Please help, malware/spyware remaining!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Comptroller, Nov 8, 2006.

  1. Comptroller

    Comptroller Private E-2

    Hello

    I've been through the 'Read & Run Me First' thread & followed all stages. I have attached logs for Bitdefender, Panda Active Scan, GetRunKey, and will attach ShowNew and HiJackThis logs to next post.

    I was hit by a huge amount of popups, error messages and the like, all at the same time, including fake explorer messages and speech-bubble shaped messages from taskbar selling software. My homepage was changed, browser windows would reload as different pages, and my computer was running really slowly as a result of all this activity.

    After running all the processes listed in the 'Read & Run Me First' thread, now problems are narrowed down to the following:

    • Pop-ups while online. Examples as follows: "Data Execution Prevention", "Spyware Removal Wizard", "Attention! Virus Detected", "Buffer overrun detected", fake explorer window selling SpyProtect.
    • Computer running slightly slower than usual

    Big improvement, but there still must be something there. Please advise me on what I should do next!

    System specs are as follows:

    Microsoft Windows XP Professional, version 5.1.2600, Service Pack 2.
    System Memory: 256 MB (PC133 SDRAM)
    CPU Type: Intel Pentium IIIE, 1000 Mhz (7.5 x 133)



    Thanks in advance.
     

    Attached Files:

  2. Comptroller

    Comptroller Private E-2

    ShowNew and HiJackThis logs attached.
     

    Attached Files:

  3. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please look in Add/Remove Programs for the following and uninstall them if found:

    VSAdd-in

    VirusBursters

    ipwins


    Now scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.microsoft.com/i sapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - C:\WINDOWS\system32\ixt0.dll (file missing)
    O2 - BHO: (no name) - {3D8C0C6A-75C7-5DF8-3D05-0174E7C24A35} - C:\WINDOWS\system32\qofkurh.dll
    O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
    O2 - BHO: (no name) - {5D3217AB-3E82-190D-F29A-0BC237A74CA9} - C:\WINDOWS\system32\hxouymn.dll
    O2 - BHO: (no name) - {9ED51E33-38D3-41AF-96D5-C435717A4A24} - C:\WINDOWS\system32\hggeb.dll
    O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\iusmfssa.dll
    O2 - BHO: (no name) - {F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} - C:\WINDOWS\system32\cbxxwtq.dll

    O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvceh.dll,startup
    O4 - HKLM\..\Run: [qgfvyxb.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\qgfvyxb.dll,cefxmwc
    O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
    O4 - HKLM\..\Run: [bkhqrrj.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\bkhqrrj.dll,esnbyag
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot

    O15 - Trusted Zone: http://www.asuapplications.co.uk (HKLM)

    O20 - Winlogon Notify: cbxxwtq - C:\WINDOWS\SYSTEM32\cbxxwtq.dll
    O20 - Winlogon Notify: hggeb - C:\WINDOWS\system32\hggeb.dll
    O20 - Winlogon Notify: winafg32 - C:\WINDOWS\SYSTEM32\winafg32.dll

    O23 - Service: sgbx_device - Sagem - C:\WINDOWS\system32\sgbxcoms.exe

    Again, make sure ALL browser windows are closed when you click FIX.

    Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

    C:\WINDOWS\Temp Delete everything in this folder!

    C:\Program Files\ipwins Delete this whole folder if it exist!

    C:\Program Files\VSAdd-in Delete this whole folder if it exist!

    C:\Program Files\VirusBursters Delete this whole folder if it exist!

    Next, run CCleaner to clean up cookies and temp files.

    NOW:
    Click Start > Run > type services.msc and Click OK

    Locate sgbx_device - Sagem and RightClick on it to bring up the Service Properties Window.
    First: Stop the service by clicking the Stop Button.
    Next: Disable it by changing the Startup Type to Disabled and click Apply

    Locate PocketKillbox
    (Procede with this step even if they do not show in blue)

    Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

    ** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

    • If you get an error message about Pending Operations, just reboot your computer manually.

    After you complete the above, REBOOT and proceed with the rest of this fix...

    Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

    • Disable and Re-enable System Restore

    • Turn OFF System Restore to flush any bad Restore Points.

    • Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.
    After you complete the above reboot once more and then scan with HijackThis and attach the new log.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now. Also, please attach a fresh HJT log.
     
  4. Comptroller

    Comptroller Private E-2

    Thanks for the help!

    I ran through the above. Only minor problems:

    • No Virusbursters or ipwins in Add / Remove Programs menu
    • O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll did not appear in HiJackThis scan so I couldn't select it
    • O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll did not appear in HiJackThis scan so I couldn't select it
    • sgbx_device was already stopped and disabled

    So far no more pop-ups or anything like that, so it's looking good. I have attached the new HiJackThis log.

    Please let me know if you see anything else that needs to be dealt with.
     

    Attached Files:

  5. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial.

    Now scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    O2 - BHO: (no name) - {09F881B0-C45C-410A-8D75-3DCF9C6F8961} - C:\WINDOWS\system32\hggeb.dll
    O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\tpdjygvh.dll
    O2 - BHO: (no name) - {F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} - C:\WINDOWS\system32\cbxxwtq.dll

    O20 - Winlogon Notify: cbxxwtq - C:\WINDOWS\SYSTEM32\cbxxwtq.dll
    O20 - Winlogon Notify: hggeb - C:\WINDOWS\system32\hggeb.dll
    O20 - Winlogon Notify: winafg32 - C:\WINDOWS\SYSTEM32\winafg32.dll

    Again, make sure ALL browser windows are closed when you click FIX.

    Next, run CCleaner to clean up cookies and temp files.

    Locate PocketKillbox
    (Procede with this step even if they do not show in blue)

    Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

    ** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

    • If you get an error message about Pending Operations, just reboot your computer manually.

    Once you complete the above, reboot once more and attach a fresh HJT log.
     
  6. Comptroller

    Comptroller Private E-2

    Okay, carried out above. Only one problem:

    • O2 - BHO: (no name) - {09F881B0-C45C-410A-8D75-3DCF9C6F8961} - C:\WINDOWS\system32\hggeb.dll wasn't listed in HiJackThis scan so I couldn't select it

    Everything else went fine.

    However, when I rebooted my computer for the second time (after deleting those files using Killbox) a message popped up from my antivirus software (AVG Resident Shield) saying:

    "C: DOCUME~1\User\LOCALS~1\Temp\hxmplncj.dll
    Trojan horse Generic2.GGN"

    Also, when I went online there was a pop-up that tried to run a control / download something & was blocked by security controls.

    I have attached latest HiJackThis log as requested. Please advise!
     
  7. Comptroller

    Comptroller Private E-2

    HiJackThis log attached here! Sorry.
     

    Attached Files:

  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Okay let's start by downloading two tools we will need:

    - Process Explorer 10.21

    - Pocket KillBox

    Extract them to there own folder somewhere that you will be able to locate them later.

    Reboot in Safe Mode (do not open any other processes)

    - Run Process Explorer

    In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

    Once you see this screen click on each instance of hggeb.dll & cbxxwtq.dll once and then click the kill button. After you have killed all of the hggeb.dll & cbxxwtq.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

    Next double click on explorer.exe and again click once on each instance of hggeb.dll & cbxxwtq.dll and kill it.

    Now just exit Process Explorer.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {F5260DD4-0F42-4D4D-B05F-ADC6A3D1A2E9} - C:\WINDOWS\system32\hggeb.dll
    O2 - BHO: (no name) - {F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} - C:\WINDOWS\system32\cbxxwtq.dll

    O20 - Winlogon Notify: cbxxwtq - C:\WINDOWS\SYSTEM32\cbxxwtq.dll
    O20 - Winlogon Notify: hggeb - C:\WINDOWS\system32\hggeb.dll
    O20 - Winlogon Notify: winafg32 - winafg32.dll (file missing)


    Now run Pocket Killbox:
    Choose Tools > Delete Temp Files and click OK.

    Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.


    C:\WINDOWS\SYSTEM32\qtwxxbc.ini
    C:\WINDOWS\SYSTEM32\qtwxxbc.ini2
    C:\WINDOWS\SYSTEM32\qtwxxbc.bak
    C:\WINDOWS\SYSTEM32\qtwxxbc.bak1
    C:\WINDOWS\SYSTEM32\qtwxxbc.bak2
    C:\WINDOWS\SYSTEM32\qtwxxbc.tmp
    C:\WINDOWS\system32\cbxxwtq.dll

    C:\WINDOWS\SYSTEM32\beggh.ini
    C:\WINDOWS\SYSTEM32\beggh.ini2
    C:\WINDOWS\SYSTEM32\beggh.bak
    C:\WINDOWS\SYSTEM32\beggh.bak1
    C:\WINDOWS\SYSTEM32\beggh.bak2
    C:\WINDOWS\SYSTEM32\beggh.tmp
    C:\WINDOWS\system32\hggeb.dll

    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    After reboot post a new HJT log.
     
    Last edited: Nov 9, 2006
  9. Comptroller

    Comptroller Private E-2

    Carried out all above steps. A couple of issues I should mention:

    • Could not find entry O2 - BHO: (no name) - {F5260DD4-0F42-4D4D-B05F-ADC6A3D1A2E9} - C:\WINDOWS\system32\hggeb.dll . However, there was an entry 02 - BHO: (no name) - {02281946-2254-40E5-A5A3-45DC0AE973D3} - C:\WINDOWS\system32\hggeb.dll. I went ahead and selected this for fixing, since the end file name was the same as the one in the given list. This may have been a bit reckless of me, hopefully it's ok?
    • After all stages were carried out & I rebooted, an AVG window popped up saying "VIRUS DETECTED, C:\WINDOWS\system32\clkmfqcy.dll, Trojan horse Generic2.GGN". I selected the 'Heal' option and it said it had been successfully healed.

    I have attached the latest HJT log. Does it look like more work is required? Thanks for all your help so far!
     

    Attached Files:

  10. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\clkmfqcy.dll

    Locate PocketKillbox
    (Procede with this step even if they do not show in blue)

    Now, Copy and Paste C:\WINDOWS\system32\clkmfqcy.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

    • If you get an error message about Pending Operations, just reboot your computer manually.

    After you complete this post reboot a few times and attach a fresh HJT log.
     
  11. Comptroller

    Comptroller Private E-2

    Hello

    Ran through all of above, no problems. HiJackThis log attached.

    Could this be the end?
     

    Attached Files:

  12. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Yes, your log looks good.

    Are you having any further problems?
     
  13. Comptroller

    Comptroller Private E-2

    No further problems, everything seems to be back to normal.

    Once more, I thank you for your invaluable assistance. :)
     
  14. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds