Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Some kind of malware, Fun web, HKCR\D, not really sure

Started by greenfairy , Nov 21 2005 02:12 PM

This topic is locked

#1 $Some kind of malware, Fun web, HKCR\D, not really sure: post #1$
greenfairy

Posted 21 November 2005 - 02:12 PM

Member

Member
11 posts

Hello, my computer has been really slow, and just recently gotten so bad that I can hardly get online. I did everything that you had listed on the page from the winsock all the way through to the hijack this. I tried to install the updates, but it wouldnt let me. The last spybot check I ran said there was 4 entries of Fun Web Products, or something, it couldn't fix them. I ranSpyware doctor the other day it found 367 infections, I saved a copy of the result, but it doesnt allow you to fix anything. If I go to certain web pages like this one, I keep getting popups of adware removal, to the point last night it was difficult to tell which was your site, or in my computer. But it is getting better since I ran all the things on the site, but I still keep getting the box that says..Microsoft has encountered a problem, and then everything goes down with it. It is still very slow. Could someone please help me, I really dont know a whole lot about all this, and I would really appreciate your help. Thank you.

#2 $Some kind of malware, Fun web, HKCR\D, not really sure: post #2$
Buckeye_Sam

Posted 23 November 2005 - 09:29 AM

Malware Expert

Member
10,019 posts

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you. :tazz:

Please visit this page and scroll down to Step 5.
Follow the instructions there to download a tool called Hijackthis and post a log here as a reply to this post.

#3 $Some kind of malware, Fun web, HKCR\D, not really sure: post #3$
greenfairy

Posted 23 November 2005 - 11:49 PM

Member

Topic Starter
Member
11 posts

Thank you sooo very much for helping me!!! Ok I did a new scan here is what I got..

Logfile of HijackThis v1.99.1
Scan saved at 9:53:27 PM, on 11/23/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\amygruver\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\system32\jx1.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: MSEvents Object - {CE70731D-F28D-4D81-9D61-C8EE60378401} - C:\WINDOWS\System32\sstqp.dll
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1132555594765
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: sstqp - C:\WINDOWS\System32\sstqp.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

I hope you will still help, thank you very much.

#4 $Some kind of malware, Fun web, HKCR\D, not really sure: post #4$
greenfairy

Posted 24 November 2005 - 12:06 AM

Member

Topic Starter
Member
11 posts

Please don't give up on me I've been waiting forever... I am online usually but not today... thank you for helping....... :tazz:

#5 $Some kind of malware, Fun web, HKCR\D, not really sure: post #5$
Buckeye_Sam

Posted 24 November 2005 - 07:42 AM

Malware Expert

Member
10,019 posts

Don't worry about that. I may not be online all the time, but I'm here a couple times a day(at least) and I will help you until we get you fixed up. :tazz:

Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to extract the files
This will create a VundoFix folder on your desktop.
After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
You will first be presented with a warning.
It should look like this

VundoFix V2.15 by Atri
By using VundoFix you agree that you are doing so at your own risk
Press enter to continue....
At this point press enter one time.
Next you will see:

Please Type in the filepath as instructed by the forum staff
and then press enter:
At this point please type the following file path (make sure to enter it exactly as below!):
- C:\WINDOWS\System32\sstqp.dll
Press Enter to continue with the fix.
Next you will see:

Please type in the second filepath as instructed by the forum
staff then press enter:
At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\System32\pqtss.*
Press Enter to continue with the fix.
The fix will run then HijackThis will open. If it does not open automatically please open it manually.
In HiJackThis, please place a check next to the following items and click FIX CHECKED:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\system32\jx1.dll (file missing)
O2 - BHO: MSEvents Object - {CE70731D-F28D-4D81-9D61-C8EE60378401} - C:\WINDOWS\System32\sstqp.dll
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: http://www.neededware.com
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: sstqp - C:\WINDOWS\System32\sstqp.dll
After you have fixed these items, close Hijackthis.
Press enter to exit the program then manually reboot your computer.
Once your machine reboots please continue with the instructions below.

Download and install CleanUp!

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

Empty Recycle Bins
Delete Cookies
Delete Prefetch files
Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

Then, please run this online virus scan: ActiveScan

Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.

#6 $Some kind of malware, Fun web, HKCR\D, not really sure: post #6$
greenfairy

Posted 26 November 2005 - 05:56 PM

Member

Topic Starter
Member
11 posts

Ok here is the Active scan

Incident Status Location

Adware:adware/neededware Not disinfected C:\WINDOWS\SYSTEM32\WinStat10.dll
Adware:adware/p2pnetworking Not disinfected Windows Registry
Adware:Adware/Adtomi Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D.tmp
Adware:Adware/Adtomi Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1E.tmp
Adware:Adware/Adtomi Not disinfected C:\WINDOWS\system32\82ip77v.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\yabca.dll
Adware:Adware/Adtomi Not disinfected C:\WINDOWS\system32\zygp4.sys
Adware:Adware/Adtomi Not disinfected C:\WINDOWS\zygp4.sys

and here is the vundofix.txt.file

VundoFix V2.15 by Atri
--------------------------------------------------------------------------------------

Listing files contained in the vundofix folder.
--------------------------------------------------------------------------------------

killvundo.bat
process.exe
ReadMe.txt
vundo.reg
vundofix.txt

--------------------------------------------------------------------------------------

Filepaths entered
--------------------------------------------------------------------------------------

The filepath entered was C:\WINDOWS\System32\sstqp.dll

The second filepath entered was C:\WINDOWS\System32\pqtss.*

--------------------------------------------------------------------------------------

Log from Process
--------------------------------------------------------------------------------------

Killing PID 256 'smss.exe'

Killing PID 940 'explorer.exe'
Killing PID 940 'explorer.exe'

Killing PID 336 'winlogon.exe'
Killing PID 336 'winlogon.exe'
--------------------------------------------------------------------------------------

C:\WINDOWS\System32\sstqp.dll Deleted sucessfully.
C:\WINDOWS\System32\pqtss.* Deleted sucessfully.

Fixing Registry
--------------------------------------------------------------------------------------

and finally the newest This

Logfile of HijackThis v1.99.1
Scan saved at 5:46:07 PM, on 11/26/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\amygruver\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\system32\jx1.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: MSEvents Object - {CE70731D-F28D-4D81-9D61-C8EE60378401} - C:\WINDOWS\System32\sstqp.dll (file missing)
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1132555594765
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: sstqp - C:\WINDOWS\System32\sstqp.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Sorry again for being delayed, my monitor went out, uhh... ok now though I am ready to get this done.. thank you again...

#7 $Some kind of malware, Fun web, HKCR\D, not really sure: post #7$
Buckeye_Sam

Posted 26 November 2005 - 08:20 PM

Malware Expert

Member
10,019 posts

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\system32\jx1.dll (file missing)
O2 - BHO: MSEvents Object - {CE70731D-F28D-4D81-9D61-C8EE60378401} - C:\WINDOWS\System32\sstqp.dll (file missing)
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: http://www.neededware.com
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: sstqp - C:\WINDOWS\System32\sstqp.dll (file missing)

Delete these files.

C:\WINDOWS\SYSTEM32\WinStat10.dll
C:\WINDOWS\system32\82ip77v.exe
C:\WINDOWS\system32\yabca.dll
C:\WINDOWS\system32\zygp4.sys
C:\WINDOWS\zygp4.sys

Reboot and post a new hijackthis log.
Let me know how things are working on your end.

#8 $Some kind of malware, Fun web, HKCR\D, not really sure: post #8$
greenfairy

Posted 27 November 2005 - 08:10 PM

Member

Topic Starter
Member
11 posts

Hello. Ok, I did the HIJACKTHIS again, and fixed the checked items. Next I tried to locate the files you told me to delete in my computer. The only one that I could find and delete was
C:\WINDOWS\SYSTEM32\WinStat10.dll

The others,
C:\WINDOWS\system32\82ip77v.exe
C:\WINDOWS\system32\yabca.dll
C:\WINDOWS\system32\zygp4.sys
C:\WINDOWS\zygp4.sys
I couldn't find anywhere, I did the regular search for files, and then tried manually several times, and I cannot find them, I must be overlooking them, I'm sorry.
But I rebooted anyhow and did the new HIJACKTHIS, here it is,

Logfile of HijackThis v1.99.1
Scan saved at 7:48:37 PM, on 11/27/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\amygruver\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1132555594765
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

My computer seems to be getting better already, I haven't got kicked offline yet, and the popups have stopped, it is really slow starting up and everything though, but I think that maybe because I have so many programs downloaded like EWIDO and stuff, so if it starts working again could you please recommend a few that you think I should keep or get rid of. Thank you so much for all the time you are spending on this I really appreciate it.

#9 $Some kind of malware, Fun web, HKCR\D, not really sure: post #9$
greenfairy

Posted 28 November 2005 - 12:08 AM

Member

Topic Starter
Member
11 posts

[b]I am sooo Happy!!! :tazz:

How did you do that, my computer is running great!! Thank you sooo much!!!
Whatever you had me do, wow, I've been dealing with this for months and months in one week you have made it all better!! Thank you.......

#10 $Some kind of malware, Fun web, HKCR\D, not really sure: post #10$
Buckeye_Sam

Posted 28 November 2005 - 11:03 AM

Malware Expert

Member
10,019 posts

I am concerned that you weren't able to find those files. Since Panda found them initially but didn't remove them we have to assume that they are still there.

Download the Pocket Killbox.

Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.

Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:
- C:\WINDOWS\system32\82ip77v.exe
  C:\WINDOWS\system32\yabca.dll
  C:\WINDOWS\system32\zygp4.sys
  C:\WINDOWS\zygp4.sys
Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Your system will reboot now.

It is very important at this time that you visit Windows Update and download and install all critical updates found for your computer. Failure to complete this step will leave you wide open to reinfection.

http://windowsupdate.microsoft.com/

After installing the updates, post one more hijackthis log so I can give it one last review. :tazz:

#11 $Some kind of malware, Fun web, HKCR\D, not really sure: post #11$
greenfairy

Posted 28 November 2005 - 01:03 PM

Member

Topic Starter
Member
11 posts

ok I know this sounds stupid but I did exactly like you said downloaded pillbox, extracted it copied all four file names when I paste from clipboard the only one that will show is C:\WINDOWS\system32\yabca.dll
I have copied them from the bottom up I have did it like 6 times, none of the other files will show in the box, and you said to make sure that they are all there, and they are not so I didn't continue. Should I do them all one at a time?

#12 $Some kind of malware, Fun web, HKCR\D, not really sure: post #12$
Buckeye_Sam

Posted 28 November 2005 - 02:02 PM

Malware Expert

Member
10,019 posts

Yes, try them one at a time. It's possible that those files are already gone, or perhaps changed names.

Let me know how it goes.

#13 $Some kind of malware, Fun web, HKCR\D, not really sure: post #13$
greenfairy

Posted 28 November 2005 - 02:46 PM

Member

Topic Starter
Member
11 posts

Ok well I copied the file C:\WINDOWS\system32\yabca.dll
and deleted it, the other files wouldn't even allow me to copy them in the white box, even one at a time. so the one file is deleted and I rebooted like it said, but i have not did the updates yet, because I am not sure if you are ready for me to since I couldn't delete the other files.

#14 $Some kind of malware, Fun web, HKCR\D, not really sure: post #14$
Buckeye_Sam

Posted 28 November 2005 - 02:50 PM

Malware Expert

Member
10,019 posts

Yes, go ahead and install the updates, up to SP1a. Do not install SP2 yet!

Once you have SP1a installed post a new hijackthis log and we'll see what's left to deal with.

#15 $Some kind of malware, Fun web, HKCR\D, not really sure: post #15$
greenfairy

Posted 28 November 2005 - 03:01 PM

Member

Topic Starter
Member
11 posts

I updated a few days ago, It said left to install is the sp2 so I didn't install anything. Is that ok?

Back to Virus, Spyware, Malware Removal · Next Unread Topic →

As Featured On:

Geeks to Go Forum 343,318 topics
Quick Links FAQ Malware Cleaning Guide How it Works
Downloads 2+ million

View New Content

Some kind of malware, Fun web, HKCR\D, not really sure

#1 $Some kind of malware, Fun web, HKCR\D, not really sure: post #1$
greenfairy

Posted 21 November 2005 - 02:12 PM

Advertisements

#2 $Some kind of malware, Fun web, HKCR\D, not really sure: post #2$
Buckeye_Sam

Posted 23 November 2005 - 09:29 AM

#3 $Some kind of malware, Fun web, HKCR\D, not really sure: post #3$
greenfairy

Posted 23 November 2005 - 11:49 PM

#4 $Some kind of malware, Fun web, HKCR\D, not really sure: post #4$
greenfairy

Posted 24 November 2005 - 12:06 AM

#5 $Some kind of malware, Fun web, HKCR\D, not really sure: post #5$
Buckeye_Sam

Posted 24 November 2005 - 07:42 AM

#6 $Some kind of malware, Fun web, HKCR\D, not really sure: post #6$
greenfairy

Posted 26 November 2005 - 05:56 PM

#7 $Some kind of malware, Fun web, HKCR\D, not really sure: post #7$
Buckeye_Sam

Posted 26 November 2005 - 08:20 PM

#8 $Some kind of malware, Fun web, HKCR\D, not really sure: post #8$
greenfairy

Posted 27 November 2005 - 08:10 PM

#9 $Some kind of malware, Fun web, HKCR\D, not really sure: post #9$
greenfairy

Posted 28 November 2005 - 12:08 AM

#10 $Some kind of malware, Fun web, HKCR\D, not really sure: post #10$
Buckeye_Sam

Posted 28 November 2005 - 11:03 AM

Advertisements

#11 $Some kind of malware, Fun web, HKCR\D, not really sure: post #11$
greenfairy

Posted 28 November 2005 - 01:03 PM

#12 $Some kind of malware, Fun web, HKCR\D, not really sure: post #12$
Buckeye_Sam

Posted 28 November 2005 - 02:02 PM

#13 $Some kind of malware, Fun web, HKCR\D, not really sure: post #13$
greenfairy

Posted 28 November 2005 - 02:46 PM

#14 $Some kind of malware, Fun web, HKCR\D, not really sure: post #14$
Buckeye_Sam

Posted 28 November 2005 - 02:50 PM

#15 $Some kind of malware, Fun web, HKCR\D, not really sure: post #15$
greenfairy

Posted 28 November 2005 - 03:01 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Some kind of malware, Fun web, HKCR\D, not really sure

#1 greenfairy Posted 21 November 2005 - 02:12 PM

Advertisements

#2 Buckeye_Sam Posted 23 November 2005 - 09:29 AM

#3 greenfairy Posted 23 November 2005 - 11:49 PM

#4 greenfairy Posted 24 November 2005 - 12:06 AM

#5 Buckeye_Sam Posted 24 November 2005 - 07:42 AM

#6 greenfairy Posted 26 November 2005 - 05:56 PM

#7 Buckeye_Sam Posted 26 November 2005 - 08:20 PM

#8 greenfairy Posted 27 November 2005 - 08:10 PM

#9 greenfairy Posted 28 November 2005 - 12:08 AM

#10 Buckeye_Sam Posted 28 November 2005 - 11:03 AM

Advertisements

#11 greenfairy Posted 28 November 2005 - 01:03 PM

#12 Buckeye_Sam Posted 28 November 2005 - 02:02 PM

#13 greenfairy Posted 28 November 2005 - 02:46 PM

#14 Buckeye_Sam Posted 28 November 2005 - 02:50 PM

#15 greenfairy Posted 28 November 2005 - 03:01 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Sign In

#1 $Some kind of malware, Fun web, HKCR\D, not really sure: post #1$
greenfairy

Posted 21 November 2005 - 02:12 PM

#2 $Some kind of malware, Fun web, HKCR\D, not really sure: post #2$
Buckeye_Sam

Posted 23 November 2005 - 09:29 AM

#3 $Some kind of malware, Fun web, HKCR\D, not really sure: post #3$
greenfairy

Posted 23 November 2005 - 11:49 PM

#4 $Some kind of malware, Fun web, HKCR\D, not really sure: post #4$
greenfairy

Posted 24 November 2005 - 12:06 AM

#5 $Some kind of malware, Fun web, HKCR\D, not really sure: post #5$
Buckeye_Sam

Posted 24 November 2005 - 07:42 AM

#6 $Some kind of malware, Fun web, HKCR\D, not really sure: post #6$
greenfairy

Posted 26 November 2005 - 05:56 PM

#7 $Some kind of malware, Fun web, HKCR\D, not really sure: post #7$
Buckeye_Sam

Posted 26 November 2005 - 08:20 PM

#8 $Some kind of malware, Fun web, HKCR\D, not really sure: post #8$
greenfairy

Posted 27 November 2005 - 08:10 PM

#9 $Some kind of malware, Fun web, HKCR\D, not really sure: post #9$
greenfairy

Posted 28 November 2005 - 12:08 AM

#10 $Some kind of malware, Fun web, HKCR\D, not really sure: post #10$
Buckeye_Sam

Posted 28 November 2005 - 11:03 AM

#11 $Some kind of malware, Fun web, HKCR\D, not really sure: post #11$
greenfairy

Posted 28 November 2005 - 01:03 PM

#12 $Some kind of malware, Fun web, HKCR\D, not really sure: post #12$
Buckeye_Sam

Posted 28 November 2005 - 02:02 PM

#13 $Some kind of malware, Fun web, HKCR\D, not really sure: post #13$
greenfairy

Posted 28 November 2005 - 02:46 PM

#14 $Some kind of malware, Fun web, HKCR\D, not really sure: post #14$
Buckeye_Sam

Posted 28 November 2005 - 02:50 PM

#15 $Some kind of malware, Fun web, HKCR\D, not really sure: post #15$
greenfairy

Posted 28 November 2005 - 03:01 PM