Virus/malware infection, please help

Ok, umm, I might not be doing this right, I don't have time to read through all the etiquette because my computer keeps resetting itself randomly. I've got a virus or something, I don't know where or how, I was just reading through some forums then suddenly I was getting Chinese pop-ups every few minutes, things adding themselves to my IE bar, computer resetting itself, computer running slow when it's not resetting itself, not detecting my sound card for some reason, no borders around explorer windows for some reason, stuff like that. I also get an error about mgpbop15.dll (I think) when it starts up, saying it couldn't start because something is already running it. I've run as many scans and deleted as many things as I feel comfortable doing without exprt advice. Please help quickly, I'm a multimedia student and I have exams coming up and I NEED a computer.

 

Thanks for your help, but my problem still isn't fixed. I've run full and quick scans in AVG in normal mode and safe mode and no matter how many times I quarantine some files they keep coming back. I've used a bunch of other programs, too, Windows Defender, Trojan Remover, Panda whatever it is, nothing works.

 

zombibubonik,

Per your HJT log you have a lot of baddies.

Please download VundoFix.exe to your desktop. Reboot into Safe Mode and procede with the below.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Once you complete the VundoFix above, I need you to run the Panda Online Scan listed in the READ ME. Once you complete the scan attach the log, also attach a fresh HJT log with the VundoFix log.

 

I ran VundoFix and HJT, VundoFix didn't find anything, I've been trying to run Panda but my computer keeps restarting before it finishes. Here are my VundoFix and HJT logs, I'll keep trying Panda and post the log if it finishes.

 

Download AVG AntiSpyware, save to your desktop and double click to install once it completes.

Once you have installed the program, download the updates using the link below. Once downloaded, double click to install.

AVG AntiSpyware Updates

After you have installed the updates, run the program from the icon on the desktop. Once it has opened run a full scan removing all found objects. After the scan has completed reboot and attach the log along with a fresh HJT log.

 

It's no good, my computer just doesn't stay running long enough to do any long scans. The best I can give you is AVG always reports finding C:\WINDOWS\system32\almst.exe every start-up. It reports it as Adware.Baidu and no matter how many times I delete it or quarantine it, it always comes back. Also, when I run some exes (AVG included), I get a notice in the bottom corner saying C:\$Mft or something is corrupt and to run Chkdsk. I'm sorry I can't get any logs to you, my computer just seems to be getting worse.

 

See if you can run this thread: Using SDFix

 

It reboots during Stage 2, while it's scanning before start-up. I'm attaching the log of how far it got. On a side-note, my computer runs normally in safe mode, is it ok to scan with AVG and Panda in safe mode? Also, whatever it is has disabled Windows Firewall and won't let me re-enable it, should I download a new firewall?

 

Yes you can run AVG in Safe Mode, however in order to run Panda you must have Cable/DSL as dialup doesn't work in Safe Mode.

Yes, personally I recommend ZoneAlarm Firewall Free.

 

Everything seems to be (mostly) back to normal with the firewall installed. I'm yet to have any unwanted reboots, which is nice, but inconclusive since I haven't run it for long periods of time. The only issues now are that AVG is still telling me about this Adware.Baidu, there's still no border around any windows, and explorer windows (Internet Explorer, My Computer, folders in general) take about 10 times longer to load. It's fine for me, I use Firefox, but other people in my family use IE. People with less patience than me. I really think I need a new computer but my parents seem intent on holding on to this one as long as possible. Attached are HJT and AVG logs.

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Please make sure the Viewing of Hidden Files & Folders is enabled per the READ ME.

Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

cisrv.exe

pmsgr.exe

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.neopets.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://client.jogo.cn/cdn/browser/sidesearch/sidesearch-en.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://client.jogo.cn/cdn/browser/customsearch/customsearch-en.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 211.248.226.254:8080

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {003169BC-AB68-482F-AEA6-B51A47BDDB83} - C:\WINDOWS\system32\ATIAngetser.dll
O2 - BHO: Google Bar - {12365484-96a1-6974-3269-123555124655} - C:\WINDOWS\system32\GoogleBar.dll
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5003.dll (file missing)
O2 - BHO: (no name) - {930FD663-1720-4E8A-BC62-681A8BCEA428} - C:\WINDOWS\system32\adsnwer.dll
O2 - BHO: BrowserProxy4 - {BCF4D74B-E6BD-4C8F-83D7-90D6439705B9} - C:\WINDOWS\system32\AlxTbl.dll

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKCU\..\Run: [Oldt] "C:\WINDOWS\CROSOF~1.NET\cmd.exe" -vt yazr

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

O20 - AppInit_DLLs: C:\WINDOWS\system32\regedit.dll

O21 - SSODL: NetWork - {FC055E7D-8144-4706-8586-2F1C49FCDD2A} - C:\WINDOWS\system32\cmspl.dll
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll

O23 - Service: Performance Moniter (MerDE2) - Unknown owner - (no file)
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)

Again, make sure ALL browser windows are closed when you click FIX.

Next, run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, REBOOT and proceed with the rest of this fix...

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Seems I was a little premature with the "no reset" call, but it certainly lasted longer than usual. Followed your steps and noticed explorer windows opening at normal speed now. I daresay it even seems a smooch faster.

EDIT: Problems I have encountered? None except I couldn't stop those two processes you told me to. One was a system process and the other one just came back when I stopped it. They're both gone from the process tree now, though.

 

Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial.

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

O2 - BHO: Google Bar - {12365484-96a1-6974-3269-123555124655} - C:\WINDOWS\system32\GoogleBar.dll
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5003.dll (file missing)
O2 - BHO: BrowserProxy4 - {BCF4D74B-E6BD-4C8F-83D7-90D6439705B9} - C:\WINDOWS\system32\AlxTbl.dll

O4 - HKLM\..\Run: [RichMedia] C:\WINDOWS\system32\Rundll32.exe "C:\PROGRA~1\pcast\hbcast.dll",WaitWindows

O21 - SSODL: NetWork - {FC055E7D-8144-4706-8586-2F1C49FCDD2A} - C:\WINDOWS\system32\cmspl.dll
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll

O23 - Service: Indexing Service (IndexingService) - Unknown owner - C:\WINDOWS\system32\cisrv.exe (file missing)

Again, make sure ALL browser windows are closed when you click FIX.

• Now Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
• On the page that opens, scroll down to Power Manager (PowerManager) & Indexing Service (IndexingService)
• Then right click the entry, select Properties and press Stop Service.
• When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
• Click OK until you get back to Windows.

• Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
• At the lower right, click on the Config button
• Then click the Misc tools button
• Select Delete an NT Service
• Copy/pastePowerManager & IndexingService into the box that opens, and press OK
• If you receive any error messages just ignore them and continue.
• Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

Next, run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\system32\AlxTbl.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\GoogleBar.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

Once you complete this post, reboot again and attach a fresh HJT log.

 

Still getting restarts as of this post. webwork.dll and cmspl.dll just keep putting themselves back after deleting them.

 

First, please look in Add/Remove Programs and uninstall AVG Anti-Spyware 7.5 & Windows Defender.

After removing the above, reboot into Safe Mode!

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

O2 - BHO: Google Bar - {12365484-96a1-6974-3269-123555124655} - C:\WINDOWS\system32\GoogleBar.dll
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5003.dll (file missing)
O2 - BHO: BrowserProxy4 - {BCF4D74B-E6BD-4C8F-83D7-90D6439705B9} - C:\WINDOWS\system32\AlxTbl.dll

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O21 - SSODL: NetWork - {FC055E7D-8144-4706-8586-2F1C49FCDD2A} - C:\WINDOWS\system32\cmspl.dll (file missing)
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll

Again, make sure ALL browser windows are closed when you click FIX.

Next, run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\system32\AlxTbl.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\webwork\webwork.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\GoogleBar.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above reboot once more and attach a fresh HJT log.

 

They're not going away, they just keep coming back as soon as I delete them.

 

Okay let's start by downloading two tools we will need:

- Process Explorer 10.21

- Pocket KillBox

Extract them to there own folder somewhere that you will be able to locate them later.

Reboot in Safe Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of GoogleBar.dll, webwork.dll & AlxTbl.dll once and then click the kill button. After you have killed all of the GoogleBar.dll, webwork.dll & AlxTbl.dll's under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of GoogleBar.dll, webwork.dll & AlxTbl.dll and kill it.

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: Google Bar - {12365484-96a1-6974-3269-123555124655} - C:\WINDOWS\system32\GoogleBar.dll
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5003.dll (file missing)
O2 - BHO: BrowserProxy4 - {BCF4D74B-E6BD-4C8F-83D7-90D6439705B9} - C:\WINDOWS\system32\AlxTbl.dll

O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP001.TMP\"

O21 - SSODL: NetWork - {FC055E7D-8144-4706-8586-2F1C49FCDD2A} - C:\WINDOWS\system32\cmspl.dll (file missing)
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll


Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\WINDOWS\system32\GoogleBar.dll
C:\WINDOWS\webwork\webwork.dll
C:\WINDOWS\system32\AlxTbl.dll

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot post a new HJT log.

 

Sorry about it taking so long, it was working alright for awhile but just recently it's been playing up again.
I did as many of those things as I could, chaslang, but like I said in my earlier posts my computer kept resetting so I couldn't keep it going long enough to run many scans or read much in the way of threads.
bjgarrick Process Explorer didn't do anything, I couldn't find any of those processes in either of the threads bits. One file I'm suspicious of but can't get rid of is C:\WINDOWS\system32\almst.exe, is this anything or shouldn't it be there? It seems to be the cause of any adware according to AVG

 

It took me a few goes to download and run them, I think I got reset about 6 times, but here they are.

 

zombibubonik,

To help clean these infections I would like you to go back to the READ ME and try to run the online scans. Be sure you try the Panda scan and if possible Bit Defender to.

If you have Cable/DSL then run them in Safe Mode.

 

Uhh I ran the scans but I forgot to save the reports, sorry. Panda didn't find anything though, and I remember BitDefender found a lot of update*.exe where * is a number that it said were some sort of Trojan. Also sometimes when I start up it downloads "new Windows updates", this happens most days, and last night my computer started acting funny and when I checked the processes there was a system process called update.exe

 

I understand but I need those logs, it will help you out by removing some of this stuff and me out to help move the cleaning along.