Virus problem

Discussion in 'Malware Help (A Specialist Will Reply)' started by GeauxSaints, Aug 4, 2006.

  1. GeauxSaints

    GeauxSaints Private E-2

    I have a problem with a virus named "ADW_WEBSEARCH.BD". I have followed the instructions given the best I can. Ran Ccleaner, Spybot, and Defender all in safe mode. Hijack this has been uploaded.

    Thanks for your help.
     

    Attached Files:

    GeauxSaints, Aug 4, 2006
    #1
  2. GeauxSaints

    GeauxSaints Private E-2

    Here is the correct uploaded material. Sorry about that.
     

    Attached Files:

    GeauxSaints, Aug 4, 2006
    #2
  3. GeauxSaints

    GeauxSaints Private E-2

    here are my specs

    Operating System: Microsoft Windows XP Professional
    CPU Type: AMD Athlon XP-A, 1833 MHz (5.5 x 333) 2500+
    Motherboard Name: Abit NF7(-S) v2.0 (5 PCl, 1 AGP, 3DIMM, Audio, LAN)
    Motherboard Chipset: nVIDIA nForce2 Ultra 400
    System Memory: 512 MB (PC3200 DDR SDRAM)
     
    GeauxSaints, Aug 4, 2006
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Where are the logs from the two online scanners as requested in step 6 of the READ ME? These two scans must be run!


    Make sure viewing of hidden files is enabled (per the tutorial).
    First look in Add/Remove programs for MyGlobalSearch and uninstall if found
    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete    :
    C:\Program Files\MyGlobalSearch <--- the whole folder

    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, Aug 4, 2006
    #4
  5. GeauxSaints

    GeauxSaints Private E-2

    I tried to run Bitdefender, but the scan refused to load. I downloaded "ActiveX" and "Java" and the scan still refused to load. I did manage to conduct a Panda Scan, and I have attached the saved report. The report indicated that there were 54 Spyware and 3 Hacking tools.

    Done.

    I found “My Global Search Bar” on my Add/remove programs but when I tried to remove it a prompt came up saying “access is denied”.

    Which ones did you want me to end?

    I did this and I have included the new HJT log.

    I did this, rebooted, and ran Ccleaner before starting HJT.

    Things seem to be working properly other than the Trend Micro alert, which should be taken care of with step 1.
     

    Attached Files:

    GeauxSaints, Aug 4, 2006
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That Processes to kill line was a something I was supposed to delete from your post! Ignore it.

    We have a little more to do!

    Now Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now run Windows Explorer and delete the below (use safe mode if necessary):

    C:\Documents and Settings\Brent\Start Menu\Programs\WhenU <--- the whole folder
    c:\program files\Save <--- the whole folder

    C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\chrome\whenu_ff.jar
    C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll
    C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll
    C:\Program Files\Netscape\Netscape Browser\plugins\NPMyGlSh.dll

    Now if you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Aug 6, 2006
    #6
  7. GeauxSaints

    GeauxSaints Private E-2

    That worked. Thanks again for your help.
     
    GeauxSaints, Aug 6, 2006
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Aug 6, 2006
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds