Computer affected by malware every boot up

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [jrm\] c:\windows\mrjj.exe
O4 - HKLM\..\Run: [noC=] c:\windows\mrjj.exe
O4 - HKLM\..\Run: [virD] C:\windows\mrjj.exe
O4 - HKLM\..\Run: [=NOI] C:\windows\mrjj.exe
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler] C:\named.exe
O4 - HKLM\..\Run: [msls] C:\WINDOWS\System32\MsLS32.exe
O4 - HKLM\..\Run: [Microsoft Configure 32] msgconfigre.exe
O4 - HKLM\..\RunServices: [Microsoft Configure 32] msgconfigre.exe
O4 - HKCU\..\Run: [sccrv8] C:\WINDOWS\System32\sccrv8.exe
O4 - HKCU\..\Run: [Microsoft Configure 32] msgconfigre.exe
O4 - HKCU\..\Run: [Amir] "C:\Program Files\ears\rlrs.exe" -vt mt
O23 - Service: fwnet64 (fwnet) - Unknown owner - C:\WINDOWS\fwnet64.exe (file missing)

Exit HijackThis when done. Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete the following:

c:\windows\mrjj.exe
C:\named.exe
C:\WINDOWS\System32\MsLS32.exe
C:\Program Files\ears\rlrs.exe

Exit Explorer and reboot into Normal Mode. Rescan with HijackThis and post a new log here.

Find these files:

C:\WINDOWS\System32\msgconfigre.exe
C:\WINDOWS\System32\sccrv8.exe

zip them up and send to this e-mail address including a link to this thread in the body of the email.

Looking better - go to Start->Run and type Services.msc then hit Ok. Scroll down and find the service called "fwnet64". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.

Open HijackThis, click Config… > Misc Tools > Delete an NT Service tab. In the dialogue box that opens enter fwnet64 in the slot and click OK.

Then find and delete this folder:

C:\Program Files\ears

Reboot and post a new HJT log.

Click here to download Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the red 'Delete File' button (red circle with a white X) after pasting each one:

c:\windows\mrjj.exe
C:\WINDOWS\System32\msgconfigre.exe
C:\WINDOWS\System32\sccrv8.exe

Click 'Exit' when done.


Then do this for me:

Click here to run ActiveScan.

• Once you are on the Panda site click the Scan your PC button
• A new window will open…click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Paste the contents of the Panda scan report in your next reply.

Incident Status Location Adware:adware/purityscan Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temp\!update.exe Adware:adware/transponder Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temp\dummy.htm Adware:adware program Not desinfected C:\WINDOWS\SYSTEM32\data.~ Adware:adware/imgiant Not desinfected C:\WINDOWS\LASTGOOD\INF\imgiant.inf Adware:adware/wupd Not desinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\MediaGatewayX.dll Adware:adware/dollarrevenue Not desinfected C:\WINDOWS\drsmartload.dat Spyware:spyware/media-motor Not desinfected C:\WINDOWS\mm63.ocx Adware:adware/popupsandbannersNot desinfected C:\WINDOWS\teller2.chk Spyware:spyware/adclicker Not desinfected C:\WINDOWS\usta33.ini Adware:adware/mediatickets Not desinfected Windows Registry Virus:W32/Gaobot.gen.worm Disinfected C:\!KillBox\msgconfigre.exe Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-4a97bc2f-418baf93.zip[BlackBox.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-4a97bc2f-418baf93.zip[VerifierBug.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-4a97bc2f-418baf93.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-4a97bc2f-418baf93.zip[Beyond.class] Adware:Adware/WUpd Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temp\ICD5.tmp\MediaGatewayX.dll Adware:Adware/MediaTickets Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temp\oins.exe Adware:Adware/SaveNow Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temp\temp.fr50C9\SaveUninst.exe Adware:Adware/IST.ISTBar Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temp\uninstall.exe Adware:Adware/WinTools Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\4DCXQNG9\mmxxxxmas2[1].exe Adware:Adware/MediaTickets Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\CZT7MEN1\index4[1].htm Virus:W32/Gaobot.gen.worm Disinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\KPY3OXEN\babeg[1].exe Adware:Adware/WUpd Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\KPY3OXEN\bridge-c11[1].cab[MediaGatewayX.dll] Adware:Adware/MediaTickets Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\KPY3OXEN\CA43IHWT.HTM Virus:Trj/Lowzones.ML Disinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\KPY3OXEN\goaway[1].exe Spyware:Spyware/Media-motor Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\KPY3OXEN\mm63[1].ocx Adware:Adware/E2Give Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\YGKBXDK9\IeBHOs[1].dll Spyware:Spyware/Media-motor Not desinfected C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\YGKBXDK9\unstall[1].exe Virus:Bck/Msxp.A Disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CP2FG5IV\newppp[1].exe Virus:Trj/Ranky.JP Disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ODE3GT6J\joker2[1].exe Virus:Bck/Joker-Proxy.A Disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ODE3GT6J\newppp2[1].exe Virus:W32/Gaobot.JBG.worm Disinfected C:\IEXPLORE.exe Virus:Trj/Ranky.JP Disinfected C:\joker2.exe Virus:Bck/Msxp.A Disinfected C:\newppp.exe Virus:Bck/Joker-Proxy.A Disinfected C:\newppp2.exe Adware:Adware/ImGiant Not desinfected C:\WINDOWS\inf\imgiant.inf Spyware:Spyware/Media-motor Not desinfected C:\WINDOWS\mm63.ocx Virus:W32/Sdbot.ftp Disinfected C:\WINDOWS\system32\i Virus:W32/Sdbot.ftp Disinfected C:\WINDOWS\system32\o Adware:Adware/MediaTickets Not desinfected C:\WINDOWS\system32\oins.exe

Good, please post a new HJT log.

You are running HijackThis from the Desktop; please create a new folder for it and move the program into the new folder

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [Microsoft Configure 32] msgconfigre.exe
O4 - HKLM\..\RunServices: [Microsoft Configure 32] msgconfigre.exe
O4 - HKCU\..\Run: [Microsoft Configure 32] msgconfigre.exe

Exit HijackThis when done. Reboot, rescan with HijackThis and post a new log here.

Looks OK now - how is it running?

Looks OK now - how is it running?

Seems to be fine,no popups for now haha.I'll post if anything crops up.

Thanks Daemon for the help,Merry Christmas and a Happy New Year!

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php