Well, I don't know what I have going on here....

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Sodflyer, Nov 30, 2004.

  1. Sodflyer

    Sodflyer Private E-2

    I dodn't remember how I found this site but I did find the spyware removal help guide that I did follow...downloaded everything and ran them in safe mode...Adaware is what I use the most but this did not seem to help...I am still getting these dang pop ups! Please advise what to download and run that WILL remove these....they are as bad as every page has one or two that pops up on me now. Thanks Jeff.
     
    Sodflyer, Nov 30, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you have run ALL the steps from Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal and you still have a problem, do the below.

    Make sure you have HJT Version 1.98.2 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

    To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
     
    chaslang, Nov 30, 2004
    #2
  3. Sodflyer

    Sodflyer Private E-2

    I did all of them except for the final two optional items...might give that a try though if I can figure it out...this seems like a simple problem but none of the programs are seeing it...on the online scan it found 5 trojans and removend them ( I think) after that adaware found something like 450 items that were removed, Spybot found some but not as much. The addon to Spybot did not find anything nor did the other programs listed. Jeff.
     
    Sodflyer, Nov 30, 2004
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay so follow the steps of my previous message.
     
    chaslang, Nov 30, 2004
    #4
  5. Sodflyer

    Sodflyer Private E-2

    Ok, here it is...looks like a mess but then again I don't exactly know what I am looking for here. Thanks! Jeff.
     

    Attached Files:

    Sodflyer, Nov 30, 2004
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please remember that no browsers should be running anytime you are using HijackThis. You had IE running:
    C:\Program Files\Internet Explorer\iexplore.exe

    Is there a reason you did not run the Symantec online scan?
     
    chaslang, Nov 30, 2004
    #6
  7. Sodflyer

    Sodflyer Private E-2

    I looked for that after I ran the file and saved it as a txt...there were no running IE... there were only open running windows explorer ( 3 of them).

    Is there a reason you did not run the Symantec online scan? Did not know there was one...Did I miss a step? I will look for it now and see what that does. Jeff.
     
    Sodflyer, Nov 30, 2004
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    ake sure you have system restore disabled and viewing of hidden files enabled.

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below processes and End them:
    AutoUpdate.exe
    caclogon.exe
    sfcrib.exe
    CxtPls.exe


    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
    O2 - BHO: SDWin32 Class - {16774354-00A1-47F9-95DA-20927C3B2884} - C:\WINDOWS\System32\xjfot.dll (file missing)
    O2 - BHO: (no name) - {18896729-C131-73B5-8251-115505F82C11} - C:\WINDOWS\System32\tykrk.dll (file missing)

    O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
    O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [q3oh34e] sfcrib.exe
    O4 - HKCU\..\Run: [Hza] C:\WINDOWS\System32\w?nlogon.exe
    O4 - HKCU\..\Run: [b07nRQKpT] caclogon.exe
    O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
    O15 - Trusted Zone: *.db105.com
    O15 - Trusted Zone: *.windupdates.com
    O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v3/vet_install_popup.pl?1&4&04.00.07.02&unknown&unknown&http://www.toyota.com/images/vehicles/prius/prius_3d/3d_hsd/pc/index.html
    O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab


    Boot into safe mode and use Windows Explorer to delete:
    C:\Program Files\AutoUpdate <--- the whole directory
    C:\Program Files\VBouncer <--- the whole directory
    C:\Program Files\CxtPls <--- the whole directory
    C:\Program Files\Common Files\tsa <--- the whole directory
    C:\WINDOWS\System32\caclogon.exe
    C:\WINDOWS\System32\sfcrib.exe
    C:\WINDOWS\satmat.exe


    Now reboot in normal mode and post a new HJT log. And tell us how things are working.


    The below lines seem a little strange for Norton Antivirus. I'm not sure what they are yet. Seems strange that the O4 line loads 1544.exe but 1545.exe is found running. So leave them be for now.

    E:\Program Files\Norton AntiVirus\1544\1545.exe
    O4 - HKLM\..\Run: [Seti] E:\Program Files\Norton AntiVirus\1544\1544.exe
     
    chaslang, Nov 30, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes! You missed a step. Are you sure the browser was closed? Minimized would still be running.
     
    chaslang, Nov 30, 2004
    #9
  10. Sodflyer

    Sodflyer Private E-2

    Yeah, positive...I did think I left it open so I checked after making the file.... only the Windows explorer windows were open. I know I would not believe me either...Thanks for your help so far...I will run all of that again. Thanks Jeff.
     
    Sodflyer, Nov 30, 2004
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Complete the items I gave you in message # 8. I'll be back later.
     
    chaslang, Nov 30, 2004
    #11
  12. Sodflyer

    Sodflyer Private E-2

    Ok, did it but ot did not have a few directory's you said to delete with the vew all files on etc... did not find the VBouncer and the Tsa directory all of the others were there. here is the HJT log just after boot up... will see how she is doing here in a few. Thanks! Jeff.
     

    Attached Files:

    Sodflyer, Nov 30, 2004
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! That log looks good! How are things working?
     
    chaslang, Nov 30, 2004
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds