toolbar.desktoptraffic.net

Morning,
I'm new to this site so please bear with me. I'm writing from work and my problem is on my home computer. I can't logon to IE. When I try the
toolbar.desktoptraffic.net comes up and shakes my screen. It never logs on to anything. I read your spyware trojan & virus removal section. I will be able to do up to step 3 but after that I cant logon to internet so what should I do??
Thanks in advance
T.Blue

 

Try this tool: ToolBar Cop

Do what you can in the Cleanup tutorial and then send us a HijackThis Log. Please be sure to follow the instructions below:

Note that your HijackThis should be up-to-date (v1.99.1) and MUST be extracted to its own safe folder – C:\Program Files\HijackThis!
Should you need a Fresh Download of HJT, get it HERE: HijackThis v1.99.1

Also note that, before you scan, you MUST close all running programs including your web browser, e-mail and items in the system tray.

Please save your HJT Log as a .txt File and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

I’ve been tied up with work lately and cannot visit this forum too often these days, but somebody will try to take a look when they get a chance.

Best luck
PP

 

All I could do was get to step 3 in the tutorial. I cant send you a HJ log because I cant get on line to download it. So I also cant download any of the programs that you recommended for cleanup. My computer gets stuck as soon as I click on Internet Explorer. The toolbar.desktoptraffic.net comes on like its trying to load that page, but it never loads it. It just sits there and shakes...lol.
Should I try and download the cleanup programs while at work and bring them home to install???
Thanks again,
T.Blue

 

Yes! Not the first time somebody has had to do it that way!

Burn all the tools onto a disk and run them as directed. Then get a HJT log from Normal Windows Boot - Save it to a floppy and send it when you are able from working machine. The process may drag out, but we'll see what we can do

PP

 

I could not check for online updates on Ad-Aware SE, Spybot, Spyware Blaster. I could not do the online scan at Trend Micro's Free Online Virus Scan and Symantec Security Check. In Kill2me it was unable to remove C:\windows\system32\msg118.dll.

I did all the scans through number four on the list. I rebooted my computer and tried to open IE. The address it defaulted to was http://hsremove.com/done.htm. This page could not be displayed. I could not get to Yahoo.com either.

I am posting this from home from a laptop computer. Attached is the HJ log.

Thanks again!

tblue

 

First you need to relocate HJT to a secure location. For example C:\Program Files\HJT

C:\Documents and Settings\JENNIFER\My Documents\hijack\hijackthis\HijackThis.exe

 

Hi Tblue,

I would be more comfortable if you put your anti-spyware tools like SpybotSD in C:\Program Files Folder rather than Documents and Settings.

Also, you MUST move HijackThis to a safer folder - C:\Program Files\HijackThis


Also, please download the following tools and have them handy:

KILL 2 ME.zip

L2MeFix Tool

Generic Detection Tool - NT/2000/XP

VX2.BetterInternet Finder XP/2k - Version Msg126

Pocket KillBox


Go ahead and put them on a disc so they can be handy - Don't know if we'll need them all, but just to be prepared. . . . .

I'll look over your HJT log and post some instructions for you as soon as I can.

PP

 

Ok I moved the files and downloaded the others. will wait for your reply.

Thanks,

TBLUE

 

First make sure you have "System Restore" temporarily disabled per the tutorial.

Now with HJT in its new secure location, run HJT this again in normal mode removing the below lines. Before fixing anything with HJT please close ALL BROWSERS including the one you are reading in now.


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.popupsearches.com/sidesearch.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.popupsearches.com/sidesearch.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

O2 - BHO: (no name) - {AC109D01-32D6-4EB5-8300-D3C5EBAC7C83} - (no file)

O4 - HKLM\..\Run: [_10029C] C:\WINDOWS\System32\_10029C.exe

O4 - HKLM\..\Run: [Visual Element Fx] C:\Documents and Settings\All Users\Application Data\X2FF\xde19979.exe

O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\JENNIFER\Application Data\ttuh.exe

O4 - HKCU\..\Run: [DR_S] C:\Program Files\DR_S\DR_S.exe

O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - http://download.getmirar.com/875457/files/installer.cab

O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.3.1/ttinst.cab

O20 - Winlogon Notify: Guardian - C:\WINDOWS\system32\msg118.dll

O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe



After you have fixed the above entries, please reboot into "Safe Mode" by tapping F8 when you see the BIOS screen come up. When the menu of options comes up, choose "Safe Mode". Now in safe mode delete the below files. Make sure you have "view hidden files and folders" enabled per the tutorial.

1) Go into the folder C:\WINDOWS\System32 and locate the file named _10029C.exe and delete it.

2) In the same directory locate the file named msg118.dll and delete it.

3) Now go into the folder C:\Program Files and locate the folder named DR_S and delete the whole folder.

4) Now go into the folder C:\WINDOWS and locate the file named Nhksrv.exe and delete it.

5) Now go into the folder C:\Documents and Settings\All Users\Application Data and locate the directory named X2FF and delete the entire folder.

6) Last one, go into the folder C:\Documents and Settings\JENNIFER\Application Data and locate the file named ttuh.exe and delete it.

7) Now reboot in normal mode, post a fresh HJT log. Now the tool PP asked you to download called Generic Detection Tool - NT/2000/XP. Extract this to your desktop. In the extracted folder named Find It NT-2K-XP run find.bat and let it take as much time as it needs to run. After this is complete attach this log as well as the HJT log. You seem to have a VX2 infection.

Thanks Bj

 

Couldn't find _10029C.exe
Couldn't delete msg118.dll:Access is denied, make sure disk is not full or right protected and that the file is not currently in use.
Couldn't find DR_S
Couldn't find ttuh.exe

Couldn't attach the new HJ log because one is already attached to string.

Find It output log is attached.

Will wait to hear.

Thanks,
TBLUE

 

Did Output.txt attach? It gives error of attachment in progress?????

 

No, It did not attach. The file msg118.dll is going to be part of the new VX2 which PP or Chas! will have to assist you with. After you post the log from Find.bat they will assist you from there.

Thanks Bj

 

Hi TBlue,

Let's address some of these. . . .

Please unzip and run KILL 2 ME Tool - It should handle this one!

You didn't find them in Program Files Folder? - No problem, we'll get them if they exist!

Rename it something different - HJT 2 or similar

That log did not attach!

Please run the KILL2ME Tool and then rescan for those 2 logs and attach them. If you can't attach them, Copy&Paste them into post and I'll take care of it

Will check back as time permits.

PP

 

I unzipped and ran Kill 2 me and it still could not delete the msg118.dll file. It told me "The Look2me infection is about to be removed, Unable to Remove, The Look2me infection might now have been removed completely". This file is still there.
I couldn't find DR_S or ttuh.exe in the program files directory so I did a search of C: and they were no where to be found.
I had tried to rename the HJ Log last night and it still wouldn't attach.

I am attaching a new HJ log and Output log.

Thanks,

TBLUE

 

Hi TBlue, PP will check your logs when time permits. Hang in there!

Bj

 

ok thanks...i cant do much now anyway I'm at work arrrrgggggghhhh!!!!!! I'll check tonight when I get home.

 

Hi TBlue,

Let's try this:

Please open Pocket KillBox and select the “Delete on Reboot” Option. Copy and Paste C:\WINDOWS\system32\msg118.dll into the box, making sure Delete on Reboot is Checked. Click the Red X to Delete it and then YES or OK to allow KillBox to reboot your machine.


NEXT:
Copy and paste the information below to notepad. Save it to your Desktop as type "all files" and name it fixvx2.reg


REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{749F13E6-21CB-4DAE-BE98-77AA0AA234FB}"=-
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian]


Now:
DoubleClick on the fixvx2.reg file you made and follow the prompts to allow it to merge the registry entries into the registry.


Then, for good measure:
Open VX2.BetterInternet Finder XP/2k and Click on the "Find Vx2.Betterinternet" button.

Then click on these buttons in the right pane unless they are not enabled:

UserAgent$ Button

Guardian.reg

Restore Policy

Allow Machine to Reboot.


Now, send us a fresh HJT Log and we'll clean up the remnants. Also, let us know how things are working now.

PP

 

I put msg118.dll in the kill box and checked to delete upon reboot. I pressed the red X and said OK then I got this message "PendingFileOperationsRegistryData has been removed by External Process!. I had to reboot manually and then checked the C:\windows\system32 directory and the msg118.dll file was still there.

Was able to finish the rest.

Attached is the HJ log.

when I try to get on IE, it goes directly to about:blank. When I try to type in a website, it says the page cannot be displayed.

Thanks,
TBLUE

 

Hi tblue, I see a few problems that keep returning. Be sure to pay close attention so that we can get everything removed. Lets try to remove these entries again.

First please look in Add or Remove Programs for the following and Uninstall if found:


Pop-Up Stopper Companion



Now scan with HijackThis and Check the Boxes for the following:

Again, make sure All Browser Windows are Closed when you Click FIX.


O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\JENNIFER\MYDOCU~1\SPYBOT~1\SDHelper.dll (file missing)

O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)


After removing these DO NOT reboot, let me get Chas! in to ask him about the file msg118.dll

Bj

 

Thanks Chas!

 

ok removed pop up stopper and ran the HJ removed the items you said too.
will wait for reply
Thanks,
TBlue

 

Did you do what Chaslang explained in post 20 ?? If not, please do so as this should fix your VX2 infection(s). After you have completed all the steps that chaslang described in post 20, Reboot and post a new HJT log. Also let me know how things are running. PP, Chaslang or myself will be back to check your log when time permits. Until then hang in there.

Thanks Bj

 

The only msg file I found was msg118.dll. When I tried to delete it I got the same message as before "access is denied make sure disk is not full or write protected and that the file is not currently in use"

What Now?????

Thanks,
T.Blue

 

yes I did everything in post 20. Again the only file I found was msg118.dll and it wouldn't let me delete it.
I still cant logon to IE. The about:blank page comes up.
Attached is the new HJ log

 

When doing the first line (C:\WINNT\System32 etc.) I got the message "The system cannot find the path specified"

When trying to del msg118.dll, "Access denied"

After fixing O20 and rebooting, the O20 was back.

I have a Reinstallation CD for WXP

Thanks

TBLUE

 

Hi Tblue,

In his haste, I think Chas erred a bit. Please try his procedure again as I have edited it below:

--------------------------------------------------------------------------

Let's try something slightly different. Make sure you have no browsers open when you run this and no connection to the internet.

Launch Notepad. Copy/paste the text in the box below into a new text file.
Save it as L2mefix.reg on your Desktop

Locate L2mefix.reg on your Desktop and double-click on it. Now immediately reboot to safe mode.

Open a command prompt by clicking Start, Run, and enter cmd and click OK.
Now in the command prompt window enter the following lines each followed by the enter key (at any prompts you get just answer yes! Make sure you enter the commands correctly, don't miss the spaces):

cacls C:\WINDOWS\system32\msg118.dll /g Everyone:f
cd C:\WINDOWS\system32
attrib -r -h -s msg118.dll
del msg118.dll
exit

- Empty your Recycle Bin

Run HijackThis and have it fix:
O20 - Winlogon Notify: Guardian - C:\WINDOWS\system32\msg118.dll

Now reboot in normal mode and tell us the results of doing the above. Any problems or error messages?

Is the line now gone from your HJT log?

-------------------------------------------------------------------------

Hopefully that will get it! Otherwise, we'll have to go to plan D or E
Hang in there!

PP

 

We were ok until I got to
del msg118.dll
"access is denied" came up after i hit enter
the O20 line is still there.
Still cant logo to IE.....About:blank still comes up

Are you getting aggravated yet??

Thanks,
T.Blue

 

Nothing a Sledgehammer won't cure!!!


Let's try this. . . . Please download these tools if you don't still have them handy:

L2MeFix Tool
Generic Detection Tool - NT/2000/XP


Please make sure ALL Browser Windows are Closed and you are disconnected from internet!

NOW:
Please move the L2MeFix Tool to your Desktop and DoubleClick l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix Folder on your Desktop. DoubleClick l2mfix.bat and type 2 and ENTER to select option #2 for Run Fix. Then, press any key to Reboot your machine.
Your computer will go crazy for a bit, but just let it run. It should eventually spit out a log in Notepad. Please attach that log.

Please don't run any other files in the L2MFix folder.

ALSO
Open the Generic Detection Tool and run "find.bat" again.

Please attach the Find.bat Log along with the L2MeFix Log and we’ll see where you stand.

Chas or I will check back as time permits.

PP

 

did all....logs are attached
Thanks Again
T.Blue

 

Well, on to plan F!! I have never seen a bugger this tough!

Let's see if Chas has any more ideas. Hang in there

PP

 

Im glad I know this one is being hard to remove for all of us, now I dont feel so dumb for not being able to deal with it good. hehe

 

well guess what i still feel like an idiot....lmao

 

Moring,
I found the file but couldn't rename it. Got this error
"Cannot rename msguard: It is being used by another person or program.Close any programs that might be using the file and try again".

I had no other programs running.
T.Blue

 

I was able to delete the two dll files. I also deleted msgsvc.dll. I tried to delete msgina.dll but "access denied". still cannot open IE, get About:blank

Thanks,
TBLUE

 

Not too sure it's a good idea to remove these: msgina.dll & msgsvc.dll. You need the former. The latter is less essential, I believe, but not harmful.

Hang in there for Chas to check back as I am not going to be here much over the weekend!

PP

 

OK Thanks, Phillie

 

I still have them in my recycle bin so I can restore the if needed.
T.Blue

 

Ok I restored the files that you said too. Attached is the new HJ log. I still cant logon to IE. The "about:blank" comes up and when I try any other website I get "page cannot be displayed"
Thanks,
T.Blue

 

Hey I might have had another browser open on the last HJ log. I ran another and attached a new one. Sorry bout that
Thanks,
T.Blue

 

Ok both logs are attached
Thanks,
T.Blue

 

Just for the heck of it I tried again to logon to IE. About:blank came up as usual. I then reset my home page to yahoo in the internet options. I tried to logon again and it tried to get to yahoo but page cannot be displayed came up. It didnt default to about:blank???? I'm freaking lost!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 

I actually do not have any lines in here. At the top it says:"Hosts file is located at C:\WINDOWS\System32\drivers\etc\hosts (0 lines, A)

I'm not sure if this is bad or good.

Thanks,

TBLUE