Oleext32.dll

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Peoma, Aug 1, 2005.

  1. Peoma

    Peoma Private E-2

    I got this virus and i have no idea what to do.. Heres my hijack log Hijack log

    thanks!
     

    Attached Files:

  2. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

  3. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Here are *some* items to remove anyhow, though I would prefer at a minimum, you go to safe mode and do a complete scan as you have multiple trojans, then run Hijack this, from safe mode as well, and remove these if they still exist.

    C:\WINDOWS\System32\msole32.exe
    C:\WINDOWS\System32\shnlog.exe
    C:\WINDOWS\System32\intell32.exe
    C:\WINDOWS\System32\intmon.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oneclicksearches.com/bar.html search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oneclicksearches.com/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
    O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hp9BB1.tmp
    O3 - Toolbar: MSN Verktygslåda - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar\01.01.1629.0\sv\msntb.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program\Norton AntiVirus\NavShExt.dll (file missing)
    O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
     
  4. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Peoma,

    After you fix the entries with HJT that MA requested please follow the below steps:


    Download this trial version of Ewido Security Suite

    • Install ewido security suite
    • Launch ewido, there should be an icon on your desktop double-click it.
    • The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
    • After it completes the update, click the Scanner button

    Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

    Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

    Open up Ewido and do the following:


    • Click on Scanner
    • Then click Settings
    • Under What to Scan? Select Scan every file
    • Then click OK
    • Click on Complete System Scan and the scan will start.
    • Let the program scan the machine
    While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

    Once the scan has completed, there will be a button located on the bottom of the screen named Save report


    • Click Save report
    • Save the report to your desktop or anyplace you will be able to find it to upload here.
    Reboot into normal mode and reconnect to the internet.

    Come back here and post the Ewido Scan Report along with a fresh HJT log!
     
  5. Peoma

    Peoma Private E-2

    OK now i have scanned my computer and it did find some trojans and so on.. i did the hijack search in safe mode and the scan too Heres the attachments

    Thanks for the help sofar!!!!!
     

    Attached Files:

  6. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please attach a fresh HJT log from normal mode not Safe Mode as not as processes are running.
     
  7. Peoma

    Peoma Private E-2

    There you have a new one in normal mode
    :cool:
     

    Attached Files:

  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please uninstall Ewido as it will block parts of this fix. Also you need to disable any antispyware and antivirus programs you have so they will not block any of this fix either!

    Please look in Add or Remove Programs for the following and Uninstall them if found:

    WildTangent


    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe

    O4 - HKLM\..\Run: [Winsockzz] snddrvx.exe
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe

    O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab

    O20 - Winlogon Notify: style2 - C:\WINDOWS\q4733205_disk.dll

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Navigate to and DELETE the following if they should remain:

    C:\Program Files\WildTangent ←–– Delete this whole folder if it exist!

    C:\WINDOWS\popuper.exe

    C:\WINDOWS\System32\intmonp.exe

    C:\WINDOWS\System32\msmsgs.exe

    snddrvx.exe ←–– Search for this file and delete when found!

    NEXT:
    Run CCleaner to clean up cookies and temp files.

    Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
    Note: Remember to get all updates before doing the scans.

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.


    Reboot to Normal Windows , Scan with HijackThis and attach the new log.
     
  9. Peoma

    Peoma Private E-2

    I get a explorer.exe problem all the time so it´s kinda annoying. Heres the log
     

    Attached Files:

  10. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your HJT log is clean, are you having any further Malware problems?

    For the error you mentioned I would recommend posting this in the software forum.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds