What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack Problem -need Help!

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Ran HJT and checked those 3 items , angelex was not there. Okay, I got into Safe mode and deleted wywuwu.exe. Again the other one (angelex.exe) wasn't there. So when I did restart in Windows, I didn't get that error message !! :) I was so happy! So is everything pretty much cleaned out and fixed ya think?? Oh except for my Recycle Bin, almost forgot about that problem!
Post #32
hello LorJJan4,

looks like we are getting somewhere, normally it dosnt take this many pages to try and fix something! Spybot is great.

I created the new text document and deleted it but it doesn't show up in my Recycle bin. Nothing does.
BUT when I use my "GenDiskCleaner" tool and tick the recycle bin …it'll ask :
"Do you want to delete (whatever number) files? It will show a number. It never shows any files when I open Recycle bin though.


before we try fixing the recycle bin, was it working normally beffore, you could click on it from the desktop, see whats in there and delete it? iam not familiar with GenDiskCleaner and maybe this utility is being used to clean the recycle bin?
Post #33
Yea, as far as I know, the recycle bin always used to show something in there .. all deletes. Since I use GEnDiskCleaner alot I've always cleaned it out from there. Its a pretty neat tool because it has lists of all these to clean out … Recycle Bin, History, Cookies, Internet Cache, Recent, Temporary Files. Right now I clicked the recycle bin and it asked ..Are you sure you want to delete all 28 files? So it's saying I've got 28 in there.
Post #34
just to be on the safe side, could you uninstall genDiskcleaner from the add/remove programs, if there is a uninstaller. then after the fix reinstall it. if you dont have the original install .exe you would have to download it again or install via cd, however you got it. open killbox and copy and past this path to the desktop.ini C:\RECYCLER\Desktop.ini select standard file kill, click red x, file will be deleted; next run vx2finder Click the "Find Vx2.Betterinternet" button. Click on these buttons in the right pane unless they are "greyed" out: user agent, Guardian.reg, restore policy Exit and reboot.
Post #35
:D Wow! Did everything you said and then right away after rebooting I opened my Recycle bin….. It's back !!!! and 28 files are in view! Don't want to sound corny or anything, but.. I love you, I love you, I love you! :D LOL ! So this is what came up after doing VX2 finder… Log for VX2.BetterInternet File Finder (ALL) Files Found— Additional Files— Keys Under Notify— crypt32chain cryptnet cscdll sclgntfy SensLogn wzcnotif Guardian Key— is called: Guardian Key— : User Agent String— {3F2B631E-FBB7-4805-9311-395CED10EFFE} Also, earlier I tried to delete "My Total Search Bar" program from Add/Remove programs and it gave me an error.. RUNDLL Error loading C:\Progra~1\mytota~1\bar\6.bin\mtsbar.dll So I'm not sure how to get rid of that one …there is a folder under my Program Files Dir. too called MyTotalSearch. Also in Recycle Bin under the View tab.. there's Explorer Bar and in there is MyTotalSearch Quick View. Should that be there? Is this normally in Win2000's recycle bin?
Post #36

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User

Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=-


copy the above to notepad, save to desktop as type "all files" and call it fixme2.reg
doubleclick the fixme2. reg you saved to the desktop
———————————————–
look in Program Files Dir. in the MyTotalSearch folder and see if there is a uninstaller icon in there, if so doubleclick it to launch.

rescan with HJT and post a new HJT log.



also for reference:
Please follow a few tips to remain malware free:

1) Make sure you keep your Windows OS current by visiting Windows update occasionaly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.
http://v4.windowsupdate.microsoft.com/en/default.asp

Also download, install and keep updated- Antivirus Software (and use only one):
Free for home users:
http://www.avast.com/eng/free_virus_protectio.html
http://free.grisoft.com/freeweb.php/doc/2/ AVG free version v6.0 updates end 12/31/04>>>get new (still free) version 7.0
http://www.free-av.com/

2) Watch what you download, and where you download it from. Many programs come bundled with crapware. Make sure you know what it is you will be downloading and installing. Visit the makers website, learn more about the program, Does the program you want come bundled with other "3rd party" programs? What do the 3rd party programs do? Will they deliver ads? Track your surfing habits?.You may be installing more than you think, Read the EULA agreement, you know that paragraph of stuff you "agree to" before the software installs? Stay away from warez and crack sites. Becarful what you download from file sharing networks.If you are not sure, scan it with your Antivirus app. A small file (in KB) is probably not what you think it is.

3)Adjust your browser settings: Change your(active x) settings in IE. With IE open go to tools, internet options, security tab. Click on the internet globe, then custom level. Set the first option "download signed active x controls" to prompt, the next two to disable. Read more: https://netfiles.uiuc.edu/ehowes/www/btw/ie/ie-opts.htm
http://www.microsoft.com/windows/ie/using/…y/settings.mspx
Many exploits are directed at Internet Explorer, you dont have to use it. Try a different browser: http://www.mozilla.org/products/firefox/

4)Install a firewall. A firewall will control what comes in from the internet and what leaves your computer to the internet. A firewall will also alert you when a application trys to connect to the internet from your computer, this is a good way to catch crapware or trojans, trying to connect out bound from your computer- whats that and why does it need a internet connection? You can deny it access it until more investigation is done. Zone Alarm is a free and easy to use firewall, that will provide in and outbound protection. Microsoft XP firewall only provides inbound protection. SP2 adds in and out bound protection which is better than nothing, but is not as robust as third party firewalls, Be sure to run only >one< firewall.If you use another, be sure to disable XP's built in firewall.A inexpensive NAT hardware router with SPI (firewall)would be best,along with a software firewall.
Zone Alarm: http://www.zonelabs.com/store/content/home.jsp
Kerio Personal Firewall: http://www.kerio.com/us/kpf_home.html
Outpost Firewall: http://www.agnitum.com/products/outpost/

5)Download, install and update before using:(if these are constantly finding malware, then you need to make some changes.)
Ad-Aware SE Personal edition: http://www.lavasoft.de/
Spybot Search and destroy: http://www.safer-networking.org/en/index.html
Becarful with spyware "removers and scanners"– there are many "rogue/suspect" programs that "claim to remove" spyware.


6)Other programs to consider:
SpywareBlaster: http://www.bleepingcomputer.com/forums/ind…showtutorial=49
IE-SPYAD: https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD
AntiTrojan (free) software to fill in the gap:
a2 free: http://www.emsisoft.com/en/software/free/
Ewido Security Suite: http://www.ewido.net/en/


7) Learn More:
http://www.dslreports.com/faq/8463#Tighten%20IE
http://www.cert.org/homeusers/HomeComputerSecurity/
http://www.wilders.org/index.htm


SHELF LIFE
Post #37 last edited
Hi Shelf,

Ok, I went to check out if there's an icon uninstall under the folder for MyTotalSearch and there is none. I'm not sure but maybe at one time I did try to delete that program and maybe thats why some files of are gone, and some aren't.. I don't know.
Should I just delete that folder and all other folders in it?

Since I got that error about the mtsbar.dll ..I thought it might show up in my HJT logfile, but don't think it did..
Here is my latest HJT file : i never rebooted since I ran this.

Logfile of HijackThis v1.99.0
Scan saved at 2:18:13 PM, on 12/29/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Program Files\Sierra\Planner\PLNRnote.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\MSAC-FD1\MSSTAT.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\My Download Files\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT2:" /M "Stylus C62"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [EPSON Stylus C62 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /A "C:\WINNT\system32\E_S35.tmp"
O4 - Startup: ccApp.lnk = C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - Global Startup: CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe
O4 - Global Startup: Event Planner Reminders.lnk = C:\Program Files\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSSTAT.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program Files\ScanSoft\Pagis\Monitor.exe
O4 - Global Startup: starter.lnk = C:\WINNT\system32\starter.exe
O8 - Extra context menu item: &Copy Location - C:\WINNT\WEB\graburl.htm
O9 - Extra button: (no name) - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINNT\system32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINNT\system32\webzone.dll
O9 - Extra button: (no name) - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINNT\system32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINNT\system32\webzone.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Offline - {FC09D8A3-C85A-11d2-92D0-0000F87A4A55} - C:\WINNT\system32\oline.dll
O15 - Trusted Zone: *.amazon.com
O15 - Trusted Zone: *.breasthealthonline.org
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #38

Should I just delete that folder and all other folders in it


yes go ahead and delete those MyTotalSearch folders, sometimes uninstallers dont actually remove everything. your HJt log is looking good………..shelf life
Post #39
Okay , great !!! that's really good news. I appreciate all your time and help! It sure was a tricky one since it was a new virus, (or new variant of a virus.)
Post #40
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI