Trojan's !

You are almost a year out of date with your version of MGtools. You must always download current versions. We will start a fix but you will need to update at the end of these instructions where I ask you to do so. Also note that your copy of AVG8.5 is broken. DO NOT reinstall yet.


Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below old versions of software:
Java(TM) 6 Update 3

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - d:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - d:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - d:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - d:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - Unknown owner - d:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: AxInst Service (AxIntSvc) - Unknown owner - C:\WINDOWS\System32\Dism\smss.exe
O23 - Service: DCOM Server Process Launchers (DcomLaunchs) - Unknown owner - C:\WINDOWS\ravcopy.exe (file missing)
O23 - Service: dsfg45fj pressure experimentation (dsfg45fj) - icepoint - C:\WINDOWS\hf34h.exe
O23 - Service: jwam - Unknown owner - C:\WINDOWS\system32\jwam.exe (file missing)
O23 - Service: KingDuBa Driver (KingDuuBa) - Unknown owner - C:\WINDOWS\system32\DuBa.exe
O23 - Service: Klerter - Unknown owner - C:\WINDOWS\system32\thTdg\I001.exe
O23 - Service: Remote Storm Service - Unknown owner - C:\WINDOWS\system32\thTdg\J002.exe (file missing)
O23 - Service: Traffic Control (TrafficCtrl) - Unknown owner - C:\WINDOWS\System32\Traffic\smss.exe (file missing)
O23 - Service: win - Unknown owner - C:\WINDOWS\system32\****.exe (file missing)
NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner to remove temp files!

Now goto this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Yes but my instructions are the only thing you should be doing. Did you notice how many things there were to fix? Even AVG was broken as I stated. It's up to you what you want to do. You can try running my fix and attaching new logs (I sure more will be found since the infection may have spread already) or you can format and reinstalled.

 

You waited to long to run the fix. Your version of ComboFix was therefore many days out of date. This caused it to run in Reduced Functionality Mode which is not as effective. We will use both Avenger and ComboFix this time to see if we can help work around this. But it would be best if you download the current version of ComboFix when you start this next fix. Since you will need to download Avenger too, it just one more file to download.

Also as I expected, your infection spread tremendously creating many more malware files.

I will give you another fix, try to run it as soon as possible. Also, from now on, do not power down or reboot your PC after attaching logs. The infection is spreading/changing at reboots. And if you power down or reboot, that would make my next fix incorrect because your PC would no longer have the same problems as what my fix would be based upon.


SHUTDOWN AVG before trying to do the below!!! If you cannot shut it down, uninstall it as it is of no use to you anyway since your PC is the worse infected PC that I have seen in years.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O23 - Service: 37LH08U - ??????? - C:\WINDOWS\KGXESJCX5.exe
O23 - Service: 89R6H2CE8 - ??????? - C:\WINDOWS\SJB8L0RGXDU.exe
O23 - Service: 9W10H2AIRCGR - ??????? - C:\WINDOWS\RHIUEH.exe
O23 - Service: AxInst Service (AxIntSvc) - Unknown owner - C:\WINDOWS\System32\Dism\smss.exe (file missing)
O23 - Service: CLHZ7GUD2BW - ??????? - C:\WINDOWS\TQDE7.exe
O23 - Service: DCOM Server Process Launchers (DcomLaunchs) - Unknown owner - C:\WINDOWS\ravcopy.exe (file missing)
O23 - Service: dsfg45fj pressure experimentation (dsfg45fj) - Unknown owner - C:\WINDOWS\hf34h.exe (file missing)
O23 - Service: HUO4DD - ??????? - C:\WINDOWS\77JQZPYN.exe
O23 - Service: jqka - Unknown owner - C:\WINDOWS\system32\jqka.exe (file missing)
O23 - Service: jtoq - Unknown owner - C:\WINDOWS\system32\jtoq.exe (file missing)
O23 - Service: jwam - Unknown owner - C:\WINDOWS\system32\jwam.exe (file missing)
O23 - Service: jwoq - Beijing Rising Information Technology Co., Ltd. - C:\WINDOWS\system32\jwoq.exe
O23 - Service: jwqg - Unknown owner - C:\WINDOWS\system32\jwqg.exe
O23 - Service: KingDuBa Driver (KingDuuBa) - Unknown owner - C:\WINDOWS\system32\DuBa.exe (file missing)
O23 - Service: Klerter - Unknown owner - C:\WINDOWS\system32\thTdg\I001.exe (file missing)
O23 - Service: KV3BC - ??????? - C:\WINDOWS\8M7XCV7.exe
O23 - Service: L9IJ2Z80P5 - ??????? - C:\WINDOWS\9H8DH0K4UYNZ.exe
O23 - Service: mian sha a (miansha) - Unknown owner - C:\WINDOWS\system32\ZhyFD\I001.exe
O23 - Service: Q8K2OTUQO6 - ??????? - C:\WINDOWS\HY943WQ0Q624.exe
O23 - Service: QKDP797ZG2X - ??????? - C:\WINDOWS\Z38RP.exe
O23 - Service: Remote Storm Service - Unknown owner - C:\WINDOWS\system32\thTdg\J002.exe (file missing)
O23 - Service: srivec - Unknown owner - C:\WINDOWS\system32\srivec.exe (file missing)
O23 - Service: sruae - Unknown owner - C:\WINDOWS\system32\sruae.exe
O23 - Service: srume - Unknown owner - C:\WINDOWS\system32\srume.exe (file missing)
O23 - Service: Traffic Control (TrafficCtrl) - Unknown owner - C:\WINDOWS\System32\Traffic\smss.exe (file missing)
O23 - Service: VFBU9C8MJ6 - ??????? - C:\WINDOWS\CW3QOFMXH6SO.exe
O23 - Service: VL59BFG1 - ??????? - C:\WINDOWS\D1O8ODRSFA.exe
O23 - Service: win - Unknown owner - C:\WINDOWS\system32\****.exe (file missing)

After clicking Fix, exit HJT.



Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot, you now need to perform the below fix with ComboFix. We are doing this for redundancy and to pickup anything new they may have arrived.



Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner to clean out only temp files and nothing else!

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )



Then attach the below logs:

• C:\avenger.txt
• C:\combofix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!
REMEMBER!! Do not power down or reboot your PC now. Wait for the next fix.

 

Hopefully you have not rebooted or powered down!

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O23 - Service: 33AY7LH4C - ??????? - C:\WINDOWS\KA0SM3PKU77.exe
O23 - Service: 7NS3J - ??????? - C:\WINDOWS\VJRI42V.exe
O23 - Service: MC1Q5VYJT5 - ??????? - C:\WINDOWS\SNKKA.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Q78NM0 - ??????? - C:\WINDOWS\GS79NNP7.exe
O23 - Service: QSBC5WM3N3 - ??????? - C:\WINDOWS\MBY6A7DNUNLH.exe
O23 - Service: Remote Storm Service - Unknown owner - C:\WINDOWS\system32\thTdg\J002.exe (file missing)
O23 - Service: SBE9U2UAFV5Q - ??????? - C:\WINDOWS\Q554MJ.exe
O23 - Service: UQEL4C8HOH8 - ??????? - C:\WINDOWS\D5Y7E2.exe
O23 - Service: VGV9H - ??????? - C:\WINDOWS\R6ROI8Q.exe
O23 - Service: ZFSR9NL4AG - ??????? - C:\WINDOWS\V5NMCXT1PCBN.exe

After clicking Fix, exit HJT.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner to clean out only temp files and nothing else!

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay the fix is even shorter this time. I also just noticed that the Remote Storm Service driver is not getting fixed. This is due to the malware being sneaky and embedding two spaces after the word Storm. vBulletin (used by the forum) is stupid and eliminates extra spaces thus screwing up the fix. Hopefully the below will work since I will use a code box instead of a quote box. Make sure when you copy and paste into the CFScript.txt file that there are two space after the word Storm.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) -
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) -

After clicking Fix, exit HJT.



Now we need to use ComboFix again.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

Code:

KILLALL::
 
Driver::
Remote Storm  Service
ZFSR9NL4AG

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay we got rid of the last visible signs of malware.

What exactly did they have you try?

• Do you get an IP address from your router or modem?
• Do you have your Internet Protocol (TCP/IP) Properties set to Obtain an IP address automatically?
• Do you also have Obtain DNS server address automatically?
• Does your connection work in safe boot mode?
• Which browser are you using?

SUPERAntiSpyware as a Repair option (see Preferences, Repairs) to Repair broken Network Connection (Winsock LSP Chain) have you tried it.

 

Are you sayng you have now reinstalled this PC?

Yes there are many infections that use removable devices to spread their infections. That is one reason I have posted the below:

Disabling AutoRuns

 

You're welcome. Make sure you work thru the below on your newly installed system:

How to Protect yourself from malware!