SPYware problem

nikwing · Mar 5, 2008

I was browsing int this morning, suddenly when i minimize my browser (firefox), my desktop BG already chaged to this: Blue back ground with, red & white txt "Warning! you're in danger! your computer is infected with spyware! all you with you computeris stored forever in your hard disck when you visit sides, send mails...all you actions are logged and its impossible to remove with standard tools. Your data is still available for forensics and in some cases for you boss, your friends... bla bla bla" the file is called mywallpaper.

and it makes my pc slow, cannot open task manager, cannot change my desktop bg, my IE automatic pop out & open porn/ security page.

And if i tried to remove the file c:/windows/mywallpaper appears there in a while

i've check the internet & find out that there's a few version of this malware. but still i cannot find a way to remove mine

thanks

Lev · Mar 5, 2008

Please attach the MGTools log as requested in the instructions within this link. Thanks

Read & RUN ME FIRST Before Asking for Support

nikwing · Mar 5, 2008

srry, forgot to post that, i'll post it as soon as possible, when i finished my class

nikwing · Mar 6, 2008

here's the mglog

thanks

chaslang · Mar 8, 2008

Please see the very first area of the READ & RUN ME under Important Notes. You have both Avast and Kaspersky antivirus programs installed. You must uninstall one of this immediately.

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [1029BB4B-16A9-4E77-AA3D-96930BD68EEC] "C:\WINDOWS\sysockeu.exe"
O4 - HKLM\..\Run: [852EBF20-A95D-4F1F-B9C2-B2CD24350F3E] "C:\WINDOWS\sysodkcs.exe"

After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Open Notepad and copy/paste the text in the below quote box into it:

KILLALL::

DirLook::
C:\WINDOWS\NV34443428.TMP
C:\WINDOWS\NV12881332.TMP

File::
H:\data.exe
C:\WINDOWS\sysockeu.exe
C:\WINDOWS\sysodkcs.exe
C:\WINDOWS\sysokuaw.exe
C:\WINDOWS\sysounrk.exe
C:\WINDOWS\ftebh.exe
C:\WINDOWS\config.ini
C:\WINDOWS\fbdzj.exe
C:\WINDOWS\fzmxg.dll

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{290d218e-e470-11dc-ad0b-001d7daceda6}]
Click to expand...

Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

C:\ComboFix.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

SPYware problem

nikwing Private E-2

Attached Files:

combofix log.txt

SASlog.txt

Lev MajorGeek

nikwing Private E-2

nikwing Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member