HJT Log - Unable to successfully remove a spyware
dohjai Hi guys, I've got this spyware on my PC for the past couple of weeks that I'm unable to get rid of. I've scanned for viruses with NIS 2007 and I've used Ad-aware, Spybot S&D, Webroot Spy Sweeper, A-squared, Ewido online scan, and it's still stuck in my PC. I think it's related to the line O4 - HKCU\..\Run: [funk iso] F:\DOCUME~1\dohjai\APPLIC~1\BINDSI~1\plus user.exe. I've manually removed it and also with the tools and it keeps coming back after a reboot. Also, I have two IEXPLORE.EXE (in caps) running in the background that keeps coming back even if I kill the process. Ads will pop up if I use IE, but Firefox is fine. Please kindly help me clean this thing. Thanks in advance! Back to Top
Touch Forum Moderator Hi dohjai
It looks You´ve got a lop infection -
Search and Destroy" <<your computer will now be scanned for infected files>>REBOOT " Button.
C:\NoLop.log along with new hijackthis log
-----------------------------------------------------------------------
--If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program. --
http://www.ascentive.com/support/new/support_dll.phtml?dllname=MSCOMCTL.OCX
Do NOT post your problem in someone elses thread.
Start a new topic so that it may receive proper attention .
Do not PM me with logfiles. They will be deleted
Back to Top
dohjai Thanks for your reply! I've attached the NoLop log and the new HJT log. I do recall that one of the scans with the previous tools I used did remove a LOP spyware. Also, I notice that F:\Documents and Settings\Dohjai\Application Data\Bind Site Dart still contains the files gwbxijie.exe, plus user.exe, Wipeskip2.exe, and a hidden system file named 233D05DB (no extension). Can I manually remove this directory? After scanning and cleaning with NoLop!, and rebooting, the 2 IEXPLORE.EXE processes are still running in the background. Hope there's a way to clean this without having to format the hdd. Thanks! Back to Top
Touch Forum Moderator You should get rid of them after this fix -
Please download free Trial of Superantispyware
Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it.
close the program
Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
Run Hijackthis and place a check beside each of the following. Close all other browser windows except HJT.
Click fix checked.
O4 - HKCU\..\Run: [funk iso] F:\DOCUME~1\dohjai\APPLIC~1\BINDSI~1\plus user.exe
Please print out or copy this page to Notepad as you will be in Safe Mode and unable to refer to this page.
Reboot into Safe Mode by tapping F8 after the BIOS has loaded.
The Windows Advanced Options Menu appears.
Ensure that the Safe mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Delete the following files or folders (delete item in bold). Please do not be concerned if
any of the items are not found as they may have been automatically removed by actions I had
you take earlier in the cleaning process.
Folders:
F:\DOCUME~1\dohjai\APPLIC~1\BINDSI~1 \plus user.exe
F:\Documents and Settings\All Users\Application Data\Save Bash Lies Intra
Double-click ATF-Cleaner.exe to run the program.Main choose: Select All Empty Selected button.
Start Superantispyware/rightclick on the black/yellow bug in tray.
Hit - Scan Your Computer - button
Click on the drive(s) you want to scan. Put a check in - Perform Complete Scan, then next
it will scan now. When scan have finished, put a checkmark with all items it found. Next, after cleaning, let it Reboot
Start Superantispyware again –
Click Preferences and then click the statistics/logs tab.
Click the dated log and press view log and a text file will appear.
Post this log along with fresh hijackthis log and tell how things are running
Do NOT post your problem in someone elses thread.
Start a new topic so that it may receive proper attention .
Do not PM me with logfiles. They will be deleted
Back to Top
dohjai Thanks for your help. Please see the logs below and let me know if there is anything else that needs to be cleaned up. Thanks again..txt.txt.txt.txt.txt.txt.txt.txt.txt.txt.txt Back to Top
Touch Forum Moderator It looks clean to me. How are things running ?
Do NOT post your problem in someone elses thread.
Start a new topic so that it may receive proper attention .
Do not PM me with logfiles. They will be deleted
Back to Top
dohjai The IEXPLORE.EXE processes that are not supposed to be there are gone. No more ads popping up when using IE. But I see a rundll32.exe in the Processes tab and rundll32.exe exists in 2 places, F:\WINDOWS\system32 (which I presume is normal) and F:\Program Files\Musicmatch\Musicmatch Jukebox. I'm just a little worried about this process, is there a way to confirm that the one that is running is genuine? Thanks for your assistance. Back to Top
Touch Forum Moderator It´s not supposed to be there. Rightclick on - rundll32.exe - in musicmatch folder- properties. If it´s not from microsoft- delete it.
Do NOT post your problem in someone elses thread.
Start a new topic so that it may receive proper attention .
Do not PM me with logfiles. They will be deleted
Back to Top
dohjai It's from Microsoft and the date modified and file size is exactly the same as the one in F:\WINDOWS\system32, being 8/4/2004 9:07AM and 33kb. I don't recall seeing this in the Processes tab previously. Back to Top
dohjai Just ran msconfig, and from the Startup tab, I see a rundll32 where the Command is rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent. I guess this would be genuine as bthprops.cpl is the Bluetooth Devices Control Panel applet. So, it appears my system is clean (I hope). Thanks for all your help, much appreciated. Back to Top
Touch Forum Moderator I was glad to help
Hide systemfiles again From Windows Explorer, go to Tools>Folder Options> View tab. Untick - Show hidden files and folder Tick - Hide file extensions for known types Tick - Hide protected operating system files Click Yes to confirm & then click OK To completely and immediately remove any infected file or files in the data store, turn off and then turn on System Restore. To do so, follow these steps: System Restore
Here are some additional software you may wish to consider using, to prevent malicious software installing in your PC - >
IE-SPYADS IE-SPYAD is a Registry file (IE-ADS.REG) that adds a long list of known ad/spy servers and domains to the "Restricted Zone" of Internet Explorer. (Choose between IE-SPYAD and IE-SPYAD2). Freeware
Spyware Guard Background process to check applications as they begin to run for known spyware and malicious code, produces an alert if necessary. Freeware. SpywareBlaster From the same company as Spyware guard, this is not a scanner, it blocks malicious objects and code from being downloaded, in addition to blocking access to sites known to download malware. Spyware Blaster runs silently in the background and does not need to be open to protect your PC. Freeware
Make sure to keep these programs up-to-date
Do NOT post your problem in someone elses thread.
Start a new topic so that it may receive proper attention .
Do not PM me with logfiles. They will be deleted
Back to Top
Forum Information Currently it is Saturday, November 21, 2009 3:26 PM (GMT +1)View Active Threads Who's Online This forum has 30334 registered members. Please welcome our newest member, sushil .Details Dickens 5 Latest Threads
|