spyware/hijack/display problems...pls help !

Hi...hope you guys can help. Seems i have a few problems here. I have followed all the proceedures in the Read Me First section, but nothing has helped so far.

- on start up : get a dialogue box saying " error loading EGOMSERVICE_1048.dll the specified module can not be found

- desk top back ground is now black with "Warning! Your computer is infected!" showing in the middle of the screen. I can not get rid of this.

- when i right click on desktop and then properties, only 2 tabs available, no desktop tab there.

- now have a "desktop.ini" icon on my desktop, don't know where that came from

- in my C:\Documents and Settings\Peter\My Documents\received files folder i now have a number of images, strangely of Michael Buble album shots. these are shown as .jpg, but when i right click to delete them tells me these are system files. file names are as follow:

AlbumArt_(3EA43876-E1F3-4236-8A53-19C60E5 867C0)_Large.jpg
AlbumArt_(3EA43876-E1F3-4236-8A53-19C60E5 867C0)_Small.jpg
AlbumArtSmall.jpg
Folder.jpg

- also a "desktop.ini" file in the above folder

- have a folder and program called "security Iguard" from Rex Services in my programs files folder, can't remember downloading this, but i could be wrong on that.

- about blank has hijacked IE homepage

- also have "update searches" hijacking IE

- when i do get IE working it will not open a new browser window, window opens, but nothing happens, including any Major Geeks pages.

- can not run "about buster" have downloaded it several times but when i go to open it it says "corrupt data base"

- getting lots of pop ups for spyware stuff or telling me there is spyware etc on pc

- can not log onto internet when in safe mode

- also seem to have a lot of thumbs.db files in most folders,do not remember them being there

- have done Trend House Call : showed TROJ Downloader.OG in the following files
windows\system32\mstd.dll
windows\system32\javawr.dll
windows\system32\crlk.dll
windows\system32\addhu32.dll
windows\wfqhbt.dat
windows\jrzxsk.dat
windows\javaau.dll

also showed TROJ OT.A in

c\program files\windowsmediaplayer\wmplayer.exe.tmp

- ran RAV Scan :

trojan dropper WIN32/Slaif A* shown in :

windows\downloaded program files\LiveService.inf

trojan WIN32/VB.CD shown in :

documents and setting\all users\application data\IE service\v28.exe

- ran Online Trojan Scanner, found the following :

windows\system32\egcomservice2.dll
Dialler

windows\stoolbd.dll
not a virus:AdWare.Toolbar.Fastlook a

windows\down loaded program files\DeskAdX.dll
Adware.winAD.n

windows\downloaded program files\CONFLICT.1\DeskAdX.dll
Adware.win.AD.n

program files\mIRC\mirc.exe
riskware.mirc.6.12
(will delete mIRC completely, don't use it anymore)

That's about it at the moment. I have run HJT, but will await instructions before attaching it here.

Thanks in advance.

 

Sorry, just a bit more additional information, also ran the following in safe mode :

CCleaner
Ad Aware - clear
SpyBot - clear
HS Remove - clear
Killme - removed if present
CWShredder - clear
Stinger - clear

Thanks again.

 

Sorry about the delayed response, we are very busy here in the Spyware Forum. If you have followed the READ ME procede with a HJT log.

http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

thanks for getting back, appreciate how busy u guys must be. Yes, followed all the pre HJT instructions, i have attached my log form HJT.

These Michael Buble .jpg things have thrown me for a loop though...any ideas on those ??

Anyway, log attached, look forward to the next instalment.

Cheers

 

Your Operating System and Internet Explorer versions are WAY out of date and represent a major security risk. After we fix your current problems, you must get updated. You need to install Service Pack 2 for security purposes.

Look in Add/Remove Programs and uninstall the following prorgam:

Paltalk


Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.updatesearches.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.updatesearches.com/search.php?qq=%1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.updatesearches.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.updatesearches.com/

R3 - Default URLSearchHook is missing

O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpE1A3.tmp

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetdata\services.exe
O4 - HKLM\..\Run: [WindowsFZ] C:\WINDOWS\System32\LogFiles\A5281300.so
O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGCOMSERVICE_1048.dll,InstantAccess
O4 - Startup: PalNetaware.lnk = C:\Program Files\Paltalk\pnetaware.exe

O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: {2AEEAC34-FD74-4142-B891-4B05C0C03C87} - http://akamai.downloadv3.com/binaries/DialHTML/EGCOMSERVICE_1048_pack_XP.cab
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab
O16 - DPF: {50AD557E-3426-41FD-AFDD-2AF39BB1C387} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_5_EN_XP.cab
O16 - DPF: {6A841EE8-C9B0-63F9-F507-29A70119A4D8} - http://216.118.71.185/1/gdnAU1865.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\Program Files\Paltalk ←–– Delete this whole folder if it exist!

C:\WINDOWS\System32\shnlog.exe

C:\WINDOWS\System32\intmon.exe

C:\WINDOWS\System32\hpE1A3.tmp

C:\WINDOWS\inetdata\services.exe

C:\WINDOWS\System32\LogFiles\A5281300.so

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing ALL of the above, Scan with HijackThis and attach the new log.

 

hi and thanks again. Problems with about blank and update search on IE are now fixed. New log is attached.

I still have the problem with my desktop though...black background is still there with "warning! your computer is infected"

Also, still only 2 tabs when right click on desktop, no desktop tab there.

Also, still can not open a new/secondary IE window when sent to it...window opens, but nothing happens.

When i opened add/removed programs, noticed one called "Explorer Assiatant", yes that is how it is spelt...doesn't look familiar...is it a problem?

Finally, sorry about this.....those bloody Michael Buble .jpg things that say they are a system file when i go to delete them.

Thanks again.

damn, cant attach log because IE wont allow secondary window to open. Will send this and attach log via Mozilla !!

 

here is the new HJT log

 

hi Guys...any further advice on my remaining problems ? The IE secondary window not downloading is a real pain, also the desktop issue.

Thanks once again.

 

Your HJT log is clean!

Navigate to and delete the following file:

C:\WINDOWS\Web\desktop.html

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file desktopfix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the desktopfix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES!


Click Start > Run > type regedit

Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Look for a DWORD value called "NoViewContextMenu"

When located right click and delete it!


Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Look for a DWORD value called "NoViewContextMenu"

When located right click and delete it!


Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

Look for a DWORD value called "NoChangingWallPaper"

When located right click and delete it!



Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Only Should have "NoDriveTypeAutoRun"

Remove This Value "NoActiveDesktop"
Remove This Value "ForceActiveDesktopOn"

Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

There should on be the (default) string here

Remove This Value NoComponents
Remove This Value NoAddingComponents
Remove This Value NoDeletingComponents
Remove This Value NoEditingComponents
Remove This Value NoHTMLWallpaper


Now, Navigate to and delete the following file:

C:\WINDOWS\Web\wallpaper.html


Final Step:

Right Click on your desktop, click properties, click the Desktop Tab, click Customize Desktop, click the Web Tab. Now, uncheck everything in this tab.

After you have completed ALL of the above, reboot and see if problem remains!

 

Thanks once again for your assistance, much appreciated !

The good news all seems ok with the desktop now.

But still have the problem with IE not being able to download anything in the secondary window it opens.....can this be fixed ???

Also,could not follow all instructions from your last post.

1. windows\web\desktop.html does not seem to exist on my pc

2. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

no DWORD called "NoViewContextMenu" was there

3. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

as above, not there.

4. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

only have "explorer" and "network" and the "policies" folder, no "active desktop" was there.

5. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

as well as "nodrivetypeautorun" also have a REG-Binary "CDRAutorun" and a REG-SZ "(default)". did not have "NoActiveDesktop" or "ForceActiveDesktopOn".

6. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

the "activedesktop" not there under "policies

7. do not have C:\WINDOWS\Web\wallpaper.html


Hope this is all of assistance. The main problem i want to fix is IE not downloading the secondary page it tries to open.

Thanks once again.

 

You desktop is ok now, correct?

Are you having any further Malware problems?

 

Yep, desktop is fine now, all reset and no problems there.

No malware problems either that i can see.

But still have that problem with IE not being able to load when it opens a secondary window from the primary window....very frustrating !!

Thanks in advance once again for helping with this IE problem.

 

Since your not having any Malware problems, I would recommend posting this in the Software Forum. If you like I can move this thread there for you or you can post your problem in there.

Let me know!

 

Ah yes, quite right.....no longer a spyware problem !

Would appreciate if you could move it to the software section.

Once again thanks for all your help, was invaluable.

Will be passing this site onto friends.

 

Moved as per your request!

Just to give a heads up of whats going on, Its best to drop a message explaining whats going on so they can best assist you.

Good Luck!

 

Thanks

Ok, all malware problems seem to be fixed now !

One problem remaining......with Internet Explorer.

When a secondary window opens from a primary IE site, it will not load anything, the window opens, then remains completely blank.

Have no idea how to fix this......any help would be appreciated.

Thanks in advance.

 

Try this,

1. Quit all programs that are running.
2. Click Start, and then click Run.
3. Type regsvr32 urlmon.dll, and then click OK.
4. When you receive the "DllRegisterServer in urlmon.dll succeeded" message, click OK.

If this does not resolve the problem, repeat steps 2 through 4 for each of the following files (in step 3, replace Urlmon.dll with each of the file names below):

• Shdocvw.dll
• Msjava.dll
• Actxprxy.dll
• Oleaut32.dll
• Mshtml.dll
• Browseui.dll
• Shell32.dll

Windows XP and Windows 2000 only
Restart the computer to enable the changes to take effect.

Steve

 

Thanks !

Fixed with the first attempt, much appreciated.

Pete

 

Good deal Pete, you should be fixed up now.

Steve