The "belgiandip" Monster

First of all, click here to download TheKillbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. Make sure the 'Create backup before deleting file' box is checked. In the 'Paste Full Path of File to Delete' box, copy and paste this entry, clicking 'Kill File' after pasting:

C:\WINDOWS\System32\xssoi.exe

Click 'Exit' when done.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

Using Explorer, go to C:\!Submit and find the following file: xssoi.exe - zip it up and send to this e-mail address including a link to this thread in the body of the email.

Make sure that you have no other browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [xssoi] C:\WINDOWS\System32\xssoi.exe
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/es/SysWebTelecom.cab

Reboot, rescan with HJT and post a new log for a final check over.

It's morphed to protect itself. It is now this entry:

O4 - HKLM\..\Run: [onimec] C:\WINDOWS\System32\onimec.exe

Do you know what this is?:

O4 - HKLM\..\Run: [Sbaw.exe] C:\docume~1\owner\locals~1\temp\Sbaw.exe

If not, reboot into safe mode by tapping F8 after the BIOS has loaded and fix the two O4 entries with HJT. Then find and delete the .exe files. Reboot when done.

Open TheKillbox. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\WINDOWS\System32\deshared.exe

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The C:\WINDOWS\System32\deshared.exe listing should show up in the window.Then repeat the process, this time adding:

C:\documents and settings\owner\local settings\temp\Sbaw.exe

If that's successful you should have the two files listed, in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

Rescan with HJT and post a new log.

Open TheKillbox. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\WINDOWS\System32\deshared.exe

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The c:\windows\system32\hlpchog.dll listing should show up in the window.Then repeat the process, this time adding:

C:\documents and settings\owner\local settings\temp\Sbaw.exe

If that's successful you should have the two files listed, in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

Rescan with HJT and post a new log.

Well the only problem is when I clicked on the File menu and chose "Add File" the c:\windows\system32\hlpchog.dll listing did not show up in the window: Instead the C:\WINDOWS\System32\deshared.exe showed up so of course I just erased it and closed down killbox. I didn't proceed after that with the Sbaw.exe, so what's next?

If c:\windows\system32\hlpchog.dll was supposed to show up and it didn't why and what next? Hardryve

Sorry for confusing you - I copy/pasted out of one of my earlier posts and didn't fully amend it. I've edited so that it reads right now. Repeat for sbaw.exe then post a new HJT log.

I also keep getting the following:

DDE Server Window: iexplorer.exe-Application Error
The instruction at "0X01e93812" referenced memory at "0X01f54dd0".The memory could not be "read"
Click on ok to terminate the Program

I hope this belgiandip is the cause of all these imperfections and error's,………Hardryve What a mess, heh?

erk!!

You are still infected with that dayam trojan! Until we get rid of that it's not worth worrying about anything else.

OK. Boot into safe mode by tapping F8 after the BIOS has loaded.

Open HJT and have it fix:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O4 - HKLM\..\Run: [Sbaw.exe] C:\docume~1\owner\locals~1\temp\Sbaw.exe
O4 - HKLM\..\Run: [ga256v] C:\WINDOWS\System32\ga256v.exe

Open Explorer, find and delete:

C:\docume~1\owner\locals~1\temp\Sbaw.exe
C:\WINDOWS\System32\ga256v.exe

Reboot. Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Rescan with HJT. If that trojan has morphed again it always appears after O4 - HKLM\..\Run: [NetPeeker] then repeat with the new name until you have got rid of it. When clean post a new HJT log.

erk!!  

You are still infected with that dayam trojan!  Until we get rid of that it's not worth worrying about anything else.

OK. Boot into safe mode by tapping F8 after the BIOS has loaded.

Open HJT and have it fix:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O4 - HKLM\..\Run: [Sbaw.exe] C:\docume~1\owner\locals~1\temp\Sbaw.exe
O4 - HKLM\..\Run: [ga256v] C:\WINDOWS\System32\ga256v.exe

Open Explorer, find and delete:

C:\docume~1\owner\locals~1\temp\Sbaw.exe
C:\WINDOWS\System32\ga256v.exe

Reboot. Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Rescan with HJT. If that trojan has morphed again it always appears after O4 - HKLM\..\Run: [NetPeeker] then repeat with the new name until you have got rid of it. When clean post a new HJT log.

Now I haven't done anything in your quote yet until I tell you this:

As usual when I put zonealarm on before I connect, this time I checked the control panel on there and guess what I FINALLY FOUND? Yepper, Thinstaller Client and 2 werule, name: tWVC11nL.exe……..and: bdspk.exe both located as plain as day(talking about the werule ones) at: C:\WINDOWS\System32\bdspk.exe
and the other werule in: C:\WINDOWS\system32\tWVC11nL.exe Now the Thinstaller is found in: C:\WINDOWS\bdl84126.exe total mb's were 58mb, someone said to be looking for 64mb files, not so. The werule were 64mb

I just want to confirm before I do anything now that I found them. Also I downloaded from Lockergnome a software entitled TuneUp Utilities 2004(version 4.1.2312) copyright 1996-2004 TuneUp Software GmbH. So before I go and use it cause I already have it installed but haven't run it yet, let me know if that is a good program or should I just get rid of it altogether, at this point now that those bastard's have shown up I don't need more problems, I knew they were somewhere on this PC never imagined they would show up right in front of my face on zonealarm, heh?

So get back to me and give me the final death sentence on these bastards finally, Never stopped looking, and when you least expected it, ah HA!

I'm a little elated at the moment, so please excuse me, Hardryve

Let me know how I can attach the ASAP icon on to my signature, I will add those icon's to all the forum's I belong and the one's I run as well. I am a member there also (ASAP)

erk!!  

You are still infected with that dayam trojan!  Until we get rid of that it's not worth worrying about anything else.

OK. Boot into safe mode by tapping F8 after the BIOS has loaded.

Open HJT and have it fix:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O4 - HKLM\..\Run: [Sbaw.exe] C:\docume~1\owner\locals~1\temp\Sbaw.exe
O4 - HKLM\..\Run: [ga256v] C:\WINDOWS\System32\ga256v.exe

Open Explorer, find and delete:

C:\docume~1\owner\locals~1\temp\Sbaw.exe
C:\WINDOWS\System32\ga256v.exe

Reboot. Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Rescan with HJT. If that trojan has morphed again it always appears after O4 - HKLM\..\Run: [NetPeeker] then repeat with the new name until you have got rid of it. When clean post a new HJT log.

Now I haven't done anything in your quote yet until I tell you this:


I had to re-edit this one again I found some other thing's, HARDRYVE

As usual when I put zonealarm on before I connect, this time I checked the control panel on there and guess what I FINALLY FOUND? Yepper, Thinstaller Client and 2 werule, name: tWVC11nL.exe……..and: bdspk.exe both located as plain as day(talking about the werule ones) at: C:\WINDOWS\System32\bdspk.exe
and the other werule in: C:\WINDOWS\system32\tWVC11nL.exe Now the Thinstaller is found in: C:\WINDOWS\bdl84126.exe total mb's were 58mb, someone said to be looking for 64mb files, not so. The werule were 64mb

I just want to confirm before I do anything now that I found them. Also I downloaded from Lockergnome a software entitled TuneUp Utilities 2004(version 4.1.2312) copyright 1996-2004 TuneUp Software GmbH. So before I go and use it cause I already have it installed but haven't run it yet, let me know if that is a good program or should I just get rid of it altogether, at this point now that those bastard's have shown up I don't need more problems, I knew they were somewhere on this PC never imagined they would show up right in front of my face on zonealarm, heh?

So get back to me and give me the final death sentence on these bastards finally, Never stopped looking, and when you least expected it, ah HA!

I'm a little elated at the moment, so please excuse me, Hardryve

Let me know how I can attach the ASAP icon on to my signature, I will add those icon's to all the forum's I belong and the one's I run as well. I am a member there also (ASAP)

Now in addition to the above I found 2 other totempole files in WINDOWS\System32 they are:msdmoe2w.exe….and leaccrco.exe…both from totempole version's are the same: 1.0.0.5 date created for leaccrco.exe was: 4/14/04 7:14am size is 64.0kb…….and for msdmoe2w.exe same version, date created was: 4/30/04 6:38am size is 64kb

But in C:\WINDOWS\bdl84126.exe date: 3/1/04 size is 58kb did not find. Also in C:\WINDOWS\System32\tWVC11nL.exe and bdspk.exe did not find so there somewhere and probably hiding in the registry to.

Well I found quite a few stalking around I just needed a leed some how, so when your ready give it to me I can't wait, like a kid so excited catching my first fish!

Any time now I'll be a waitin on you Daemon, Hardryve

I re posted this because your board was acting up after I finished re-editing it said I did not have permission to edit this post so this is the full post after being re-edited in total, Hardryve

I have seen winpup files of different sizes. More info here:

http://www.wilderssecurity.com/showpost.ph…40&postcount=19

The difficulty is nailing it before it morphs. Stop it from running via the Task Manager (CTRL>ALT>DEL) or use Safe Mode or Killbox.

Here's how to use the regfile. Copy the contents of the quote box to notepad. Name as pup.reg. Save as All files on the desktop.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\comms]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\pup]

Close notepad and double click on the file. When asked to merge to the registry say yes. Post a new Hijackthis log when done.

Let me know how you get on.