the logs from read and run first

Here are my logs. My computer is not letting me finish the spybot-search and destroy program. It runs through the whole thing and then when I click to fix problems it freezes, but here are the logs and I will wait to do more further operations. I do still have quite a bit of popups if that helps. Thanks Amber

 

Hi travamber!
You need to stay in one thread. I've asked that the two threads be merged.

Please rerun AVG Antispyware and have it fix everything it finds this time. If possible, get a log from it afterwards and attach it with your next post.

Thanks!
abri

 

Hi trafamber!
After you finish re-running AVG Antispyware and having it fix everything, please continue with the following:

1) Please find this file C:\WINDOWS\system32\34853FABE3.sys in Windows Explorer, right click on it and rename it from 34853FABE3.sys to 34853FABE3.ddd


2) Next go to add/remove programs and uninstall the below:

- Viewpoint Media Player


3) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: IntelligentAdvisor - {6548BF73-58FF-71D5-F97D-17C71E323709} - C:\Program Files\IntelligentAdvisor\IntelligentAdvisor-2.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BDEX System - {83CDEF6B-98D2-4C60-84FC-00C44606A4F8} - C:\WINDOWS\domnftwpto.dll
O3 - Toolbar: The emlkdvo - {940EBD8D-A3B7-44F9-A850-F60E76BE3B22} - C:\WINDOWS\emlkdvo.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm492YYUS
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O21 - SSODL: alxvdvm - {3FAED67F-FF1D-4CB3-9959-E335DF54AD2B} - C:\WINDOWS\alxvdvm.dll
O21 - SSODL: bvtqfvx - {DC4ABA21-66DC-4E9B-B062-75CC63CEE028} - C:\WINDOWS\bvtqfvx.dll

After you click fix, just close hijackthis.

4) Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

5) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger

6) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

7) Now download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


8) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip it generates along with the Avenger log.


Let me know how things are running now?

abri

 

Here is the log after I deleted the detected threats from the scan.

 

Things are much better although when I open my Windows Internet Explorer it refers me to a site,http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2. Other than that no more pop ups and I have attached the logs from the avenger and the mgtools.

 

Hi travamber,
There may be some redundancy in the next steps. If you don't find something, (because it was deleted in a previous step) please just continue on through the instructions.

1) Please begin by following the instructions in the link for Removing Zlob aka SmitFraud, SpySheriff, Infections You will be asked to attach the logs to your next posts.

2) After completing the above, go to add/remove programs and see if you find any of the following programs. If so, uninstall it/them.

MyWay or MyWayBar or MyWaySpeed or MyWaySearchBar or My Web Search Bar
MyWebSearch or MyWebSearch Email Plugin
My Web Search (Outlook, Outlook Express, and IncrediMail)
MyWay Search Assistant or My Way Search Assistant

3) Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

4) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: BDEX System - {83CDEF6B-98D2-4C60-84FC-00C44606A4F8} - C:\WINDOWS\domnftwpto.dll (file missing)
O4 - HKLM\..\Run: [maosmpfv] C:\ucohrxym.bat
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O21 - SSODL: bvtqfvx - {5738F01D-65E6-4535-848D-82FA9200F816} - C:\WINDOWS\bvtqfvx.dll (file missing)
O21 - SSODL: alxvdvm - {BFFA2DD4-BE57-4FB2-A468-7EBC5AA5AB13} - C:\WINDOWS\alxvdvm.dll (file missing)


After you click fix, just close hijackthis.


5) And now, please do the following:

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

6) Now download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


7) And finally, please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip it generates along with the Avenger log.

Let me know how things are running now?

abri

 

Everything Is Back To Normal Now!!!!!yeah!!!thanks Sooooo Much For All The Help!
Amber

 

I'm so glad things are going better!

Please post the MGlogs.zip (under C:\) to me so I can confirm your reasons to be happy. lol

Also, after I've had a chance to check your logs one last time, I will post you the final instructions which will get all the stuff back out of your computer we put in for diagnostic purposes.

Thank you!
abri

 

the information you needed it says i have already given to you in this thread,but i'm still not having any more trouble.....once again thanks so much!