[gemee]

Tried again, but it refuses to start in Safe Mode. Something interesting though. When the screen does come up with my icons, there is a square box with the message "Open File-Security Warning"
Name; Strings.exe
Could this have anything to do with why I am unable to achieve Safe Mode??

[Advertisements]

I went in an deleted the Strings.exe, and tried once again to start in Safe Mode tapping f8 and nothing happened. This is a stupid question, but does the f need to be in caps?

[gemee]

I went in an deleted the Strings.exe, and tried once again to start in Safe Mode tapping f8 and nothing happened. This is a stupid question, but does the f need to be in caps?

[gemee]

I have to leave the house for approx. 1/2hr. I will be back at 9pm p.s.t........

[gemee]

I am back, but my computer still will not start in Safe Mode. Is there another way that I can try?

[gemee]

WOO HOO!!!! Someone sent me this, and it seems like it has removed ALL the spyware!!!.... http://www.webroot.c...ownloads/whytry

[gemee]

Someone over on eBay posted this for me, and after trying a bazillion things, this free trial program seems to have wiped my computer clean. If it continues to remain clean tonight, I will dance a JIG!!!!!! http://www.webroot.c...ownloads/whytry

[Kat]

Hello and welcome to GeeksToGo. Webroot is being sold on EBAY???? Could you possibly give me a link to this?? I would appreciate it.

Also, to date, Webroot does not fully remove the Aurora infection. We have a very easy-to-use removal method that works like a charm every time. Your problems may *appear* to be gone, but they may not be fully. Webroot is a GREAT program, but as I said, as far as I know it doesn't fully handle Aurora. If it has been updated to do so, that would be WONDERFUL!!

Would you mind posting a HijackThis log here in this thread by using the Add Reply button so I can see if in fact it did fully clean your system??

Thanks!

[gemee]

Hi! Thanks for replying. No, this is not being sold on eBay, but someone in the eBay Computer Chat room gave me a link to this. His id is xyste. Here is a link to the board; http://chatboards.eb...rum=1&thread=25

I have been trying all day to get rid of the spyware on my computer, but every program that I used, was unsuccessful. Someone was helping me on another thread of majorgeeks, but she "disappeared" tonight, so I went over to eBay. I got the link on the chatboard. Let me do a lof right now, and I will come right back and post it for you.

[gemee]

Here is my log;

Logfile of HijackThis v1.99.1
Scan saved at 10:16:51 PM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jucheck.exe
C:\Program Files\BigFix\BigFix.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\knap.exe
C:\Program Files\Linksys\Wireless-B USB Network Adapter\WUSB11Cfg.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Linksys\Wireless-B USB Network Adapter\NICServ.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\carol\Local Settings\Temp\Temporary Internet Files\Content.IE5\2OSXEAEC\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.com/...ame=h:h:home:US
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\carol\Application Data\Mozilla\Profiles\default\d48dpp8z.slt\prefs.js)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [vrrxbd] c:\windows\system32\vgkbgxv.exe r
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [a0v3RTGqS] aclmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Wireless-B USB Network Adapter WLAN Monitor.lnk = C:\Program Files\Linksys\Wireless-B USB Network Adapter\WUSB11Cfg.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\dncompos.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Unknown owner - c:\Program Files\Intel\NCS\Sync\NetSvc.exe (file missing)
O23 - Service: NICSer_WUSB11 - Unknown owner - C:\Program Files\Linksys\Wireless-B USB Network Adapter\NICServ.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Do you see anything that I should be worried about?

[gemee]

Kat, please let me know if you see something further that I need to do to my system.

[Kat]

Not too bad, actually! Let's do this:

Open HijackThis and scan for a log. Place a check next to ONLY the following items:

O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [vrrxbd] c:\windows\system32\vgkbgxv.exe r
O4 - HKCU\..\Run: [a0v3RTGqS] aclmon.exe


Now make sure NO other programs or windows are open, and click the "Fix Selected" button.

Reboot into Safe mode by repeatedly tapping the F8 key as the computer begins to boot. From there, you will be taken to a screen where the first option is to enter Safe Mode.

Find the following files and delete them:

C:\WINDOWS\system32\exp.exe
c:\windows\system32\vgkbgxv.exe
c:\windows\system32\aclmon.exe


Reboot normally.

I need you to download MWav to a convenient location.

This scan might take around 3+ hours to finish when set to scan everything.
I need you to run MWav by double-clicking on mwav.exe.
Put a check next to the below items before scanning:

• Memory
• Startup Folders
• Drive - All Local Drives
• Folder - then click "browse" to change the directory to C: (default is C:\Windows)
• Registry
• System Folders
• Services
• Include Sub-Directory
• Scan All Files

Please make sure ALL of these are checked, then press the Scan button. This typically will take hours to complete.

**NOTE*** Sometimes MWav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.

On the bottom portion of the window, you will see the lower panel where MWav is listing "infected items", please highlight everything in that lower panel and copy them by holding CTRL + C then paste it here. The whole log will be extremely BIG so there is no way to post the log. I just need the infected items list.

Reply here with a fresh HijackThis log, and a copy of the MWav Infected Items list (if there IS one!)

[Kat]

Kat, please let me know if you see something further that I need to do to my system.

As you see, I just posted instructions. It had only been eight minutes after you posted your log before you asked me this. I was working on analyzing the log, and working up the response. We do tend to take the time we need to ensure we do things right . Also, we all tend to sleep once in awhile, which is probably why your helper at the other forums "disappeared". I will be heading to bed myself pretty soon, and will be back in the morning.

[gemee]

Thanks so much Kat, for your quick response! You know earlier, I tried to start in Safe Mode, and my computer wouldn't co-operate. I tried about 5 times.
Can I try deleting those things in Normal mode?

[Kat]

Sorry about this, bananafanafo. I came across the new thread earlier. Gemee indicated she had been being helped on MAJORGEEKS, not here. Had I known the original thread was here at that point, I would not have begun giving advice. I have merged the two threads, and will gracefully bow out now.

Gemee, you need to please stick to this topic. Bananafanfo is one of the BEST at this, and will be able to help you. However, she also has MANY other people she helps, along with raising a one year old daughter, and she does need to sleep sometimes. PLEASE try to be patient if she does not reply to you within a few minutes of your posting.

Thank you.

[gemee]

No problem. It looks like I was able to find resolution to the problem. Thanks