Please help..no one else will

Discussion in 'Malware Help (A Specialist Will Reply)' started by stooge, Mar 22, 2005.

  1. stooge

    stooge Private E-2

    After posting onto 2 other sites with no responce i am getting frustrated by it all.I think i have VirtualMaid and ISTbar (istsvc) as well as yoursearch.cc pop ups coming up constantly.
    Id really appreciate help with this folks..
    heres my hijack this log..


    Logfile of HijackThis v1.99.1
    Scan saved at 00:01:57, on 22/03/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


    Edit by chaslang: Unrequested inline log removed
     
    Last edited by a moderator: Mar 22, 2005
    stooge, Mar 22, 2005
    #1
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Welcome To MajorGeeks.Com!

    We have guidelines that must be followed so we can best assist you.

    First:
    Please download and run the following removal tool:

    Second:
    Please close all browsers and any unnecessary programs while using HJT.
    • C:\Program Files\Internet Explorer\iexplore.exe

    Third:

    Please follow ALL the steps in this sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Fourth:

    After doing ALL of the above, reboot and attach a new HJT log as an attachment to your post using the Manage Attachments feature. Please do NOT post your log inline like you did the last time as they will be removed.

    Good Luck!:)
     
    bjgarrick, Mar 22, 2005
    #2
  3. stooge

    stooge Private E-2

    Ooops...sorry for the big hijack this log post,my mistake.Advise looks great..now i gotta get home from work and do it all.il post soon.Thanks again :D :)
     
    stooge, Mar 22, 2005
    #3
  4. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your welcome, I will have the log converted into an attachment for you, just be sure to attach the next one as an attachment. :p

    Good Luck!:)

    I will be awaiting your resutls and new HJT log.
     
    bjgarrick, Mar 22, 2005
    #4
  5. stooge

    stooge Private E-2

    Ran all guides and all scans.Nothing came up.. :(
     

    Attached Files:

    stooge, Mar 22, 2005
    #5
  6. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Are you familiar with UltraVNC?


    Scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe

    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)

    Are you familiar with this entry? If so leave it as is, if not have HJT fix it.

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NEXT:
    Run CCleaner and Spybot S&D and have Spybot fix what it finds.
    Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin

    And Click OK.


    Reboot, Scan with HijackThis and attach the new log.
     
    bjgarrick, Mar 22, 2005
    #6
  7. stooge

    stooge Private E-2

    I did everything you said.
    UltraVnc and fdireland are working programmes on my pc so they are ok.
    Spybot S&D didnt find anything,and yes i did a update before it.
    heres the next log anyways..
     

    Attached Files:

    stooge, Mar 22, 2005
    #7
  8. stooge

    stooge Private E-2

    What will i do next?i hope my post isnt just going to die :confused:
     
    stooge, Mar 23, 2005
    #8
  9. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Log looks ok to me, Are you currently having any further problems?
     
    bjgarrick, Mar 23, 2005
    #9
  10. stooge

    stooge Private E-2

    Im at work at the moment but this morning i checked before i left.Im still having issues..i also noticed that 3 icons appeared on my desktop.a dating one,online pharmacies and a anti spyware.Obviously i check my add/remove..nothing there.Im quite stumped by this as nothing seems to be showing in scans!
    Il check again as soon as i get home.
    Appreciate all the help by the way :)
     
    stooge, Mar 23, 2005
    #10
  11. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please download "StartDreck", from here: http://www.niksoft.at/_data/startdreck.zip

    Unzip to its own folder and start the program,
    Press 'Config'
    Press 'Unmark All'
    Check the following boxes only:
    Registry -> Run Keys
    System/drivers> Running processes
    Press 'Ok'
    Press 'Save' and select the location to save the log file
    (default is the same folder as the application)

    Please attach the log in this thread.
     
    bjgarrick, Mar 23, 2005
    #11
  12. stooge

    stooge Private E-2

    Here you go :)
     

    Attached Files:

    stooge, Mar 23, 2005
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Since BJ is not around, I will see if I can help you out. The StartDreck log showed nothing.

    Do you use both MSN Messenger and Windows Messenger?

    Please do the following to setup Windows Search and run a search for msmsgs.exe

    How to use windows XP search mechanism to look for hidden files:
    If you use Search, you need to do the following:
    Click Search and the Select "All files and folders"
    Enter the filename in the "All or part of the file name:" box, so enter msmsgs.exe
    Now select "More advanced options"
    Make sure the following check boxes are checked:
    - Search system folders
    - Search hidden files and folders
    - Search subfolders
    Then click the Search button.

    Tell me all the matches you get.


    Also please get some Properties, Version and Company information on the below file:

    C:\WINDOWS\system32\helper.exe

    Locate it with Windows Explorer and right click on it. Select Propeties and then the Version tab. Go thru the list of Item names and see what you can find.
     
    Last edited: Mar 24, 2005
    chaslang, Mar 23, 2005
    #13
  14. stooge

    stooge Private E-2

    I noticed that myself about messenger and msn.Then when i started turning on my pc msn and messenger would start up for somereason!?
    So i removed them from my add/remove and reinstalled msn and its seems to have gotten rid of instantsearch.cc pop ups.I also found two files within system32...msmsgs.exe or msmsg.exe and .ini file which when you open it had
    [http://www.instantsearch.cc/text/online_gambling.html]
    [http://www.instantsearch.cc/text/computer_dating.html]
    [http://www.instantsearch.cc/text/online_pharmacy.html]
    [http://www.instantsearch.cc/text/pop_up
    ...and so forth.Deleted them in safe mode and its gone now.
    Now i only have yourquicksearch.com toolbar popup to get rid of! lol

    but what you said about that helper file within system32.i think thats it.its all deleted anyway..just gotta wait and see!
    Thanks for stepping up by the way,appreciate it! :)
     
    stooge, Mar 24, 2005
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome! So can I assume you're in good shape now?

    Look in the Tools, Manage Add-ons area of IE to see if there is anything in there related to that tool bar.
     
    chaslang, Mar 24, 2005
    #15
  16. stooge

    stooge Private E-2

    Well im in work now but i have a good feeling that it should be all clear!i left the pc running so when i get home il see if a have anypop ups...pray...
    And may i add..majorgeeks were the only site out of 3 that would respond to my issue.Great job guys!Thanks a million for all the help and advice!
    Just hope you dont hear back from me again or i still have that feckin popup!!!!
    :D :p
     
    stooge, Mar 24, 2005
    #16
  17. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    bjgarrick, Mar 24, 2005
    #17
  18. stooge

    stooge Private E-2

    Home to see that everything is clear and no pop ups!!
    Thank you so so much for all your help..im now going to change to firefox!!!
    Your site is in my favorites now :p
    cheers :D
     
    stooge, Mar 24, 2005
    #18
  19. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Good Deal!:)

    You should see Chaslang's Commandments!

    Browse Safely!
     
    bjgarrick, Mar 24, 2005
    #19

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds