Rid it once, then it came back.

Discussion in 'Malware Help (A Specialist Will Reply)' started by Elisetimpe, Mar 14, 2008.

  1. Elisetimpe

    Elisetimpe Private E-2

    http://elisetimpe.com/Malware_popups.htm
    Above are the images of the popups that characterized the malware. I went thru the "do me first", and it appeared to be gone. I reset the restore point. Then, I went about resetting the time to 12 hour without reading your instructions. I clicked on it and looked for a place to reset it. The popups started again.
    Now I just went through the "do me first" stuff again. The time is still at 24 hours & I haven't seen a popup yet. Here's the logs:

    [EDIT by chaslang] Inline ComboFix log deleted.


    I have an HP Pavillion dv 9000 with 2 hard drives running Media Center. What else do you need?
    How do I REALLY get rid of this? I don't have popups at this moment, but am going to wait for your advice before trying to figure out how to put my 12 hour time back.
    More questions>>Is it just my C drive, or is my D drive and the E drive that I never access involved? If I tried to format my C drive, would I have a problem because I didn't create backup discs, though when I later tried, it wouldn't let me saying it was done once? If I backed up everything I could think of on my C drive onto DVDs, would using them to restore a format re-create the malware? Same question with an external hard drive.
    Thank you!!!!
     
    Elisetimpe, Mar 14, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    The reason you are having problems getting your thread posted is because you are not following the instructions in the READ & RUN ME.
    The keywords are that you must attach logs which is explained in the instructions.
     
    chaslang, Mar 14, 2008
    #2
  3. Elisetimpe

    Elisetimpe Private E-2

    Here are my logs. So far so good. I used MS Publisher to create a Real Estate flyer for a co-worker. Took a couple of hours.
    I was playing songs on ITunes while working. Have looked at email.
    Once, I got the pop-up message from (?)windows saying it cleaned by deletion a "downloader". I'd gotten that many times yesterday during infection. I still have not poked around to figure out how to set my clock back to 12 hours...hate to sit and count on my fingers...
    That's what seemed to bring it back last time.:confused
    :confused
    Do you think it's gone? Can you see anything in my logs? (I feel like I'm offering my palm to a palm readerLOL)
     

    Attached Files:

    Elisetimpe, Mar 16, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You can fix your clock from Control Panel ->Regional and Language Options and then on the Regional Options tab click the Customize button then on the next form click the Time tab. Then change the Time format to what you want. It explains there what the lower case and upper case letters will do. Upper case H is giving you 24 hour clock settings.

    No! You are still badly infected.

    We read minds too. ;)


    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 6

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O3 - Toolbar: etlrlws - {47F54733-C836-4704-A3F9-6939B8259389} - C:\WINDOWS\etlrlws.dll (file missing)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O8 - Extra context menu item: &Search - ?p=ZZ
    O15 - Trusted Zone: http://www.adobe.com
    O15 - Trusted Zone: http://print.coupons.com
    O15 - Trusted Zone: http://www.eneighborhoods.com
    O15 - Trusted Zone: http://*.firstteam.net
    O15 - Trusted Zone: *.stumbleupon.com
    O15 - Trusted IP range: http://10.1.2.116
    O21 - SSODL: bokpkov - {1FD624D0-5D52-45AD-8D4C-5C735639A271} - C:\WINDOWS\bokpkov.dll
    O21 - SSODL: altvxvm - {D2C9C1FA-5FE4-47AE-AADC-8AD8752640B6} - C:\WINDOWS\altvxvm.dll
    O21 - SSODL: CheckRam - {148454dc-b0c4-45c1-b13a-54329f13d057} - C:\WINDOWS\Installer\{148454dc-b0c4-45c1-b13a-54329f13d057}\CheckRam.dll
    O21 - SSODL: zip - {80040745-81ac-45e0-8ad6-77607587c8d0} - C:\WINDOWS\Installer\{80040745-81ac-45e0-8ad6-77607587c8d0}\zip.dll

    After clicking Fix, exit HJT.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Mar 17, 2008
    #4
  5. Elisetimpe

    Elisetimpe Private E-2

    Please let me know if logs didn't attach. I've uploaded them 3 times, then decided that they didn't attach to a place like this where I type. Anyway, I got confused & have decided to ignore it.
    I'm not sure how it is yet, but please let me know how the logs look. If I get any more indications that all is not right, I'll be back here.:wave
    "Upload Errors
    ComboFix.txt:
    Attachment in Progress. Can be deleted here.
    MGlogs.zip:
    Attachment in Progress. Can be deleted here. "
    In progress? Maybe I'll make it. Please let me know.

    Thank you so much for being here and helping!!!
     
    Last edited: Mar 21, 2008
    Elisetimpe, Mar 21, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No your logs did not attach and I need to see the new logs in order to continue helping you. Try attaching them again. Use a different browser if still having problems. What browser were you using?
     
    chaslang, Mar 21, 2008
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds