[nlbeurs1]

I have succesfully removed TrojanDownloader.xs (and others) via a number of spyware removal applications (S&D, AVG Spydoctor smithfraud) and a lot of manually deleting of infected files. All these spyware programs as well as Symantec (my standard AV) indicate that my system is clean.

There are no symptoms of spyware/viruses or other malware, other than that I cannot access ANY antivirus or spyware websites nor can I access any online virus scanner. The browers will return HTTP 404 error.

I can access these files/websites on another computer, so it's not the router or the router's firewall

Tried installing firefox - will not start
Tries installing MBAM - will not install
Tried installing Superantispyware - will not install

I have replaced the hostfiles with the standard MS version of this file - no succes
Symantec has also fixed the hostfiles - no change

All other websites are fine - can browse without problems

Any help would be appreciated - I guess there is still a remenant of the trojan/spyware left that is causing this symptom?! I've attached the Hijack log .

Cheers!

Attached Files

•  hijackthis.txt   10.6KB   752 downloads

[Advertisements]

Hi there let me see what I can do

Download and save to your desktop OTCleanit we will use this later


Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\vbpdtvdp.exe,
O2 - BHO: (no name) - {4D91F86F-9731-4F70-AD6F-19C36D942F4B} - (no file)
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O4 - HKCU\..\RunOnce: [SpybotDeletingB8599] command /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1297] cmd /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4777] command /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9052] cmd /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.


Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Programs to delete go here

Please note any other programs that you dont recognize in that list in your next response

THEN

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\WINDOWS\system32\vbpdtvdp.exe
  Purity

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Please download ComboFix from Here or Here to your Desktop.


**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Logs required : OTMoveit and Combofix

[Essexboy]

Hi there let me see what I can do

Download and save to your desktop OTCleanit we will use this later


Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\vbpdtvdp.exe,
O2 - BHO: (no name) - {4D91F86F-9731-4F70-AD6F-19C36D942F4B} - (no file)
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O4 - HKCU\..\RunOnce: [SpybotDeletingB8599] command /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1297] cmd /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4777] command /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9052] cmd /c del "C:\WINDOWS\SYSTEM32\qoMghhHb.dll_old"
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.


Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Programs to delete go here

Please note any other programs that you dont recognize in that list in your next response

THEN

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\WINDOWS\system32\vbpdtvdp.exe
  Purity

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Please download ComboFix from Here or Here to your Desktop.


**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Logs required : OTMoveit and Combofix

[nlbeurs1]

Hi Essexboy,

Thanks for your assistance. Very much appreciated.

Now for the result:

"Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis."

DONE

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Programs to delete go here

CHECKED - NOTHING THERE THAT IS NOT FAMILIAR

Please download the OTMoveIt2 by OldTimer.

DONE THROUGH ANOTHER MACHINE AS i CANNOT ACCESS THE GTG.COM SITE, NOR CAN I DOWNLOAD FROM THE URL. PUT THE APP ON THE DESKTOP, BUT IT WILL NOT RUN. LIKEWISE FOR COMBOFIX. SAME RESULTS WHETER IN SAFE OR NORMAL MODE. SAME RESULTS RUNNING FROM THE USB STICK OR THE DESKTOP. ALSO TRIED A RESTART AND I MADE SURE NO APPS (ANTIVIRUS OR OTHERWISE) ARE RUNNING BY KILLING THESE PROCESSES IN THE TASK MASTER.
I've attached the latest hijack log

Thanks mate...

PS: one file that I do see in the running processes is winlogon.exe. I read mixed opinions about this when I goole it. what do you think?

Attached Files

•  hijackthisv2.txt   9.34KB   240 downloads

[Essexboy]

OK what we will do is try and fool the nasty by re-naming combofix. Please follow the instructions carefully

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".
• During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  
• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combo-Fix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[nlbeurs1]

ok, since I can't access the site on the infected PC, can I do exactly the same but on another PC, save to the USB stick and from there move it to the infected PC's desktop to run?

ta

[Essexboy]

If that should fail to run then download and run this analysis programme

Download OTScanit to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

• Close ALL OTHER PROGRAMS.
• Open the OTScanit folder and double-click on OTScanit.exe to start the program.
• Check the box that says Scan All User Accounts
• Check the Radio buttons for Files/Folders Created Within 90 Days and Files/Folders Modified Within 90 Days
• Under Additional Scans check the following:
  • Reg - BotCheck
  • Reg - Desktop Components
  • Reg - Disabled MS Config Items
  • File - Additional Folder Scans
  • File - Purity Scan
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

[nlbeurs1]

Well...you've shown that nasty! Worked like a charm the first time with combo-fix.

logs attached, but I can access the antivirus websites again and as a side bonus performance improved significantly...

From the logs, can you see anything else that requires cleaning?

Cheers

Attached Files

•  ComboFix.txt   7.86KB   512 downloads
•  hijackthisv3.txt   9.57KB   363 downloads

[Essexboy]

OK lets now seek and destroy the rest

Can you now download and run OTScanit as in my post before your report and attach that

[nlbeurs1]

Thanks ,will do. I'm currently travelling and back in a few days to take the next steps. I hope you will still be available to help out when I return..

Cheers

[Essexboy]

I will be away from the 1st June for about a week. If you can get it to me before then I will finish you off

[nlbeurs1]

Ok, I'm back and I got right onto it.. I ran OTscanit. Log attached as per instructions
 OTScanIt.Txt   268.79KB   381 downloads

[Essexboy]

Thank you Well that showed clean, but I did notice that it was run in safe mode. Are you experiencing any problems in normal mode ?

[nlbeurs1]

No other reason than ensuring something is not running that is not supposed to be running. I've attached another log that I ran under normal mode.

 OTScanIt2.Txt   283.55KB   517 downloads

[Essexboy]

Subject to no further problems .....

Now the best part of the day ----- Your log now appears clean

Double click OTScanit once again and you should see a CleanUp! button, press that button, you may get prompted by your firewall that OTScanit wants to contact the internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself

Now to get you off to a good start we will re-set your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your your restore point but this is my method:

1. Select Start > All Programs > Accessories > System tools > System Restore.
2. On the dialogue box that appears select Create a Restore Point
3. Click NEXT
4. Enter a name e.g. Clean
5. Click CREATE

You now have a clean restore point, to get rid of the bad ones:

1. Select Start > All Programs > Accessories > System tools > Disk Cleanup.
2. In the Drop down box that appears select your main drive e.g. C
3. Click OK
4. The System will do some calculation and the display a dialogue box with TABS
5. Select the More Options Tab.
6. At the bottom will be a system restore box with a CLEANUP button click this
7. Accept the Warning and select OK again, the program will close and you are done


Now that you are clean, to help protect your computer in the future I recommend that you get the following free program:

• SpywareBlaster to help prevent spyware from installing in the first place.
• SuperAntispyware Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Keep safe

[nlbeurs1]

CHEERS! YOU"RE THE BEST

Thanks for your help. you've deserved your holiday

One last thing: I've got a hardware and a software firewall as well as Norton Internet Security and this still happened. What antivirus/anti spyware program would you recommend? I will definitely give those 2 programs a go that you suggested earlier.

Thanks again and enjoy your holiday!