Spike Needs Help!

sevenfootspike · Mar 4, 2006

I have followed all of the directions in the "Read and Run Me First" thread. However, when running PandaActiveScan the window would not open to a full screen so I saw nothing that said "see report". After scanning it did say "malicious software has been found". After rebooting I ran HJT and have attached that report along with Bitdefender. One last thing that I may be having problems with.....when I rebooted and connected to the internet, I had a message saying there was a security breach by blackworm virus. When I clicked on this it took me to a WINVIRUS 2006 site. I closed the window and posted here before doing anything. Any chance this may be a hoax like WinFixer? Any help that can be given would be highly appreciated.

Thanks,
Spike

chaslang · Mar 4, 2006

Did you have a problem trying to install MS Windows Defender?

Run the below and attach the requested log:

Virtumonde aka Trojan Vundo Removal

Then also attach a new HJT log and tell me how things are working.

sevenfootspike · Mar 4, 2006

Yes, I did have problems installing MS Defender. Sorry I forgot to mention that. Now I'm having another problem with the VundoFix. I get to the point where is says it will "close and reopen in a minute or less" and click OK. I have done this twice, but nothing happens after that. I have waited 5 to 6 minutes both times and it never reopens. Am I missing something?

sevenfootspike · Mar 4, 2006

OK, third time is a charm. I tried again and it worked. I'm attaching the logfile along with a new HJT log.

chaslang · Mar 4, 2006

Let's get an installed programs list from HijackThis too!

Run HijackThis, click Open the Misc Tools section
Click Open Uninstall Manager
Click Save List (generates uninstall_list.txt)
Click Save, to save it to a file where you can find it.
Upload this file as an attachment too.

After seeing the above, I'll work up a final (should be final) fix.

Things should already be alot better though since Vundo is fixed now.

sevenfootspike · Mar 5, 2006

I guess I'm confused. Where is "MISC TOOLS" and "UNINSTALL MANAGER"?
Sorry for taking your time and that I'm such a novice.

chaslang · Mar 5, 2006

Right on the main page of HijackThis when you first run it. Look at the buttons! Read the fourth one down!

sevenfootspike · Mar 5, 2006

OK, call me stupid. I guess I could have easily found that if I was paying more attention. Here are the attachments you requested.

chaslang · Mar 5, 2006

Okay!

We recommend uninstalling Viewpoint Media Player in our readme. You should uninstall it, unless you use it (but I doubt it).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: WTLHelper Object - {BD6CD737-34E1-4864-8697-83EC081F1989} - C:\WINDOWS\system32\gebyv.dll (file missing)
And if you do not use Windows Messenger (this is not MSN Messenger), also fix the below
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

After clicking Fix, exit HJT.

Now we need to Reset Web Settings:

If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.

Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

sevenfootspike · Mar 5, 2006

You, my friend, are truly amazing! Computer works like it did when I first bought it! Everything is so much faster! Here is the newest HJT log. How does it look? Anything else I should do besides disable and re-enable system restore?

chaslang · Mar 5, 2006

Did you fix the items I gave you in the last message and did you Reset Web Settings?

What about removing the WindowsMessenger lines?

All of these are still there. If you did fix them, try all the steps again but this time exit MS Antispyware first before doing any fixes. And then reboot. If you get a message from MS Antispyware about any home,start, or search page changes, just accept them.

Then attach a new HJT log. The next steps (if this all works) are below.

If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

sevenfootspike · Mar 5, 2006

OK, here is a new HJT log. It looks like all of those are gone now, except for

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

I don't know why that won't go away. Am I doing something wrong? Apparently so. Will it hurt if it's left there?

chaslang · Mar 5, 2006

sevenfootspike said:

I don't know why that won't go away. Am I doing something wrong? Apparently so. Will it hurt if it's left there?
Click to expand...

Windows Messenger is an unnecessary program that no one uses and it can be the source of popups.

Use the below to Remove it from your system.

Disable/Remove Windows Messenger

Let me know if this works. It could be that MS Antispyware was still blocking the change.

Make sure you have started working on the How to protect thread!

sevenfootspike · Mar 5, 2006

OK, that worked. Thanks so much chaslang! I'll start working on the protection thread next! Thanks again for all your help!

chaslang · Mar 5, 2006

You're welcome. Surf safely!

Log in or Sign up

Spike Needs Help!

sevenfootspike Private E-2

Attached Files:

bdscan1.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sevenfootspike Private E-2

sevenfootspike Private E-2

Attached Files:

VundoFix.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sevenfootspike Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sevenfootspike Private E-2

Attached Files:

hijackthis.log

uninstall_list.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sevenfootspike Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sevenfootspike Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sevenfootspike Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member