Smitfroud-C!Help me plz! I'm novice

Welcome to Majorgeek!

What about CounterSpy or AVG AntiSpyware? You did not attach a log from one of them.


Also you did not install GetRunKey or ShowNew properly. You tried to run it from D:\ISO-8859-1 which I assume is a CD drive. You must extract ALL files from the GetRunKey.zip and ShowNew.zip files into a folder on your C drive. Use a folder named C:\MGTools as suggested. Neither of the two programs ran properly because they were not installed properly. So you need to re-reun them and attach new logs.

Also attach (don't take a snapshot) a log from a new run of Spybot. You just need to right click in the scan window to create a log.

What are the below processes? Are they something you installed?
O4 - HKLM\..\Run: [OnlineCafe] C:\Program Files\VDC\InternetOnline\OnlineCafe.exe
O4 - HKLM\..\Run: [WebFilter] C:\PROGRA~1\VDC\INTERN~1\webfil.exe

Why are you running your PC with no protection???? You have no antivirus, no firewall, and had no antispyware program until you install CounterSpy which is only a trial.



I really need the other logs to make a complete fix, but I will give you a bunch of steps to do below.

This should help to improve your situation somewhat, but it will probably not fix everything since more could be hiding.

Start by downloading two tools we will need

- Process Explorer

- Pocket KillBox

Extract them to their own folder somewhere that you will be able to locate them later.


Make sure you have rebooted in Normal Mode (do not open any other processes)
Also make sure that one and only one Internet Explorer browser is opened up

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of winzzc32.dll once and then click the kill button. After you have killed all of the winzzc32.dll under winlogon click ok. (If you do not find the dll, just continue on.)

Now repeat the above step for the below DLLs(If you do not find the dll, just continue on):
ddcyvww.dll
gebcccd.dll
rpcc.dll
vtutu.dll

Next double click on explorer.exe and again click once on each instance of winzzc32.dll and kill it. (If you do not find the dll, just continue on.)

Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
ddcyvww.dll
gebcccd.dll
rpcc.dll
vtutu.dll
Next double click on iexplore.exe and again click once on each instance of winzzc32.dll and kill it. (If you do not find the dll, just continue on.)

Now repeat the above step for the below DLLs (If you do not find the dll, just continue on):
ddcyvww.dll
gebcccd.dll
rpcc.dll
vtutu.dll

Now just exit Process Explorer.

Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.
C:\WINDOWS\system32\tcpipmon.exe
C:\WINDOWS\system32\tcpipmon.exe

After killing all the above processes, click Back.
Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {483CC496-D041-4545-8D9E-2D64294F97B2} - C:\WINDOWS\system32\gebcccd.dll
O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\xfaklyfa.dll
O2 - BHO: (no name) - {A416D604-EAA3-4618-958C-2ECA22414616} - C:\WINDOWS\system32\ddcyvww.dll
O2 - BHO: (no name) - {B8E376B1-7A95-4B4F-A048-8254567EA2BA} - C:\WINDOWS\system32\vtutu.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BkavFw] C:\Program Files\Bkav2006\Bkav2006.exe TASKBAR
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\cajjsxgl.dll",setvm
O4 - HKLM\..\Run: [Intel system tool] C:\WINDOWS\system32\svehost.exe
O4 - HKLM\..\Run: [clcl3] C:\WINDOWS\system32\clcl3.exe
O4 - HKLM\..\Run: [tcpipmon] tcpipmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O20 - Winlogon Notify: ddcyvww - C:\WINDOWS\SYSTEM32\ddcyvww.dll
O20 - Winlogon Notify: gebcccd - C:\WINDOWS\SYSTEM32\gebcccd.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: vtutu - C:\WINDOWS\system32\vtutu.dll
O20 - Winlogon Notify: winzzc32 - C:\WINDOWS\SYSTEM32\winzzc32.dll

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\gebcccd.dll
C:\WINDOWS\system32\xfaklyfa.dll
C:\WINDOWS\system32\ddcyvww.dll
C:\WINDOWS\system32\vtutu.dll
C:\Program Files\Bkav2006\Bkav2006.exe
C:\WINDOWS\system32\cajjsxgl.dll
C:\WINDOWS\system32\svehost.exe
C:\WINDOWS\system32\clcl3.exe
C:\WINDOWS\system32\tcpipmon.exe
C:\WINDOWS\system32\rpcc.dll
C:\WINDOWS\SYSTEM32\winzzc32.dll

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folder and delete if found:
C:\Program Files\Bkav2006

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey - make sure you have installed it properly
2. ShowNew - make sure you have installed it properly
3. HJT

Make sure you tell me how things are working now!

 

The below is a direct quote right out of the READ & RUN ME.

Because you have to create it.



Note: You should not be downloading and using that MGTools.zip file from the other thread. You should only follow the directions given to you in your thread.

 

What files do you see in the folder you first extracted GetRunKey to? Tell me the file names you see?

What files do you see in the folder you first extracted ShowNew to? Tell me the file names you see?

 

Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.

C:\WINDOWS\system32\SSVICHOSST.exe

After killing all the above processes, click Back.
Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

F2 - REG:system.ini: Shell=Explorer.exe SSVICHOSST.exe
O4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\SSVICHOSST.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - Winlogon Notify: winzzc32 - winzzc32.dll (file missing)


After clicking Fix, exit HJT.

Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\windows\system32\winzzc32.dll
C:\WINDOWS\system32\autorun.ini
C:\WINDOWS\system32\setting.ini
C:\WINDOWS\system32\SSVICHOSST.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

Those are not valid folder names and this is a good example of why you should put them in the folders as recommended. You should not put quotes in folder names. And why you want them in a folder name that begins with ISO-8859-1 anyway?

 

They still are not running properly and that may be due to the choice of folder names.


Are you having any malware problems?

 

And now they ran correctly since you installed them properly in to folders with valid names.

Not helpful! You need to either give me a log from Spybot or tell me exactly word for word what is being found and not fixed.

What are the below files and folders? Especially the aaaaa.reg file? DO NOT double click on the aaaaa.reg file!!!!!! If you want to see what is in it, you will have to load it into Wordpad.

Code:

"C:\Documents and Settings\GAME3\My Documents\"
aaa.rtf       Apr  8 2007        2378  "AAA.rtf"
aaaaa.reg     Apr  8 2007     3346406  "aaaaa.reg"
cs.txt        Apr 10 2007        8885  "CS.txt"
cs2.txt       Apr 11 2007        8885  "CS2.txt"
cs3.txt       Apr 12 2007        1326  "CS3.txt"
fix.rtf       Apr 11 2007        9345  "fix.rtf"
help.txt      Apr 12 2007        2233  "help.txt"
 
 
"C:\Documents and Settings\GAME3\Application Data\"
COWON         Apr 12 2007              "COWON"
 
"C:\Program Files\Common Files\"
COWON         Apr  5 2007              "COWON"
 
"C:\WINDOWS\system32\"
tukernel.exe  Feb 16 2007     2288128  "TUKernel.exe"
 

When you run the below fixME.reg patch, take notice of the message you get from Windows and tell me exactly what it says.


Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now please download F-Secure's BlacklightBeta

• Download fsbl.exe and save it to the Desktop.
• Once saved... double click fsbl.exe to install the program.
• Click accept agreement and Click scan
• This application may trigger a warning from your antivirus. Let the driver load. Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please attach the BlackLight log.


Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\awvtu.dll
C:\WINDOWS\system32\lbivksyq.dll
C:\WINDOWS\system32\ydqnasnf.dll
C:\WINDOWS\system32\18E.tmp
C:\WINDOWS\system32\gjkkj.ini
C:\WINDOWS\system32\lgxsjjac.ini
C:\WINDOWS\system32\oeminfo.ini
C:\WINDOWS\system32\ututv.ini
C:\WINDOWS\system32\utvwa.ini

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

 

The file name was fix.rtf which is not a true text file. You probably created it with WordPad not notepad.

Try to get in the habit of using useful filenames so that there is no question as to what something is. Randomly named files are commonly used by malware programs.

What do you see in those two COWON folders.

Do you also have a c:\windows\system32\ntoskrnl.exe file (in addition to the TUKernel.exe file) and are they the same size?

Yes there was. The part that said has been successfully entered into the registry was the important part and was what I need to know.

Run this ChodeFix - How download and run and then check to see if you can get logs from GetRunKey and ShowNew.

 

Okay so then delete the below folder:

C:\Documents and Settings\GAME3\Application Data\COWON

Yes I know ntoskrnl.exe is valid. I just wanted to make sure it was there and see if the file sizes were similar. I believe TUKernel.exe is part of TuneXP 1.5 that you have installed. I did not notice it earlier. So it is okay. Many people (even some antispyware programs believe it is malware, but that is probably due to where they installed it and the name they gave it.


Uninstall CounterSpy since we are finished with it now!


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O1 - Hosts: ECHO is off.
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

After clicking Fix, exit HJT.

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now reboot in normal mode

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. HJT

Are you having any more malware problems?

 

You did not get the step with the fixME.reg patch performed properly. Try it again. Tell me if you receceive a message after running it that says that it was successfully added to the registy.

Did you change any of your hidden files settings? They seem to have changed!

 

Okay! This time it worked. Last time it did not. You must always make sure you get a success message when doing these registry patches and let us know whether it succeeded or you receive an error message.

Nothing happened, and when I check Folder Option again, it automatically changes to
"Do not show hidden files and folders" [/quote]Yes! I can see it in the GetRunKey log! Search thru it and you will see a value the looks like this:

"Hidden"=dword:00000002

it should be

"Hidden"=dword:00000001

And back in message # 18 it was correct. I'm not sure why it changed back, but it does not appear to be malware because your logs are all clean. Perhaps you have locked something within one of your applications.


Thus, if you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you run Avenger, you can delete all files related to Avenger now.
7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
9. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!