Spyware Help

Hi...I'm new to this site and am hoping you can help me. I've read through past posts and noticed there are people out there with a similar problem. I am dealing with spyware -- aurora, a better internet, buddy.exe, cashback buddy/bullseyenetwork (I think I got rid of those). Can you please help me? Don't know how technologically saavy I am, but I downloaded HijackThis, since I think that's a good starting point. Thanks.

 

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:


http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Hi...I tried to do the things in the attached article, but no luck. In fact, I'm receiving attempts from buddy.exe to enter my system as I type this. Luckily my firewall is blocked them now. I have attached my HijackThis log here. Please let me know what you think. I appreciate the help. Thanks.

 

Where's the rest of the log?

Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:
Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
(C:\Program Files\HJT) and click Next.

Now run HJT from there. Please save your HJT Log as a .txt File and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.

 

Here is my log....hopefully I'm doing this correctly.

Thanks!

 

Click Start > Run > type in regedit

Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Delete the value, Nail.exe and exit Registry Editor

NEXT:
Click Start > Run > type in cmd

Type in the following:
Nail.exe /FullRemove

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

vlvpnn.exe

qprgl.exe

hkgvobm.exe

iexplore.exe <-- End every instance of this process as requested!

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us9.hpwis.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
(If this still exist, have HJT fix it)

O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll (file missing)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O4 - HKLM\..\Run: [BPCv2] C:\Program Files\bpc_search\BPCv2.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\vlvpnn.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [mpyixl] c:\windows\system32\hkgvobm.exe
O4 - HKCU\..\Run: [eBt3Rjd7W] qprgl.exe
O4 - Startup: AutoTBar.exe

O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)

O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://tsweb.oakwood.com/tsweb/msrdp.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Click Start > Run > type services.msc and Click OK

Locate System Startup Service (SvcProc) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\bpc_search ←–– Delete this whole folder if it exist!

C:\WINDOWS\system32\vlvpnn.exe

C:\WINDOWS\system32\qprgl.exe

C:\WINDOWS\system32\hkgvobm.exe

C:\WINDOWS\cfgmgr51.dll

AutoTBar.exe ←–– Search for this file and delete when found!

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After doing ALL of the above,
Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Thanks so much for the help. Unfortunately, I'm still receiving pop-up notices in my firewall, saying that buddy, aurora, and abetterinternet are trying to get access.

I did everything on the list...is there anything else you suggest?

Thank you. I attached a revised Hijack This log. I appreciate your help.

 

Sorry about the delay, been really busy at work lately!

Please Boot into Safe Mode with the viewing of Hidden Files & Folders enable per the tutorial!

Click Start > Run > type in cmd

Now type in the below exactly as it appears.
(There is a space between exe / )

Nail.exe /FullRemove

Now procede with the following:

- Click Start, Run, and enter cmd in the box and click OK. This opens a commend prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\system32\
attrib -r -h -s vlvpnn.exe
del vlvpnn.exe
exit

- Again, Click Start, Run, and enter cmd in the box and click OK. This opens a commend prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\system32\
attrib -r -h -s dfrmady.exe
del dfrmady.exe
exit

- Last time, Click Start, Run, and enter cmd in the box and click OK. This opens a commend prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\
attrib -r -h -s Nail.exe
del Nail.exe
exit

Now, Scan with Hijack This and have it fix these entries if they still remain:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\vlvpnn.exe
O4 - HKLM\..\Run: [vaswob] c:\windows\system32\dfrmady.exe

Make sure ALL browsers are closed before you click FIX!


Reboot into Normal Mode and attach a fresh HJT log.

 

Thanks for the help. I did what you said and I'm afraid that the same problems are still occurring.

Question, when I do the fir st step, I just do cmd, then I type "Nail.exe /FullRemove" and when I hit enter, I just receive the command response again. Is that correct? Or is something else supposed to happen?

Oh well. Here is my most recent HijackThis log. Thank you again for your time!

 

Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O4 - HKLM\..\Run: [lcdogo] c:\windows\system32\onfpybr.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\vlvpnn.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ncnk.exe

C:\WINDOWS\System32\onfpybr.exe

C:\WINDOWS\system32\vlvpnn.exe

C:\WINDOWS\Nail.exe

(If you can't delete any of these files, right click and select properties and clear all attributes)

NEXT:
Run CCleaner


Reboot to Normal Windows , Scan with HijackThis and attach the new log.

 

I just did the recommended steps -- here is my updated HijackThis log. I noticed that Nail.exe is still appearing. When I was deleting that program from the WINDOWS folder, I noticed that it kept reappearing! I tried to delete it numerous times! Tricky....

Thanks!

 

Download ABIremover and save it to a location like C:\ABIremove

NOW:
Reboot into Safe Mode, be sure you have ALL browsers closed while running this removal tool.

Next, start the ABIRemover.exe, press install, wait (explorer window will disapear)

Reboot directly, boot into normal mode and attach a fresh HJT log.

 

Thank you for your help. Here is my newest Hijack This log.

Thanks!

 

Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\vavknn.exe reg_run
O4 - HKLM\..\Run: [cmokuf] c:\windows\system32\ptjllne.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\WINDOWS\wupdt.exe

C:\WINDOWS\System32\vavknn.exe

C:\WINDOWS\System32\ptjllne.exe

NEXT:
Run CCleaner

Reboot to Normal Windows , Scan with HijackThis and attach the new log.

 

Here is my new HJT log...

Thanks, again!

 

Download the following file, after download is complete run the uninstaller. When uninstall is complete reboot and post a new HJT log.

-Download Uninstaller

 

Here is my new HJT log.... what exactly was that uninstaller? It made my start menu a little different.... stuff is missing....don't remember what it was?

Thanks!!

 

Download Pocket KillBox
(Don't run it yet)


Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


Now scan with HijackThis and Check the Boxes for the following:

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\vavknn.exe reg_run

Make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner


Locate PocketKillbox
(Complete this even if it doesnt turn blue)

Now, Copy and Paste C:\WINDOWS\system32\vavknn.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES.

Now allow Killbox to reboot your system. After you have rebooted and windows has loaded procede with the following steps below.


1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.


Now come back here and post both logs as attachments.

 

Hi, I'm sorry for the delay in my response...I just moved. Anyway, I have not completed the last thing you suggested yet. I'm not sure exactly what the program I used to "uninstall" buddy was....but it added an entirely new program on my computer with pop-ups, etc. And my web browser freezes every five minutes. Should I still try what you listed below? Or should I just re-install the operating system and start over? Thanks for all your help...

 

Procede with my previous fix and follow the instructions as requested.

 

Hi...I tried to do the steps below, but I wasn't able to find:

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\vavknn.exe reg_run

I attached a new HijackThis log here.

Thanks.

 

Damn! Your infection has mutated which means it has changed names. You MUST do my fixes in a timely manner so this infection does not mutate and change names because if you keep doing this it will be impossible to remove.

Let's start over...

First, please run Panda Online Scan. After the scan attach the log to your next post. Also please follow the below:

1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.


Now come back here and post all three logs as attachments.

 

Yikes! How did I GET all this stuff?! Well, here are the first two logs you requested. The third will follow. I really appreciate your help. Thanks!

 

Here is the third log -- RK Files.

Thanks!

 

You MUST complete this fix in a timely manner or else this will be no good as these infections mutate. If you do not do this in a timely manner or reply within a reasonable period of time I will close this thread.

Download Pocket KillBox

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

C:\WINDOWS\cqgnbcof.exe
C:\WINDOWS\dwtdiflw.exe
C:\WINDOWS\Helper101.dll
C:\WINDOWS\vjsxtzwj.exe
C:\WINDOWS\vuydfzuo.exe

C:\WINDOWS\system32\dwdgllf.dll
C:\WINDOWS\system32\JKJNB.dll
C:\WINDOWS\system32\CONRES.cpl
C:\WINDOWS\system32\datadx.dll
C:\WINDOWS\system32\supdate.dll
C:\WINDOWS\system32\tvmk8.dll
C:\WINDOWS\system32\in10b6s.dll
C:\WINDOWS\system32\SWRT01.dll
C:\WINDOWS\system32\in10b6s.dll
C:\WINDOWS\system32\in9bDs.dll
C:\WINDOWS\system32\pypav.dat
C:\WINDOWS\system32\xmltok.dll

C:\WINDOWS\system32\Cache\mswinstall.exe
C:\WINDOWS\system32\Cache\adl_ibis_AS2.exe
C:\WINDOWS\system32\Cache\cxtpls_loader.exe
C:\WINDOWS\system32\Cache\InstallAPS.exe
C:\WINDOWS\system32\Cache\installer_MARKETING17.exe
C:\WINDOWS\system32\Cache\WebRebates_Auto_InstallSilent.exe
C:\WINDOWS\system32\Cache\wrapperouter.exe


C:\WINDOWS\Downloaded Program Files\ATPartners.inf
C:\WINDOWS\Downloaded Program Files\instafin.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll

C:\Program Files\Common Files\Java\bpt.cfg

C:\Documents and Settings\Owner\Application Data\tvmcwrd.dll


After you complete the above, reboot and attach a fresh HJT log.

 

Thank you for your help. Here's the new HJT log.

Thanks!

 

Your HJT log is clean, now I need you to complete post #22 again to confirm your clean.

Are you currently having any malware problems after my previous fix?

 

Here are my logs once again. I attached two here, and the third will follow. My computer seems to be running a little better, yes. My firewall notice pops up somewhat often, but I'm guessing that is normal?

Thanks again for all of your help!

 

Here is the third...

Thanks!

 

Oh no....is BJ okay?!

Well, thank you for your help. I have attached an updated log here...

Thank you!