Ridding Myself Of Spyware Stormer

Hello Brian, Welcome to TomCoyote forum. I do see a couple of items that should be removed.

Some information about this item:
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
http://castlecops.com/startuplist-1773.html

O2 - BHO: (no name) - {75136CEA-AD29-DADA-5940-F9CACED39ECD} - C:\WINDOWS\System32\mgpekptv.dll
(Does not identify, as such I will remove it.)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
(this item does not id itself either. If of any value, the DPF will install again if that website is visited.

Scan with HijjackThis and check these two items:

O2 - BHO: (no name) - {75136CEA-AD29-DADA-5940-F9CACED39ECD} - C:\WINDOWS\System32\mgpekptv.dll
16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe

close all programs but HJT and all browser windows then click on "Fix Checked"

Do a search for this item: - C:\WINDOWS\System32\mgpekptv.dll, if you locate it delete it. You may have to enable hidden files:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Run Cleanmgr: Start, Run type "cleanmgr" without the quotes then ok. Remove anything windows locates.

Empty the recycle bin and restart the computer, please follow the instruction in these two links:
When replying to your topic, please use the
http://forums.tomcoyote.org/style_images/1/t_reply.gif
button NOT the
http://forums.tomcoyote.org/style_images/1/t_new.gif
button.
Post a new log, include your comments, any feedback you think we should have. The all clean will get you information to help you stay clean.

Thanks…pskelley
TomCoyote forum
Classroom Advanced
If you get help here consider a donation:
http://tomcoyote.com/donate.php

Brian, I do not know what happened to this computer since I first saw a log, but it is severely infected now and this was not the case on December 27th. I do not know if I can repair this infection? I will give it a try. The first thing I want you to do is stay offline with the computer as much as possible during the attempt to clean it.
Here is some information that will educate you to the infections that are now on your computer:
A log at Lavasoft showing that Ad-aware used as instruction can fix it.
http://www.lavasoftsupport.com/index.php?s…pic=48616&st=20

Information from Symantec about this item and what it installs.
https://www-secure.symantec.com/avcenter/ve…kdloader.b.html

This is the Service that installs the stuff. Don't know how you got it, but as I said, It was not in the last log. I would not have touched the log if it was. Since I have started I will do what I can do, please execute instructions carefully. Communicate your thoughts and anything that come up in the scans along with the next log. Thanks.
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe


All of these instruction are very important, please follow the directions 100%. Start by using the following two links, make sure you download Ad-aware SE Personal Build 1.05 AND Spybot Search & Destroy 1.3. Run Spybot first, undate the program as soon as it is downloaded, use the tutorial to make sure it is configured correctly, run it and remove anything Spybot says is bad. If you get DSO Exploit notifications, ignore them. Do not activate the TeaTimer function in Spybot yet, if we can clean the computer, you can activate it then.
Reboot the computer when Spybot has done it's job. Then Run Ad-aware, Update it first, then configure it exactly as suggested in the tutorial, this is very important. Allow Ad-aware to remove anything that is located.

Ad-aware:
http://www.bleepingcomputer.com/forums/tutorial48.html
Spybot:
http://www.bleepingcomputer.com/forums/tutorial43.html


Then I want you do update the Symantec product you are using and do a complete system scan.

Next, here are four free online scans, run all four and have them remove anything they locate.
http://www.windowsecurity.com/trojanscan/
http://scan.sygatetech.com/pretrojanscan.html
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.pandasoftware.com/activescan/co…n_principal.htm

Enable Hidden files for your system:
http://www.bleepingcomputer.com/forums/ind…showtutorial=62

Look carefully in Add Remove programs, if you see any of these items, remove them:
Admilli Service
BullsEye Network
zeta.exe
If you try to remove them and windows won't let you, use Safe Mode to do this:
http://www.bleepingcomputer.com/forums/ind…torial=61#winxo

Scan with HijackThis and check each of these line items:

O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\bbetts\Local Settings\Temp\yfAS.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKLM\..\Run: [AIrQws5.exe] C:\documents and settings\betts\local settings\temp\AIrQws5.exe
O4 - HKLM\..\Run: [pIFeu.exe] C:\documents and settings\betts\local settings\temp\pIFeu.exe
O4 - HKLM\..\Run: [2.exe] C:\documents and settings\betts\local settings\temp\2.exe
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Download…bridge-c420.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe

Close all programs but HJT and all browser windows, then click on "Fix Checked".

Choose the instructions for your system and entry the Safe Mode:
http://www.bleepingcomputer.com/forums/ind…torial=61#winxo
You may need to print these instructions, you will not be able to see them in Safe Mode.

Right Click on Start, then click on Explore. Use this tree to locate and delete the following files or folders. Some may not be there, but check this carefully and DO NOT miss any:

C:\Program Files\Admilli Service\ >>> folder

C:\Program Files\BullsEye Network >>> folder

C:\documents and settings\betts\local settings\temp\2.exe

C:\documents and settings\betts\local settings\temp\pIFeu.exe >>> file

C:\Documents and Settings\bbetts\Local Settings\Temp\yfAS.dll

C:\documents and settings\betts\local settings\temp\AIrQws5.exe >>> file

C:\WINDOWS\System32\msbe.dll

C:\WINDOWS\zeta.exe >>> file

While you are in this Windows folder, look for this folder: TEMP delete everything in that folder. NOT THE FOLDER just the contents. If there is a lot, click on Edit at the top then select all then delete.

Run Cleanmgr: Start, Run type "cleanmgr" without the quotes then ok. Check and remove anything windows locates. Then empty the recycle bin and restart the computer. Post a new log with your feedback and any information from the scans and we'll see where we are. Once again I suggest you keep this computer offline except when doing this cleanup until it is clean, and you have some layered protection in place. What you have now is just not doing the job if it is being updated and maintained properly.

Thanks…pskelley
TomCoyote forum
Classroom Advanced

Yeah Brian, You go guy. When I looked at that second log I almost fell off my chair. Did someone else in the house get hold of your computer while you were gone? It does look like you have overcome the bad stuff. There are two lines of 016 that I had for removal that you did not remove. Take a look at the end of the last HJT instruction in my last post for these items:

O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe

I do not know what they are. If you do not know, I believe you should use HJT and remove them. The other one still in the log is Windows Updates site and that is fine. If you know what these are, and wish to keep them, that is fine. I strongly suggest you keep a close eye on this computer using the current log to compare with new ones to watch for problems. Print the log and pin it to the wall.

Here is the information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://www.cjwd.demon.co.uk/compsafetyonline.html
http://www.bleepingcomputer.com/forums/topict2520.html

I personally run McAfee VSO, Ad-aware, Spybot S&D, SpywareBlaster, SpywareGuard and IE-Spyad. Keep your Avtivirus software up to date, and keep a firewall enabled. Please send my one more log to look at.

Happy New Year
Thanks…pskelley
TomCoyote forum
Classroom Advanced
If you get help here consider a donation:
http://tomcoyote.com/donate.php
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.

The two lines below are what I believe as Photoparade setup from Walmart when you get pictures on DVD from what I could figure out and quicktime installer, which for some reason is too long and gets the "…" routine. I guess I can remove them, but was not sure since I know my folks occassionally use those programs. O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} -http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe I will keep this log as a model and monitor this computer a little better to hopefully prevent it from becoming infested. Of course the more it happens, the more I learn. Thanks a bunch for your help. Brian

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?