Windows explore accessing the Web

RogTheDogMan · Jun 8, 2010

Hello,
I'm having an issue with Windows explore accessing the Web.
I'm also having issues with Firefox being redirected, and something using up the majority of my CPUs resources and 60% to 70% of my bandwidth.
I have run your cleanup procedures from the post. Read me first.
It seemed to help, but I am still having issues. All of the scans were performed with updated programs. But I would disconnect from the Internet, perform the scan, remove what is found. Once all of this was done, I would reconnect to the Internet and more viruses would be downloaded.
Please find the attached logs, as these may help you help me.

Windows XP SP3.
Intel core 2duo E8500 3.17GHz
3 MB RAM @ 3.16Ghz

Kestrel13! · Jun 8, 2010

Hi there and welcome. I am currently reviewing your logs and will get back to you with a set of instructions in the next post I make to you.

Kestrel13! · Jun 8, 2010

Before we continue please delete the below as it was not in the correct location as specified anyway:

C:\Documents and Settings\Administrator\Desktop\MGtools.exe

1. Please go to Add/Remove programs and uninstall the following outdated versions of Java:

Java(TM) 6 Update 4

Java(TM) 6 Update 5

Java(TM) 6 Update 7

2. What is this small file for?

C:\Documents and Settings\Administrator\Application Data\evf2

3. What do you know about these files?

C:\Documents and Settings\All Users\Application Data\gvpgdylr.gft

C:\WINDOWS\Hvexahat.dat

If you do not know then just delete them.

4. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {05F29964-F3D2-463F-929D-D296B8748CFa} - C:\WINDOWS\system32\bitsprx432.dll

O2 - BHO: (no name) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)

O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)

O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)

O4 - HKLM\..\Policies\Explorer\Run: [RTHDBPL] C:\Documents and Settings\Administrator\Application Data\SystemProc\lsass.exe

After clicking Fix exit HJT.

5. Now download The Avenger by Swandog469, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Documents and Settings\Administrator\txbchqhnkh.tmp
C:\Documents and Settings\Administrator\Application Data\SystemProc\lsass.exe
C:\WINDOWS\system32\bitsprx432.dll
C:\WINDOWS\Tzawivanoqiq.bin
C:\WINDOWS\system32\1288624096
C:\WINDOWS\system32\1c4ed0e7
C:\WINDOWS\system32\2DE.tmp
C:\WINDOWS\system32\480151472
C:\WINDOWS\system32\75.tmp
C:\WINDOWS\system32\76.tmp
C:\WINDOWS\system32\sl2105480482
C:\WINDOWS\Temp\BIT12.tmp
C:\WINDOWS\Temp\BIT13.tmp
C:\WINDOWS\Temp\BIT8.tmp
C:\WINDOWS\Temp\BIT9.tmp
C:\WINDOWS\Temp\fla6F.tmp
C:\WINDOWS\Temp\GUR1.tmp
C:\WINDOWS\Temp\GUR1A.tmp
C:\WINDOWS\Temp\GUR2.tmp
C:\WINDOWS\Temp\GUR3.tmp
C:\WINDOWS\Temp\GUR4.tmp
C:\WINDOWS\Temp\GUR5.tmp
C:\WINDOWS\Temp\GUR6.tmp
C:\WINDOWS\Temp\GUR7.tmp
C:\WINDOWS\Temp\Tmp10.tmp
C:\WINDOWS\Temp\Tmp11.tmp
C:\WINDOWS\Temp\Tmp12.tmp
C:\WINDOWS\Temp\Tmp13.tmp
C:\WINDOWS\Temp\Tmp14.tmp
C:\WINDOWS\Temp\Tmp15.tmp
C:\WINDOWS\Temp\Tmp16.tmp
C:\WINDOWS\Temp\Tmp17.tmp
C:\WINDOWS\Temp\Tmp18.tmp
C:\WINDOWS\Temp\Tmp3.tmp
C:\WINDOWS\Temp\Tmp4.tmp
C:\WINDOWS\Temp\Tmp7.tmp
C:\WINDOWS\Temp\Tmp8.tmp
C:\WINDOWS\Temp\Tmp9.tmp
C:\WINDOWS\Temp\TmpA.tmp
C:\WINDOWS\Temp\TmpB.tmp
C:\WINDOWS\Temp\TmpC.tmp
C:\WINDOWS\Temp\TmpD.tmp
C:\WINDOWS\Temp\TmpE.tmp
C:\WINDOWS\Temp\TmpF.tmp
C:\WINDOWS\Temp\Win23.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\1D.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Hqd.exe
C:\WINDOWS\mspenc.dll
C:\WINDOWS\Hjujua.exe

Folders to delete:
C:\WINDOWS\system32\D805~1
C:\WINDOWS\system32\2130489479

Registry values to delete:
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run- | M5T8QL3YW3
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run- | Mkihafoqip
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run- | QZAIB7KITK
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run | Alcmtr

Registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

6. Also delete all files in the below bold folders except ones from the current date (Windows will not let you delete the files from the current day).

C:\Documents and Settings\Administrator\Local Settings\Temp

C:\WINDOWS\TEMP

7. Now I would like for you to download and run Combofix as per these instructions:

A guide and tutorial on using ComboFix

8. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

9. Let me know how things are running now.

RogTheDogMan · Jun 9, 2010

Ok I followed every thing you told me to do to the letter. I got to combofix and followed the instruction. I ran the program and got to around stage 40 or so and it crashed my system and go in to memory dump. I allowed it to complete the dump and reboot. On restart i got a message saying error loading OS. I put my XP disk in to try and fix the problem. It tells me that the volume is full or croup and wants to reformat the drive. I then went into the recovery and DOS to have a look. I can not bring up the Dir's for c:\. I get the following message "An error occurred during directory enumeration.
I can not allow it to reformat the drive, my whole life is on that drive. Can you help with this????

Kestrel13! · Jun 9, 2010

So what exactly happens when you try to boot normally? Can you get in via safe mode? I will have to consult with my colleagues regarding this.

RogTheDogMan · Jun 9, 2010

After the Bios load all it says is "Error loading operating system".

Kestrel13! · Jun 11, 2010

Do you have your XP CD handy?

Can you get into BIOS to see if the hard drive is being detected?

In any case, I think you would be better off working out this problem in the hardware or software forum, and then return here to continue on with what we were doing. I am sorry I cannot assist you personally any further until you have this problem solved.

RogTheDogMan · Jun 11, 2010

I can see the C:\ drive though the set up on my XP CD as well as the 8MB partition, but shows that is empty. And I can see the C:\ drive in the recovery module, but can not see any of the files on it. The stat drive is 80GB and had about 4 GB of space left on it the last time I looked. Im not sure how Comobofix works but it may have filled this empty space while doing its thing and over written part of the windows boot sector.
An ways I'm going to open a post on the software page and talk about recovery. Thank you for your help. If I get it back up and running I'll be back to get the rest of the uglys cleaned out

Kestrel13! · Jun 12, 2010

I personally don't think combofix would have caused that to happen. Yes, so post in software, and come back once you are up and running again

Log in or Sign up

Windows explore accessing the Web

RogTheDogMan Private E-2

Attached Files:

mbam-log-2010-06-07 (10-18-29).txt

MGlogs.zip

rootRepeal logDrivers.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogTheDogMan Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogTheDogMan Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogTheDogMan Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member