[Totallybent]

Hello,

I've recently obtained a few nasty bugs on my system. First I realized that AntiVirusPro 2009 was installed on my computer (I'm banning my daughter from my laptop!) and tried to uninstall it, but I'm sure you know how well that worked. I researched removing the bug and was advised to download SpyHunter. I ran the program and it said it deleted the files, but I was still having issues.

Trend Micro PC keeps popping up with a notification that there are Vundo files that couldn't be quarantined. I'm unable to manually delete the dll files because it says something is using them.

I went through the tutorials here and ran SpyHunter, SpyBot, SDFix, ATF Clean, SysRestore, Erunt, Malwarebytes, VundoFix (which found no vundo files in the scan) and Hijack this as well as SpyBot.

I'm attaching the logs of those programs for review. I'm afraid to start deleting without some instruction so any help you can give me would be great.

Thanks!

Attached Files

•  hijackThis.txt   11.59KB   188 downloads
•  sdfixreport.txt   15.27KB   265 downloads
•  mbam_log_2008_11_13__13_06_56_.txt   1018bytes   146 downloads

Edited by Totallybent, 13 November 2008 - 02:06 PM.

[Advertisements]

Hello Totallybent and welcome to GeeksToGo. Kids, once you have them you can't give them back lol. Let's see what we can find.

Before running a new scan let's clean out the temporoary folders.

Download ATF Cleaner to your Desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
• Close ALL Internet browsers (very important).
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Now download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
• Open the OTScanIt2 folder and double-click on OTScanIt2.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
• Do not change any settings.
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
• Close Notepad (saving the change if necessry).

Use the Add Reply button and Attach the scan back here (do not copy/paste it as it will be too big to fit into the post). It will be located in the OTScanIt2 folder and named OTScanIt.txt.

I will review it when it comes in.

Cheers.

OT

[OldTimer]

Hello Totallybent and welcome to GeeksToGo. Kids, once you have them you can't give them back lol. Let's see what we can find.

Before running a new scan let's clean out the temporoary folders.

Download ATF Cleaner to your Desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
• Close ALL Internet browsers (very important).
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Now download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
• Open the OTScanIt2 folder and double-click on OTScanIt2.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
• Do not change any settings.
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
• Close Notepad (saving the change if necessry).

Use the Add Reply button and Attach the scan back here (do not copy/paste it as it will be too big to fit into the post). It will be located in the OTScanIt2 folder and named OTScanIt.txt.

I will review it when it comes in.

Cheers.

OT

[Totallybent]

Thanks OldTimer!

I appreciate the help.

Attached Files

•  OTScanIt.Txt   150.56KB   108 downloads

[OldTimer]

Hi Totallybent. Let's see what we can do. Follow the steps below in order:

Step #1

Start OTScanIt2. Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Kill Explorer]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
YN -> &Search -> [?p=ZCfox000]
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
YN -> axlvlr.dll -> 
YN -> iyscgo.dll -> 
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
YN -> "C:\Program Files\America Online 9.0\waol.exe" -> C:\Program Files\America Online 9.0\waol.exe [C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL]
YN -> "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" -> C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe [C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL]
YN -> "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" -> C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL]
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YN -> "C:\Documents and Settings\Chandra Tourtelot\Desktop\wowclient-downloader.exe" -> C:\Documents and Settings\Chandra Tourtelot\Desktop\wowclient-downloader.exe [C:\Documents and Settings\Chandra Tourtelot\Desktop\wowclient-downloader.exe:*:Enabled:Blizzard Downloader]
YN -> "C:\Documents and Settings\Chandra Tourtelot\Local Settings\Temporary Internet Files\Content.IE5\8TAZO92F\wowclient-downloader[1].exe" -> C:\Documents and Settings\Chandra Tourtelot\Local Settings\Temporary Internet Files\Content.IE5\8TAZO92F\wowclient-downloader[1].exe [C:\Documents and Settings\Chandra Tourtelot\Local Settings\Temporary Internet Files\Content.IE5\8TAZO92F\wowclient-downloader[1].exe:*:Enabled:Blizzard Downloader]
YN -> "C:\Program Files\America Online 9.0\waol.exe" -> C:\Program Files\America Online 9.0\waol.exe [C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL]
YN -> "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" -> C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe [C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL]
YN -> "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" -> C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL]
YN -> "C:\Program Files\WolfQuest\WolfQuest.exe" -> C:\Program Files\WolfQuest\WolfQuest.exe [C:\Program Files\WolfQuest\WolfQuest.exe:*:Enabled:WolfQuest]
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
YN -> \{137975e1-91ef-11db-b1e2-806d6172696f} -> 
YN -> \{361ac05d-0e0d-11da-9aa9-806d6172696f} -> 
[Files/Folders - Created Within 30 Days]
NY -> 13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY -> gfmhgpnh.exe -> %SystemRoot%\System32\gfmhgpnh.exe
NY -> MRT.INI -> %SystemRoot%\System32\MRT.INI
NY -> zufezu.lib -> %CommonProgramFiles%\zufezu.lib
NY -> ikerunyqa.vbs -> %SystemRoot%\ikerunyqa.vbs
NY -> sazire.com -> %SystemRoot%\sazire.com
NY -> yzetijo.inf -> %SystemRoot%\yzetijo.inf
NY -> sako.sys -> %SystemRoot%\sako.sys
NY -> oraqedyxi.lib -> %SystemRoot%\System32\oraqedyxi.lib
NY -> siquzycar.com -> %SystemRoot%\System32\siquzycar.com
NY -> wofefi.vbs -> %SystemRoot%\System32\wofefi.vbs
NY -> luxaqy.dat -> %AppData%\luxaqy.dat
NY -> tuwowagy.db -> %SystemRoot%\System32\tuwowagy.db
NY -> mawami.com -> %CommonProgramFiles%\mawami.com
NY -> higojijij.vbs -> %AllUsersProfile%\Documents\higojijij.vbs
NY -> huky._dl -> %AppData%\huky._dl
NY -> fykyma.bat -> %CommonProgramFiles%\fykyma.bat
NY -> zibig.bat -> %CommonProgramFiles%\zibig.bat
NY -> egyno.bat -> %SystemRoot%\egyno.bat
NY -> omidovodo.com -> %AllUsersProfile%\Application Data\omidovodo.com
NY -> uxeve.pif -> %CommonProgramFiles%\uxeve.pif
NY -> enadi.reg -> %AppData%\enadi.reg
NY -> juwet.ban -> %AppData%\juwet.ban
NY -> fygedoxo.dl -> %AllUsersProfile%\Documents\fygedoxo.dl
NY -> tebep.bat -> %AllUsersProfile%\Documents\tebep.bat
NY -> jovobev.vbs -> %AllUsersProfile%\Application Data\jovobev.vbs
NY -> vworftqf.ini -> %SystemRoot%\System32\vworftqf.ini
NY -> nhpoek.dll -> %SystemRoot%\System32\nhpoek.dll
[Files/Folders - Modified Within 30 Days]
NY -> 13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY -> qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
NY -> qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
NY -> gfmhgpnh.exe -> %SystemRoot%\System32\gfmhgpnh.exe
NY -> MRT.INI -> %SystemRoot%\System32\MRT.INI
NY -> vworftqf.ini -> %SystemRoot%\System32\vworftqf.ini
NY -> zufezu.lib -> %CommonProgramFiles%\zufezu.lib
NY -> ikerunyqa.vbs -> %SystemRoot%\ikerunyqa.vbs
NY -> sazire.com -> %SystemRoot%\sazire.com
NY -> yzetijo.inf -> %SystemRoot%\yzetijo.inf
NY -> sako.sys -> %SystemRoot%\sako.sys
NY -> oraqedyxi.lib -> %SystemRoot%\System32\oraqedyxi.lib
NY -> siquzycar.com -> %SystemRoot%\System32\siquzycar.com
NY -> wofefi.vbs -> %SystemRoot%\System32\wofefi.vbs
NY -> luxaqy.dat -> %AppData%\luxaqy.dat
NY -> tuwowagy.db -> %SystemRoot%\System32\tuwowagy.db
NY -> mawami.com -> %CommonProgramFiles%\mawami.com
NY -> higojijij.vbs -> %AllUsersProfile%\Documents\higojijij.vbs
NY -> huky._dl -> %AppData%\huky._dl
NY -> fykyma.bat -> %CommonProgramFiles%\fykyma.bat
NY -> zibig.bat -> %CommonProgramFiles%\zibig.bat
NY -> egyno.bat -> %SystemRoot%\egyno.bat
NY -> omidovodo.com -> %AllUsersProfile%\Application Data\omidovodo.com
NY -> uxeve.pif -> %CommonProgramFiles%\uxeve.pif
NY -> enadi.reg -> %AppData%\enadi.reg
NY -> juwet.ban -> %AppData%\juwet.ban
NY -> fygedoxo.dl -> %AllUsersProfile%\Documents\fygedoxo.dl
NY -> tebep.bat -> %AllUsersProfile%\Documents\tebep.bat
NY -> jovobev.vbs -> %AllUsersProfile%\Application Data\jovobev.vbs
NY -> nhpoek.dll -> %SystemRoot%\System32\nhpoek.dll
[Empty Temp Folders]
[Start Explorer]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTScanIt2 will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.

Step #2

Now let's run an online virus scan. Both of these require Internet Explorer. Try F-Secure first. Sometimes it doesn't play nice with other system components so if it cannot complete then try the Kaspersky scan. You only need to complete one of the two.

Run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!

• Click on Online Services and then Online Scanner
• Accept the License Agreement.
• Once the ActiveX installs,Click Full System Scan
• Once the download completes,the scan will begin automatically.
• The scan will take some time to finish,so please be patient.
• When the scan completes, click the Automatic cleaning (recommended) button.
• Click the Show Report button and Copy&Paste the entire report in your next reply.

If the F-Secure scan did not work then try an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  
  • Scan using the following Anti-Virus database:
    
    • Extended (if available otherwise Standard)
  • Scan Options:
    Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  Select My Computer
• The program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Step #3

Run a new OTScanIt2 scan with the following options

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
• Open the OTScanIt2 folder and double-click on OTScanIt2.exe to start the program.
• Just use the default settings.
• Do not change any other settings.
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it and close Notepad (save changes if necessary).
• Close OTScanIt2 and locate the OTScanIt.txt file in the folder where OTScanIt2.exe is located.
• Attach that file back here in your next reply.

Step #4

Copy/paste the following back here in your next reply:

• The latest OTScanIt2 fix log (look in the OTScanIt2 folder for a file with a name in the form of mmddyyyy_hhmmss.log for month, day, year, hours, minutes, and seconds that the scan was run. )
• The online virus scan report (whichever one you ran)

Attach the following back here in your next reply:

• The new OTScanIt2 scan log

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Cheers.

OT