win32/winwebsec

Liv2bhappy · Oct 15, 2009

I have some kind of a trojan on my laptop and I could really use some help. I read the removal of malware instructions but after removing Java and reinstalling I can no longer access the internet. An error message appears stating windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item. I am using my daughters computer to contact you. It took numerous attempts to install Super Antispyware but I did eventually get it installed but nothing happens when I click the executable file. I renamed the file to SAS.exe as you instructed but nothing happens when I click on it. I was able to run it in Safe Mode but the laptop shuts down in the middle of the scan. I am running Avast and Windows Defender. Avast found win32:malware-gen in file c:\ncylnewm.exe. Adaware found win32.backdoor.bredavi in file c:\grce.exe which was placed into quarantine. Windows Defender found trojan: win32/winwebsec. I ran Adaware and Avast in Safe Mode and they removed the infected files but as soon as I rebooted in normal mode the trojan is still present. I cannot open system restore and I was unable to get into Msconfig per your instructions. I downloaded all of the files you recommended to a USB drive but after I was unable to use Super antispyware in normal mode I figured I better ask for some help. I am unsure at this point what I can do if I cannot use the software tools you recommended which means I am also unable to attach the reports you need. Please advise me on what would be my next step. I hope you are able to help. Thanks for your time in advance.

Liv2bhappy · Oct 15, 2009

I forgot to mention earlier that something called Security Tool is continually popping up on my screen and it is taking forever for my machine to reboot.

Liv2bhappy · Oct 16, 2009

I purchased Spyware Doctor online which slowed down the Security Tools pop up. I noticed under Task Manager that a file with all numbers was running under processes. When I clicked end process this stopped Security Tools from running which then allowed me to install the tools and run the scans that you instructed. I was unable to run Root Appeal however. I received a message stating Root appeal could not initialize driver. Please contact the author. I tried downloading the file again and reinstalling but I receive the same error twice upon running.

My laptop seems to be starting up much quicker after running all of the scans. I now have internet connection as well. If you could review the logs and let me know what my next step would be, I would truly appreciate it.

TimW · Oct 19, 2009

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
c:\programdata\domemaha
c:\programdata\kipiheba
c:\programdata\kewevuro
c:\programdata\tomimago
c:\programdata\godadoju
c:\programdata\rizazugu
c:\programdata\tadovoyi
c:\programdata\piyuzuju
c:\programdata\fudimapo
c:\programdata\tumazuba
c:\programdata\ludimeda
c:\programdata\mekopigo
c:\programdata\vigodite
c:\programdata\vagiluke
c:\programdata\bimoyuka
c:\programdata\daluwimo
c:\programdata\tigifofi
c:\programdata\rokonuge
C:\_311440_
C:\mexlsjq.exe
C:\miucimsp.exe
c:\windows\system32\wiprocas.exe
c:\windows\system32\netiougc.exe
c:\windows\System32\dahovibo.exe
c:\windows\System32\hajigira.exe
c:\windows\System32\keradebu.exe
c:\windows\System32\reveraza.exe
c:\windows\System32\yozugifi.exe
c:\windows\System32\jabizati

Folders to delete:
C:\_311440_
c:\windows\System32\jabizati
c:\programdata\domemaha
c:\programdata\kipiheba
c:\programdata\kewevuro
c:\programdata\tomimago
c:\programdata\godadoju
c:\programdata\rizazugu
c:\programdata\tadovoyi
c:\programdata\piyuzuju
c:\programdata\fudimapo
c:\programdata\tumazuba
c:\programdata\ludimeda
c:\programdata\mekopigo
c:\programdata\vigodite
c:\programdata\vagiluke
c:\programdata\bimoyuka
c:\programdata\daluwimo
c:\programdata\tigifofi
c:\programdata\rokonuge
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
-
Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Liv2bhappy · Oct 19, 2009

Hi,

Thanks for responding. I ran Avenger and am attaching avenger.txt file. I ran the MGtools\GetLogs.bat file but I cannot seem to find the MGLogs.zip folder. I searched everywhere and am unable to find it, so I cannot attach the file you requested. More help with this would be appreciated.

I've noticed a few things happening. I ran an Avast virus scan this morning before you you replied to me and it found 2 things. win32malware-gen and win32malob-t [crypt]. I also ran Malwarebytes and it found c:\windows\system32\yozugifi.exe.

Also, I have been having problems with my America Online program. My address book is empty. I used AOL live help and they could not help me. I deleted AOL 9.0VR from my computer and installed an updated version 9.5. Each time I reboot, I lose my address book. Not sure if you know why this is.

Another thing I've been having problems with is Adobe Flash Player Version 10. When I play games on facebook it keeps telling me I need to upgrade my flash player which I have done numerous times. It seems like once the computer reboots files are missing again.

Windows is blocking Malwarebytes from starting up. I am receiving notification in the bottom right area of my screen.

Start up seems slower than usual.

Can I ask you a question? Is it safe to continue using my online banking. I just want to be sure that my machine has not been compromised with everything that has been happening.

I will await your response.

Thank you!!!

Liv2bhappy · Oct 19, 2009

Hi,

I figured out what I did wrong. UAC was enabled when I tried to run the MGtools scan before. I am attaching the log file. I apologize, I am not familiar with programs.

Please let me know what else you need me to do.

Thanks Again.

TimW · Oct 22, 2009

Let's just remove some of the items in your temp folder.

Please use add/remove programs to uninstall:
Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Users\Dianne\AppData\Local\Temp\4397-2-4.ini
C:\Users\Dianne\AppData\Local\Temp\aolsetup.ini
C:\Users\Dianne\AppData\Local\Temp\SiNdInst.dll
C:\Users\Dianne\AppData\Local\Temp\snc12a6.tmp
C:\Users\Dianne\AppData\Local\Temp\snc12a7.tmp
C:\Users\Dianne\AppData\Local\Temp\snc12a8.tmp
C:\Users\Dianne\AppData\Local\Temp\snc12a9.tmp
C:\Users\Dianne\AppData\Local\Temp\snc12aa.tmp
C:\Users\Dianne\AppData\Local\Temp\snc12bb.tmp
C:\Users\Dianne\AppData\Local\Temp\snc12bc.tmp
C:\Users\Dianne\AppData\Local\Temp\snc2f79.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3026.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3046.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3056.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3096.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3104.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3144.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3ddb.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3ddc.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3dec.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3dfd.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3e0e.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3e0f.tmp
C:\Users\Dianne\AppData\Local\Temp\snc3e10.tmp
C:\Users\Dianne\AppData\Local\Temp\snc49fb.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4a0c.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4a0d.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4a0e.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4a0f.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4a20.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4a21.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4c34.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4c35.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4c75.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4c85.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4cb5.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4cb6.tmp
C:\Users\Dianne\AppData\Local\Temp\snc4cd6.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60bc.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60bd.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60be.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60bf.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60c0.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60c1.tmp
C:\Users\Dianne\AppData\Local\Temp\snc60c2.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8cb5.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8cb6.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8cb7.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8cb8.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8cb9.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8ce9.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8cfa.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8d90.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8da1.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8da2.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8da3.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8da4.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8da5.tmp
C:\Users\Dianne\AppData\Local\Temp\snc8db5.tmp
C:\Users\Dianne\AppData\Local\Temp\snc95e1.tmp
C:\Users\Dianne\AppData\Local\Temp\snca9a1.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb04c.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb05c.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb05d.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb09d.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb0bd.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb0be.tmp
C:\Users\Dianne\AppData\Local\Temp\sncb0de.tmp
C:\Users\Dianne\AppData\Local\Temp\sncbd60.tmp
C:\Users\Dianne\AppData\Local\Temp\sncce95.tmp
C:\Users\Dianne\AppData\Local\Temp\snccee4.tmp
C:\Users\Dianne\AppData\Local\Temp\snccee5.tmp
C:\Users\Dianne\AppData\Local\Temp\snccef6.tmp
C:\Users\Dianne\AppData\Local\Temp\snccef7.tmp
C:\Users\Dianne\AppData\Local\Temp\snccef8.tmp
C:\Users\Dianne\AppData\Local\Temp\snccf08.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd20e.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd20f.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd367.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd368.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd379.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd5da.tmp
C:\Users\Dianne\AppData\Local\Temp\sncd5db.tmp
C:\Users\Dianne\AppData\Local\Temp\sncdaf4.tmp
C:\Users\Dianne\AppData\Local\Temp\snce245.tmp
C:\Users\Dianne\AppData\Local\Temp\snce265.tmp
C:\Users\Dianne\AppData\Local\Temp\snce266.tmp
C:\Users\Dianne\AppData\Local\Temp\snce267.tmp
C:\Users\Dianne\AppData\Local\Temp\snce278.tmp
C:\Users\Dianne\AppData\Local\Temp\snce288.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf98b.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf99c.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf99d.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf99e.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf9ae.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf9af.tmp
C:\Users\Dianne\AppData\Local\Temp\sncf9b0.tmp
C:\Users\Dianne\AppData\Local\Temp\ssupdate.exe
C:\Users\Dianne\AppData\Local\Temp\SysInfoWinModuleUninstaller.log
C:\Users\Dianne\AppData\Local\Temp\TFRE42.tmp
C:\Users\Dianne\AppData\Local\Temp\tsverchk.dll
C:\Users\Dianne\AppData\Local\Temp\uninst.dll
C:\Users\Dianne\AppData\Local\Temp\uninst.tmp

Programs to launch on reboot:
C:\Users\Dianne\Desktop\ComboFix.exe
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip
* C:\Avenger.txt

The issues with those programs should be addressed in the software forum.

Liv2bhappy · Oct 22, 2009

Viewpoint media player is used by the America Online program. I originally deleted it but that is when I started having problems with my AOL address book which I am still having problems with even after uninstalling and reinstalling. Is it really necessary to remove Viewpoint Media player?

TimW · Oct 22, 2009

AOL is such a PITA>.....no., as it usually just comes back again.

Liv2bhappy · Oct 22, 2009

Here are the logs that you requested. I will wait to hear back from you.

Thanks Again for your help.

TimW · Oct 24, 2009

I am not seeing any malware in your logs. Tell me what issues you may still have.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore ato create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Liv2bhappy · Oct 24, 2009

Hi,

The only issues I am having is with Flash player having to be reinstalled each time computer is rebooted and I also have to keep uninstalling and reinstalling America Online because my address book keeps disappearing upon reboot. I think one of the scans that I was requested to run must have deleted some registry keys. They were both working fine up until then. Kind of a bummer that I can't figure out how to fix it and real PITA having to reinstall. Other than that...my laptop seems to running good. Any suggestions on flash player and AOL problem? I searched software forum couldn't seem to find anything.

TimW · Oct 26, 2009

I do not know why you are having those issues. Nothing in the fixes or scans removed anything that would block those installations.

I suggest that you post in the software forum for additional assistance.

Log in or Sign up

win32/winwebsec

Liv2bhappy Private E-2

Liv2bhappy Private E-2

Liv2bhappy Private E-2

Attached Files:

MGlogs.zip

combofixlog.txt

SUPERAntiSpyware Scan Log - 10-16-2009 - 11-29-21.log

mbam-log-2009-10-16 (11-58-38).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Liv2bhappy Private E-2

Attached Files:

avenger.txt

Liv2bhappy Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Liv2bhappy Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Liv2bhappy Private E-2

Attached Files:

avenger.txt

MGlogs.zip

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Liv2bhappy Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member