twink64.exe and systime.exe!!!! AAAAAAGH!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by boudewijnzen, Oct 26, 2004.

  1. boudewijnzen

    boudewijnzen Private E-2

    HIya, im a complete novice when it comes to computer things really, but i know enough to have realised there was adware on my computer, and its got to the point where my machine is pretty much crippled.
    i can now; Only open one browser at a time
    My startup page is now a random search site
    Browser spontaniously closes
    Various error messages, all leading to browser closing
    So...I downloaded and used Ad-aware and it removed quite a large amount of files, the problem however still existed, i downloaded The Cleaner, it did the same, but problem still existed, i downloaded Spyware Doctor, it did the same and problem STILL existed, plus ontop of that its little box pops up every 30 seconds with a new cookie its removed. So, then, i got hold of AVG, updated it and ran it, and it found 86 different infections, all of which could be put into the Virus Vault bar two, twink64 and systime, now when ive tried manually removing these windows refreshes and im back at desktop again. Now ive read the posts on here etc, and seen this Hijackthis spoken of so ive downloaded it in anticipation of someone beng able to offer me help. But any advice offered MUST be given in simplest terms possible, as i really am a novice, but im so angry that machine has been crippled because of this. Any help would be massively gratefully received, thanks.
     
    boudewijnzen, Oct 26, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to MG's Boudewijnzen,

    Our standard procedures require that you please follow all the steps in this Sticky thread < READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal >

    If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

    NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

    From you first post it appears like you may have done some of the steps in that thread but not all. Please follow all of the steps and then if you are still having a problem make sure you have HijackThis version 1.98.2 and you should read the tutorial in this Sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

    Do NOT run Hijack This from the Desktop, a temp folder, or from a sub-folder of C:\Documents and Settings, or choose run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
     
    chaslang, Oct 26, 2004
    #2
  3. boudewijnzen

    boudewijnzen Private E-2

    thanks, im currently in the process of performing the steps in the link anyway, i hadnt read it before i posted. I cant get Trend Micro's Free Online Virus Scan to work, but half-way through Symantec Security Check i can now open more than one browser, and it has detected 1 file. I'll finish the steps and do as you said with the Hijack This! program. Thanks,
     
    boudewijnzen, Oct 26, 2004
    #3
  4. smedley

    smedley Private E-2

    you are the victim of a browser hijacker, download browser hijack baster and cwshredder and they will help you. also giant anti-spyware will let you see what hijackers you have
     
    smedley, Oct 26, 2004
    #4
  5. GeoFan

    GeoFan Private First Class

    boudewijnzen __ I hope to read your "lessons learned" and a "post-mortem"?
     
    GeoFan, Oct 26, 2004
    #5
  6. Kodo

    Kodo SNATCHSQUATCH

    Thank you smedley.. but we have a tutorial that Chas posted that covers it all... or 98% of it atleast ;)
     
    Kodo, Oct 26, 2004
    #6
  7. boudewijnzen

    boudewijnzen Private E-2

    ok, i followed every step in the tutorial, and as ive just restarted the machine back into normal mode, AVG Resident Sheild has flashed up multiple warnings about twink64 and systime, again, and PC doctor flashed a box saying its startup scan had found 14 infections. oh, and msload is clearly visable on my desktop still. The Hijack This! log is attached. :(
     

    Attached Files:

    boudewijnzen, Oct 26, 2004
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You are not using the current version of HijackThis. Please go back to the READ ME FIRST and get the proper version. Post a new log using it.
     
    chaslang, Oct 26, 2004
    #8
  9. boudewijnzen

    boudewijnzen Private E-2

    sorry, here
     

    Attached Files:

    boudewijnzen, Oct 26, 2004
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should also take look in Add/Remove programs for anything saying Kontiki or MyWebSearch (or MyWeb or MySearch) and uninstall them.

    Tell me if you find those while I look at your log.
     
    chaslang, Oct 26, 2004
    #10
  11. boudewijnzen

    boudewijnzen Private E-2

    CNET download manager, which is in brackets with Kontiki in the ctrl+alt+delete thing, is there but upon my trying to uninstal it freezes up, Search toolbar looks suspicious, but everything else i recognise.
     
    boudewijnzen, Oct 26, 2004
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you look in Control Panel, Add/Remove programs? It sounds like you went to Task Manager using CTRL-ALT-DEL.

    If this next item is installed uninstall it too:
    O4 - HKLM\..\Run: [Windows Accelerators ] c:\things\setup.exe
     
    chaslang, Oct 26, 2004
    #12
  13. boudewijnzen

    boudewijnzen Private E-2

    no, i went to add/remove in control panel, but had to go to task manager to end the add/remove task that had frozen, thats when i noticed CNEt and Kontiki are the same
     
    boudewijnzen, Oct 26, 2004
    #13
  14. boudewijnzen

    boudewijnzen Private E-2

    oh, and no that wasnt installed
     
    boudewijnzen, Oct 26, 2004
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure you have system restore disabled and viewing of hidden files enabled.


    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below processes and End them:
    C:\things\setup.exe
    C:\WINDOWS\System32\systime.exe
    C:\Program Files\Win Comm\WinComm.exe
    C:\Program Files\Win Comm\WinLock.exe
    C:\Program Files\Kontiki\bin\kontiki.exe
    C:\Documents and Settings\Mark Lambton\Application Data\peoi.exe
    C:\WINDOWS\System32\t?skmgr.exe
    C:\HijackThis.exe


    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php

    Do you recognize the www.keele.ac.uk URL on this next line? If not, fix it too otherwise skip it and continue.
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.keele.ac.uk/nsproxy.pac
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
    O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
    O2 - BHO: (no name) - {48AF1470-B136-6BF2-8723-12550E867916} - C:\WINDOWS\System32\sjgrph.dll
    O2 - BHO: (no name) - {58214779-B632-4421-8BEC-8C3561FD6287} - C:\WINDOWS\System32\cjod.dll (file missing)
    O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-444C4C4F5552} - C:\WINDOWS\System32\DLL.dll
    O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\System32\MTC.dll (file missing)
    O2 - BHO: ToolHelper - {AAAE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\WINDOWS\DOWNLO~1\CONFLICT.2\toolbar.dll (file missing)
    O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-716D74632608} - C:\WINDOWS\System32\mtc2608.dll
    O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\System32\MTC.dll (file missing)
    O3 - Toolbar: Search toolbar - {9EAC0102-5E61-2312-BC2D-444C4C4F5552} - C:\WINDOWS\System32\DLL.dll
    O4 - HKLM\..\Run: [Windows Accelerators ] c:\things\setup.exe
    O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
    O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\System32\systime.exe
    O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe
    O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\twink64.exe internat.dll,LoadKeyboardProfile
    O4 - HKCU\..\Run: [cnet] "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet -q
    O4 - HKCU\..\Run: [SysTime] C:\WINDOWS\System32\systime.exe
    O4 - HKCU\..\Run: [Odua] C:\Documents and Settings\Mark Lambton\Application Data\peoi.exe
    O4 - HKCU\..\Run: [Xwt] C:\WINDOWS\System32\t?skmgr.exe
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Global Startup: hallslogon.exe
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185
    O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
    O9 - Extra button: MP3download (HKLM)
    O15 - Trusted Zone: *.windupdates.com
    O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
    O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:\nosuch.mht!http://www.foxik.com/5/files.chm::/file.exe
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/065d0d9270892e5dc923/netzip/RdxIE601.cab
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {DD0470D4-A51B-4306-AC2C-7C160E33B4E7} - http://www.coolball.net/cxc/toolbar.cab
    O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B23E0CC} - http://direct.data-line.us/gba10.exe
    O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B23E0CD} - http://direct.data-line.us/gba10.exe


    Boot into safe mode and use Windows Explorer to delete:
    C:\Program Files\MyWebSearch <-- the whole directory if it still exists
    C:\Program Files\Kontik <-- the whole directory if it still exists
    C:\Program Files\Win Comm <-- the whole directory
    C:\Documents and Settings\Mark Lambton\Application Data\peoi.exe
    C:\WINDOWS\System32\systime.exe
    C:\WINDOWS\System32\twink64.exe
    c:\things\setup.exe
    C:\WINDOWS\System32\DLL.dll
    C:\WINDOWS\System32\mtc2608.dll
    C:\WINDOWS\System32\sjgrph.dll


    We need to delete the below but it cannot be deleted using Windows Explorer as it will not even find it.
    C:\WINDOWS\Downloaded Program Files\bridge.dll

    So here is how we will delete it.
    - Click Start, Run, and enter "cmd" without the quotes to open a command prompt window.
    - Enter the follow commands exactly as written each followed by the enter key:
    cd C:\WINDOWS\Downloaded Program Files\
    attrib -r -h -s bridge.dll
    del bridge.dll
    exit

    The last command will close the command prompt window.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
    I'm not sure what the below line is for. Do you know?
    O4 - HKCU\..\Run: [MP3download] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3download:t
     
    Last edited: Oct 26, 2004
    chaslang, Oct 26, 2004
    #15
  16. boudewijnzen

    boudewijnzen Private E-2

    in the processes list: Wincomm.exe and Winlock.exe instantly reappear after beeing ended, Kontiki, Hijack This arent there. ?
     
    boudewijnzen, Oct 26, 2004
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Try using kill process tree on them. Otherwise just continue. But later when you boot in safe mode to delete files, if you run into a problem deleting anything. Bring up TaskManager and look for the processes and end them. Then try deleting again.
     
    chaslang, Oct 26, 2004
    #17
  18. boudewijnzen

    boudewijnzen Private E-2

    ok, i did all you said, and peoi.exe wasnt there, and neither was sjgrph.dll. plus in command promt bridge.dll wasnt there either. but everything else went fine. new log file is attached.
     

    Attached Files:

    boudewijnzen, Oct 26, 2004
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That looks a lot better but these two are still there. Did you miss them or did they come back?

    O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-716D74632608} - C:\WINDOWS\System32\mtc2608.dll (file missing)
    O4 - Global Startup: hallslogon.exe

    Perhaps we also need to look for and delete hallslogon.exe
    You may have to search for it but set the Advanced options for search first.

    Click Start, Search, All files and folders, enter the file name in the box provided, then click More advanced options and make sure you have checked:
    - Search system folders
    - Search hidden files and folders
    - Search subfolders
    The click the Search button.


    And I ask again, do you know what this next line is for?
    O4 - HKCU\..\Run: [MP3download] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3download:t
     
    chaslang, Oct 26, 2004
    #19
  20. Kodo

    Kodo SNATCHSQUATCH

    Kodo, Oct 26, 2004
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Thanks Kodo!

    Boudewijnzen,

    Thus we bus have HijackThis also fix:
    O4 - HKCU\..\Run: [MP3download] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3download:t

    Then boot in safe mode and delete:
    C:\WINDOWS\System32\MSA64CHK.dll
     
    chaslang, Oct 27, 2004
    #21
  22. boudewijnzen

    boudewijnzen Private E-2

    MSA64CHK.dll wasnt there, and a search verified this. the hallsnet logon is the program to sign me into my halls network in order to get online, but all other lines you highlighted i fixed. The problem now appears to be gone! thanks alot.
     
    boudewijnzen, Oct 27, 2004
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome! I happy you that you recognized the hallslogon.exe as something you need before we deleted it.
     
    chaslang, Oct 27, 2004
    #23

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds