WINDOWS\system32jddnn.dll
C:\windows\system32\fvdues.exe
C:\WINDOWS\SYSTEM32\DrPMon.dll
C:\WINDOWS\system32\bccnnnx.exe
C:\WINDOWS\system32\Cache\20001.exe
C:\WINDOWS\system32\cngrqp.exe
C:\WINDOWS\abiuninst.htm

 

Try using Killbox in safe mode. Use instructions like BJ gave you in message number 26 to delete files.

 

You had a particularly bad case of VX2 infection way back when BJ had you run L2MeFix in message # 4. There could be some stuff still hanging on. Let's do the below:

Download: Find It NT/2000/XP

Unzip the files in the zip to their own folder of your choice (like c:\Findit ) and run "find.bat" - Allow it as much time as it needs to run. You may get an error message of "File Not Found," but just let it go.

The tool should generate a long text file. Attach this log as an attachment to your post. This will not fix anything. It just looks for potential problem files.

Then also attach a new HJT log.

 

I also think we are going to need to have you complete step # 3 in: How to Protect yourself from malware! which you never did along time ago (Try ZoneAlarm). You need to get a real firewall installed and then disable the one in WinXP SP2 which does not provide adequate protection.

 

Did you get any notices from the firewall for processes like the be.low:

C:\WINDOWS\Nail.exe
C:\WINDOWS\dinst.exe
C:\WINDOWS\system32\icqxtoa.exe r

If so, they should not be allowed to have any access.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\dinst.exe <--- probably will not see this
C:\WINDOWS\system32\icqxtoa.exe

Let me know if any of these cannot be killed.

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [pstgbfj] C:\WINDOWS\system32\icqxtoa.exe r


After clicking Fix, exit HJT.
Boot into safe mode and do the below:

- Click Start > Run and type: cmd and then click OK! This brings up a command prompt window.
- At the command prompt opens, type the below command and then hit the enter key:

nail.exe /FullRemove

Close the command prompt window.

Let me know the results of running this nail fullremove command.


Now use Windows Explorer to delete:
C:\WINDOWS\Nail.exe
C:\WINDOWS\dinst.exe
C:\WINDOWS\system32\icqxtoa.exe

If you get an error when deleting a file, Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open HJT's process manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

This process C:\WINDOWS\system32\icqxtoa.exe showed in your previous HJT log as running and should have been there unless you had rebooted or powered down after posting your last log, You must not power down or reboot unless requested.

Did the nail.exe /full remove command give any response message at all?

When you say you deleted nail.exe but it still reappears, do you mean that it deletes but comes back? Or do you mean when you try to delete it you get an error message?

 

Looks like that trojan file ( C:\WINDOWS\system32\icqxtoa.exe ) is gone and has not reappeared in your log with a new name. At least not yet!

Do you see the C:\windows\nail.exe file if you look for it?