persistent hijacking

quester · Apr 2, 2006

Have run the various anti-spyware programs etc. and attached advised logs. Hope you can see what the problem is with the persistence of hijacking sites which just started about 2 days ago. Seem to be only popping up every 15-20 minutes or so now but expect that will increase. Have blocked various sites specifically via my firewall (Kerio) also but seem to get through anyway.
As you can see the NewDotNet spyware persists but that has been on my computer a long time without hijacking incidents. Spybot can't seem to remove it for some reason.
Don't know if you will see my problem in these logs but either way this is a tremendously impressive site. Thank you for all the info.

chaslang · Apr 2, 2006

Welcome to Majorgeeks!

You need to attach your HijackThis log! Not the executable program for HijackThis.

Also that is not the correct Bitdefender log. Follow step 6 exactly as written or you will not get the correct log. What you posted is a summary which does not help us.

quester · Apr 3, 2006

Hopefully this will correct the hijack this log. I ran Bitdefender again but all that is shown to me after "click here to view the report" is this summary message-no log. Have they changed format recently on this site?? because I sure can't find it under "details" or anywhere else on the Bitdefender results?

quester · Apr 3, 2006

Perhaps this is the bitdefender log now attached?? just looked like html to me?

chaslang · Apr 3, 2006

quester said:

Perhaps this is the bitdefender log now attached?? just looked like html to me?
Click to expand...

Yes and that is exactly what it says in step 6:

Then save it to your Desktop or anywhere else you can find it to upload here as an attachment. When the procedure is followed you will be attaching a full log an HTML formatted file but it will have a .txt file extension so it can be uploaded as an attachment. If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us.
Click to expand...

No please follow the directions in step 7 to install HijackThis properly. You are running it from:
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

This means you are running it directly from the ZIP file which we specifically ask that you not do. You must fix this now before we can continue.

Also answer a question! When you obtained the HijackThis log did you have any program installations in progress that you had not completed? Or did you not reboot your PC after installing a few applications that may have needed a reboot?

Now run the procedure in the below and attach the requested vundofix log:

Virtumonde aka Trojan Vundo Removal

Now make sure HJT is installed correctly per step 7. And then fix all of the O18 lines like the below from Logitech Desktop Messenger:
O18 - Protocol: bw+0 - {C57B3772-8114-470E-BCA7-E5FCED77E898} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

Now attach a new HJT log.

quester · Apr 3, 2006

Okay, HOPEFULLY, this is somewhat right this time i.e. scanned from proper HJT location and extracted files etc. As to question whether first HJT scan was done while installing other program I do not believe so but I did have a browser open to this site. Made sure browser and everything off this time for scan. Possible that did not do a reboot somewhere that I should have also. I do apologize for not doing these things properly the first time but am still striving to do so.....
As you will see per its log I ran the VundoFix twice. This was because it would not upload for some reason as an attachment and I thought possibly the file had become corrupt or something. It kept totally locking up everytime I would try to upload..not sure what problem was.
Question - Concerning the 018 lines from the first HJT log..is it Logitech that is actually malware or a weakness or is it just that the hijackers use Logitech lines to hide their own protocols?

chaslang · Apr 4, 2006

quester said:

Question - Concerning the 018 lines from the first HJT log..is it Logitech that is actually malware or a weakness or is it just that the hijackers use Logitech lines to hide their own protocols?
Click to expand...

No Logitech is not malware! They just have some bugs in there program causing it to make these entries into your registry over and over again. Also, in reality most people do not really even want this program to run. You could/should disable it but that is your decision.

I'm looking at your log now (I see you online).

chaslang · Apr 4, 2006

Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wowt.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [LDM] \Program\
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\asdf.exe
C:\Documents and Settings\Owner\My Documents\NNuninstall.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.

Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

quester · Apr 4, 2006

Well, things seem to be working very well but I am puzzled as to why I can not get the line O4 - HKCU\..\Run: [LDM] \Program\
to stay out of the HJT log. Have gone through the safe mode-reboot-normal mode process twice and each time it reappears in the HJT log despite being "fixed" with the HJT program.
I also uninstalled the Webroot Spysweeper program that I had dallied with in the afternoon because now this A.M it kept popping up while trying to re-boot from safe mode to normal mode. Have run everything over again since uninstalling it however: safe mode, Ccleaner, prefetch emptying, and re-setting web settings, reboot to normal mode, new HJT log. Should I run it yet again to try and fix this re-appearing 04-HKCU line?

chaslang · Apr 4, 2006

First a question! Why are you using msconfig?
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

You must not use this while we are fixing problems (unless we ask for it to be used during a fix). Select Normal Startup.

That O4 line is probably coming back due to the below unnecessary process loading:
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

Read about it here: http://www.bleepingcomputer.com/startups/ldmconf.exe-2605.html
You can probably uninstall Logitech Desktop Messenger from Add/Remove programs to get rid of these two lines. (as long as you don't care about aut updates & personally I rather get updates myself)

You can also have HJT fix the below left over line from Spy Sweeper:
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

quester · Apr 4, 2006

The reason I was using msconfig to safe boot was because I'd thought that was the preferred way recommended by the link "http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam" instead of the F8 key...? Changed the system configuration general tab to select normal start up (not sure why that was ever changed??) prior to using F8 to safe boot, prefetch files deletion, CCleaner, Reset Web Settings, and then performing normal reboot again.
Removed Logitech desktop messenger and the left over spysweeper line prior to the rebooting procedure.
Have attached new HJT log so hopefully all is well! Will wait to disable System Restore etc. until hear from you.
Certainly is running nicely.

chaslang · Apr 4, 2006

quester said:

The reason I was using msconfig to safe boot was because I'd thought that was the preferred way recommended by the link "http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam" instead of the F8 key...?
Click to expand...

But HJT logs are to be from normal boot mode and at that time MSconfig should not be used.

Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

quester · Apr 5, 2006

Re: persistent hijacking IT"S FIXED THANKS!

Thank you for being my guide through the Amazon. Incredible site you offer here.

chaslang · Apr 5, 2006

Re: persistent hijacking IT"S FIXED THANKS!

You're welcome. Surf safely!

Log in or Sign up

persistent hijacking

quester Private E-2

Attached Files:

hijackthis.zip

pandaActivescan.txt

bitdefscan2.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quester Private E-2

Attached Files:

hijackthis.log

quester Private E-2

Attached Files:

bitdefscan1.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quester Private E-2

Attached Files:

VundoFix.txt

hijackthis2.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quester Private E-2

Attached Files:

hijackthis4.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quester Private E-2

Attached Files:

hijackthis5.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

quester Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member