Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
Have a computer running Windows XP Home. It has been hit by ISTBar and some other search bars have attacked it. Causing it to run slow. I have been into the register and using Hijack this, Ad Aware and Antivirus software thought I had successfully removed it all over the past two days. Then when I attatched the computer back to the internet to my horror all the search bars re-appeared. I could have cried. Machine was re-infected. Must have missed something.
So I seek help please. Its driving me insane.
Here is the current Hijack log. The computer is off the internet, I have run ad aware before getting the log.
Any help is soooo greatfully recieved you just wouldnt believe it.
Thanks
Logfile of HijackThis v1.99.0
Scan saved at 10:47:59, on 13/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Ok so I shouldnt have done the Hijack log straight after Adaware.
Here is the Hijack log after a reboot.
Thanks again.
Logfile of HijackThis v1.99.0
Scan saved at 13:13:39, on 13/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Start Hijackthis and place a check next to these items,
Close all browser windows and shut down all other programs that show in the taskbar. (even Folders)
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file
O4 - HKLM\..\Run: [e80519c58c15] C:\WINDOWS\System32\audiosrv.exe
O4 - HKLM\..\Run: [Microsofts Legacy Support] java.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [] iexpl0res.exe
O4 - HKLM\..\RunServices: [Microsofts Legacy Support] java.exe
O4 - HKLM\..\RunServices: [] iexpl0res.exe
O4 - HKCU\..\Run: [Ijnwk] C:\WINDOWS\System32\w?nlogon.exe
O4 - HKCU\..\Run: [] iexpl0res.exe
O4 - HKCU\..\RunServices: [] iexpl0res.exe
==========================
Hit fix checked and close Hijackthis. Restart the PC
Dont depend on any one antivirus program go get preferably two free onlines
(especialy it seams norton)
Trend Micro-Free online Scan: http://housecall.trendmicro.com/
check all box's except [ ]auto clean !!, scan and if it cannot clean tell it to delete found files !!
BitDefender AntiVirus Free Scan, check all box's except [ ]auto clean !!,
then have it delete the file if it cannot clean/repair/cure it,
turn off any PopupBlockers before accessing the site: http://www.bitdefender.com/scan/licence.php
Removed the Hijack bits. Then ran housecall which found and deleted:
C:\Windows\gukrlqn.exe
C:\Windows\qaadoc.exe
Then ran bit defender without the autoclean, it found a lot, but I couldnt find a delete the file option . Checked the hard drive and the virused files are still there. Do I have to manually delete them? Anyway, heres the bit defender Log:
C:\dload.exe=>(Upx): infected with Trojan.Downloader.Small.DG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AVEB6HAD\sfbho13[1].dll: infected with Adware.SideFind.A
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\C1U9IHAJ\istbar_mainstream[1].dll: infected with Trojan.Downloader.IstBar.GJ
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\C1U9IHAJ\sidefind[1].exe: infected with Trojan.Downloader.IstBar.DA
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>arrow1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>arrow2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bck1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bck2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt11.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt12.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt13.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt21.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt22.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt23.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt31.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt32.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt33.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt41.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt42.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt43.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt51.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt52.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt53.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt61.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt62.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox3.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox4.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>default.skn: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn3.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph3.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph4.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph5.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph6.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph7.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>main.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>preview.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>sprite1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>tab1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>tab2.bmp: password protected
** Deleted the C:\Program Files\Norton SystemWorks\Norton CleanSweep\*.*: password protected as this made the post too many characters **
C:\Program Files\Windows TaskAd\WinSched.exe=>(Upx): infected with Adware.WinAD
C:\SEPinst.exe: infected with Trojan.Septic.A.dr
C:\uninstallwizard.exe: infected with Trojan.Downloader.IstBar.Z1
C:\WINDOWS\livesex.cal=>(Upx): infected with Trojan.Dialer.AF
C:\WINDOWS\system32\.pif: infected with Backdoor.BotGet.FtpB.Gen
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\A74d.dll: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5UBQULGG\addit[1].exe=>(NSIS o)=>zlib_nsis0001: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5UBQULGG\addit[1].exe=>(NSIS o)=>zlib_nsis0002: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5UBQULGG\clicks[1].dll: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\RMORZH1B\ticket[1].htm: infected with HTML.MediaTickets.A
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\XGXZL3MP\all_files10[1].exe=>(NSIS o)=>zlib_nsis0001=>(NSIS o)=>zlib_nsis0003: infected with Trojan.Sandbox.A
C:\WINDOWS\system32\Dfm38Uh.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\Dhf4e8R.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\Dnkzz.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\dust: infected with Backdoor.BotGet.FtpB.Gen
C:\WINDOWS\system32\exul1.exe: infected with Adware.BBuddy.A
C:\WINDOWS\system32\exul2.exe: infected with Adware.BBuddy.A
C:\WINDOWS\system32\Fah1q6.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\o: infected with Backdoor.BotGet.FtpB.Gen
C:\WINDOWS\system32\Szqu0w1A.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\TcvX0HeM.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\Vwb73.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\Wzx4.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\Yqn4Uxf.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\system32\Zxj35W2.exe: infected with Trojan.Downloader.VB.EM
C:\WINDOWS\Temp\addit.exe=>(NSIS o)=>zlib_nsis0001: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\Temp\addit.exe=>(NSIS o)=>zlib_nsis0002: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\Temp\all_files10.exe=>(NSIS o)=>zlib_nsis0001=>(NSIS o)=>zlib_nsis0003: infected with Trojan.Sandbox.A
C:\WINDOWS\Temp\clicks.dll: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\Temp\fixit.exe=>(NSIS o)=>zlib_nsis0002: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\Temp\over.exe=>(NSIS o)=>zlib_nsis0001: infected with Adware.Statmedia.A
C:\WINDOWS\Temp\sidefind.exe: infected with Trojan.Downloader.IstBar.DA
C:\WINDOWS\Temp\Updater.exe: infected with Trojan.Spy.Middadle.A
C:\WINDOWS\tool1.exe: infected with Trojan.Downloader.IstBar.Z8
C:\WINDOWS\tools.exe: infected with Trojan.Downloader.IstBar.Z9
C:\WINDOWS\toolx.exe: infected with Trojan.Downloader.IstBar.Z7
Those are pretty common lately, I think lots of different nasties are now using odd characters like that thinking we will suggest deleting it, or just to make it harder for us to cleanup.
All you need to do is either ignore it, once the run is fixed it is effectively out of the picture. or say look for C:\WINDOWS\System32\w?nlogon.exe
where the ? is an odd character, do not attempt to delete the real windows file, check the properties first. as in right click >properties, if your unsure leave it alone.
The bad guy probably has an FMC icon,and uses an underscore
(w_nlogon.exe) see attachment. that doesn't by any means mean all those that look like this are bad.
later tell us if you found it ?
===================================
If it isn't already Set windows to show hidden file's, folder's and extensions >click here for instructions<.
find and delete (ONLY THESE EXACT) files and folder's (If present)
C:\Program Files\Windows TaskAd
C:\SEPinst.exe
C:\uninstallwizard.exe
C:\WINDOWS\livesex.cal
C:\WINDOWS\system32\.pif
C:\dload.exe
C:\WINDOWS\system32\Dfm38Uh.exe
C:\WINDOWS\system32\Dhf4e8R.exe
C:\WINDOWS\system32\Dnkzz.exe
C:\WINDOWS\system32\dust
C:\WINDOWS\system32\exul1.exe
C:\WINDOWS\system32\exul2.exe
C:\WINDOWS\system32\Fah1q6.exe
C:\WINDOWS\system32\o
C:\WINDOWS\system32\Szqu0w1A.exe
C:\WINDOWS\system32\TcvX0HeM.exe
C:\WINDOWS\system32\Vwb73.exe:
C:\WINDOWS\system32\Wzx4.exe
C:\WINDOWS\system32\Yqn4Uxf.exe
C:\WINDOWS\system32\Zxj35W2.exe
:\WINDOWS\tool1.exe
C:\WINDOWS\tools.exe
C:\WINDOWS\toolx.exe
====================
C:\WINDOWS\System32\audiosrv.exe
C:\WINDOWS\System32\iexpl0res.exe
C:\WINDOWS\System32\w?nlogon.exe
Do a file search for java.exe and tell us if its found anywhere except windows and system32 folders
Empty the recycle bin Important
Delete the contents of all your temp folders, as in. Open C:\ then >
C:\documents and settings\(all your pc users)\local settings\temp Note: Some systems have temporary internet files, Application Data and History in that temp, if so leave them and delete all other folders and files inside that temp and these below..
Delete the contents of the C:\windows\temp folder
C:\WINDOWS\Prefetch < delete the contents
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temp <delete the contents
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\ <<<<<delete contents
Clear Internet Explorers's cache
1. In Control Panel, open Internet Options.
2. Click the General tab, and then under Temporary Internet files, click Delete Files.
3. In the Delete Files dialog box, click to select the Delete all offline content check box.
4. wait for the hourglass to disapear
5. Click OK.
=========
We need to see a new hijackthis log
This is starting to look good . Here is the latest Hijack this log after removing files and reboot.
Logfile of HijackThis v1.99.0
Scan saved at 09:53:24, on 14/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Didn't find any W_login.exe or W?login.exe only ones are winlogin.exe. Didnt find any Java.exe neither. Searched whole drive and hidden files and folders.
all the search bars re-appeared. I could have cried. Machine was re-infected. Must have missed something.
. Checked the hard drive and the virused files are still there. Do I have to manually delete them? Anyway, heres the bit defender Log:
. Here is the latest Hijack this log after removing files and reboot.
