Ready to play James Bond?

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal
If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.


After doing ALL of the above if you still have a problem:

Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT

 

You have a VX2 infection. Download the below tools and only run what I indicate to run:

Pocket KillBox

VX2.BetterInternet Finder XP/2k - Version Msg126

Generic Find It Tool - NT/2000/XP


Extract all the files from the Generic Tool into its own folder.
Then run find.bat. Post the log it creates back here as an attachment.

 

What do you mean "three downloaded zip deleted"?

 

NOTE: DON'T LOG OFF! Stay here for awhile. I'm working on a fix but if you reboot, all of it will not work properly. I'll be posting it in a little while.

 

When working on problems like these you need to do only what we tell you to do. Running other things will confuse us, you, and your malware problems will mutate making our fixes ineffective. The below may no longer be complete valid now.


Please save these instructions locally so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files is Enabled as per the tutorial.

Copy and paste the information below to notepad. Save it to your Desktop as type "all files" and name it fixvx2.reg

Click on the fixvx2.reg file you made and allow it to merge the registry entries into the registry.

Here is a list of files that we need to delete using Killbox.

C:\WINNT\System32\gp86l3ls1.dll
C:\WINNT\System32\doserver.dll
C:\WINNT\System32\fplq0335e.dll
C:\WINNT\System32\r46u0ej9eho.dll
C:\WINNT\System32\tipmon.dll
C:\WINNT\System32\dnr4019qe.dll
C:\WINNT\System32\hr8405lqe.dll
C:\WINNT\System32\aza2l5ho1.dll
C:\WINNT\System32\e2jmlc111f.dll
C:\WINNT\System32\j4j6le1s1h.dll
C:\WINNT\System32\o0pqla751d.dll
C:\WINNT\System32\fpns0357e.dll
C:\WINNT\System32\hr4m05h1e.dll
C:\WINNT\System32\p84ulih9184.dll
C:\WINNT\System32\gp88l3lu1.dll
C:\WINNT\System32\j22q0cf5ef2.dll
C:\WINNT\System32\gpl8l33u1.dll
C:\WINNT\System32\en2sl1f71.dll
C:\WINNT\System32\k208lcdu1f08.dll
C:\WINNT\System32\jtj4071qe.dll
C:\WINNT\System32\kt48l7hu1.dll
C:\WINNT\System32\jt4m07h1e.dll
C:\WINNT\System32\r8r6li9s18.dll
C:\WINNT\System32\sgpblb.dll
C:\WINNT\System32\dnr2019oe.dll
C:\WINNT\System32\ir42l5ho1.dll
C:\WINNT\System32\jt8q07l5e.dll
C:\WINNT\System32\lv2409fqe.dll
C:\WINNT\System32\n62ulgf9162.dll
C:\WINNT\System32\hr6u05j9e.dll
C:\WINNT\System32\dnrm0191e.dll
C:\WINNT\System32\s8puli7918.dll
C:\WINNT\System32\g6jo0g13e6.dll
C:\WINNT\System32\ktpul7791.dll

and also C:\WINNT\System32\guard.tmp

And here is how you need to do it.

Here is the procedure to use to delete them. Run Pocket Killbox. Select the option to Replace on Reboot.

Now you are going to repeat the below steps for every file except C:\WINNT\System32\guard.tmp
(we will add it separately at the end). Replace the the word fullpathfile with the actual full file name path from above (one file at a time). For example, the first time you paste in C:\WINNT\System32\gp86l3ls1.dll


1) Now, Copy and Paste fullpathfile into the box
2) Check the option to Use Dummy.
3) Now, Click the Red X and Yes to the confirmation message.
4) A message will ask if you want to reboot now – Click NO.
5) Repeat for all files except the last one

For the last file, we will be rebooting when prompted. Here is the final step of the file deletions:

Now, Copy and Paste C:\WINNT\System32\guard.tmp into the box. Check the option to Use Dummy and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your machine to reboot Normally. Tell me if you get any error messages on reboot and tell me the exact messages.

Important:
Also run Windows Explorer and look in C:\WINDOWS\System32 for the file guard.tmp. Tell me if you see it or not. If it remains, paste C:\WINDOWS\SYSTEM32\guard.tmp into Pocket KillBox and Delete it using Standard File Kill. Check it again using Windows Explorer to make sure it is gone.

Once guard.tmp is gone, run Pocket KillBox and Copy & Paste the Following into the box: C:\RECYCLER\Desktop.ini - Click Red X to delete it using Standard File Kill.

NEXT:
Open VX2Finder and Click on the "Find Vx2.Betterinternet" button.

Then click on these buttons in the right pane unless they are not enabled:

UserAgent$ Button to remove the UserAgent from the registry

Guardian.reg

Restore Policy

Allow Machine to Reboot.

Finally, attach another Find.bat log and a Fresh HJT log! Let me know if you had any trouble with the above instructions.

 

Yes! WinXP & WinME only! Sorry about the confusion. I forgot to remove that line when I did some cutting and pasting.

 

Okay! Let's take it a little slower this time. Make sure you read the instruction before doing anything so you follow them properly. Quite a few of the problems are gone already but we have more to do. And we have to keep double checking for guard.tmp even though you already looked.


Here is a list of files that we need to delete using Killbox.

C:\WINNT\System32\wupdxm.dll
C:\WINNT\System32\h60q0gd5e60.dll
C:\WINNT\System32\axsmib.dll

and also C:\WINNT\System32\guard.tmp

And here is how you need to do it.

Here is the procedure to use to delete them. Run Pocket Killbox. Select the option to Replace on Reboot.

Now you are going to repeat the below steps for every file except C:\WINNT\System32\guard.tmp (we will add it separately at the end). Replace the the word fullpathfile with the actual full file name path from above (one file at a time). For example, the first time you paste in C:\WINNT\System32\wupdxm.dll


1) Now, Copy and Paste fullpathfile into the box
2) Check the option to Use Dummy.
3) Now, Click the Red X and Yes to the confirmation message.
4) A message will ask if you want to reboot now – Click NO.
5) Repeat for all files except the last one

For the last file, we will be rebooting when prompted. Here is the final step of the file deletions:

Now, Copy and Paste C:\WINNT\System32\guard.tmp into the box. Check the option to Use Dummy and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your machine to reboot Normally. Tell me if you get any error messages on reboot and tell me the exact messages.

Important:
Also run Windows Explorer and look in C:\WINNT\System32 for the file guard.tmp. Tell me if you see it or not. If it remains, paste C:\WINNT\SYSTEM32\guard.tmp into Pocket KillBox and Delete it using Standard File Kill. Check it again using Windows Explorer to make sure it is gone.

NEXT: Run find.bat again and attach that Log and a fresh HJT Log . At this point it is very important that you do not reboot until you next here from me. These problems can mutate and spread during reboots make my instructions not completely valid. You can disconnect from the internet, just do not reboot.

 

You're wasting my time and yours if you keep rebooting when you should not!
Also you should remain disconnected from the internet physically (unplug cable) from now on while working on these steps. Only plug back in when told to come back and post.

 

Ignore the popups! I know they are there. We have not finished fixing the problem. Infact we have not finished the first step yet.

 

OKAY print these instructions or save them locally! I want you to physically disconnect after reading this sentence before continuing. Do not connect again until told to an do not open any browsers until you come back.


Copy and paste the quoted information below to notepad. Save it to your Desktop as type "all files" and name it 2fixvx2.reg

Now:
Click on the 2fixvx2.reg file you made and allow it to merge the registry entries into the registry.

Here is a list of files that we need to delete using Killbox.

C:\WINNT\System32\dxctl.dll
C:\WINNT\System32\ltl0273mg.dll
C:\WINNT\System32\mzdocs.dll
C:\WINNT\System32\nvj0291mg.dll
C:\WINNT\System32\c800lidm180a.dll
C:\WINNT\System32\k6800glme6qa0.dll

and also C:\WINNT\System32\guard.tmp

And here is how you need to do it.

Here is the procedure to use to delete them. Run Pocket Killbox. Select the option to Replace on Reboot.

Now you are going to repeat the below steps for every file except C:\WINNT\System32\guard.tmp (we will add it separately at the end). Replace the the word fullpathfile with the actual full file name path from above (one file at a time). For example, the first time you paste in C:\WINNT\System32\dxctl.dll

1) Now, Copy and Paste fullpathfile into the box
2) Check the option to Use Dummy.
3) Now, Click the Red X and Yes to the confirmation message.
4) A message will ask if you want to reboot now – Click NO.
5) Repeat for all files except the last one

For the last file, we will be rebooting when prompted. Here is the final step of the file deletions:

Now, Copy and Paste C:\WINNT\System32\guard.tmp into the box. Check the option to Use Dummy and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your machine to reboot Normally. Tell me if you get any error messages on reboot and tell me the exact messages.

Important:
Also run Windows Explorer and look in C:\WINNT\System32 for the file guard.tmp. Tell me if you see it or not. If it remains, paste C:\WINNT\SYSTEM32\guard.tmp into Pocket KillBox and Delete it using Standard File Kill. Check it again using Windows Explorer to make sure it is gone.

NEXT: Run find.bat again and attach that Log and a fresh HJT Log . At this point it is very important that you do not reboot until you next here from me. These problems can mutate and spread during reboots make my instructions not completely valid. You can disconnect from the internet, just do not reboot.

 

It does not look (at least not from what I can see) that you have gone offline. I hope you did physically disconnect (unplug). Malware can still get out if you leave your cables plugged in (even if you don't have a browser running).

 

Run Pocket KillBox and Copy and Paste the Following into the box: C:\RECYCLER\Desktop.ini - Click Red X to delete it using Standard File Kill.

NOW:

Open VX2Finder and Click on the "Find Vx2.Betterinternet" button.

Then click on these buttons in the right pane unless they are "greyed" out:

- UserAgent$ Button to remove the UserAgent from the registry
- Guardian.reg
- Restore Policy

Exit and reboot.


Copy and paste the quoted information below to notepad. Save it to your Desktop as type "all files" and name it 2fixvx2.reg (overwrite the previous one)

Now:
Click on the 2fixvx2.reg file you made and allow it to merge the registry entries into the registry.

Run HJT this and fix the below lines if present:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O14 - IERESET.INF: START_PAGE_URL=http://www

Now reboot again!

Now (hopefully the last time): Run find.bat (Generic Detection Tool) and attach that Log and a fresh HJT Log Let me know how things look to you too.

 

I don't know what you mean by bat.ini

Are you sure you did not do something yourself to Quicklaunch?

And did you miss fixing these:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www
O14 - IERESET.INF: START_PAGE_URL=http://www

 

You're welcome. Make sure you check this out: How to Protect yourself from malware!