I recently clicked on a link to update ActiveX controls on my buisness computer and BLAMMO! Viruses galore. Ive cleaned up pretty well in the aftermath and added some new programs to deal with future issues. But I am still having issues with popups and Diskeeper 10 wont defragment. The name of the trojan I cleaned out of the registry was SurfSideKick 3. Any help would be greatly appriciated.
Logfile of HijackThis v1.99.1
Scan saved at 10:49:30 AM, on 8/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Logfile of HijackThis v1.99.1
Scan saved at 11:01:20 AM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Attempting to delete C:\WINDOWS\system32\iyfotibe.exe
C:\WINDOWS\system32\iyfotibe.exe Has been deleted!
Attempting to delete C:\WINDOWS\system32\ooaherwu.exe
C:\WINDOWS\system32\ooaherwu.exe Has been deleted!
Attempting to delete C:\WINDOWS\system32\uofhueio.exe
C:\WINDOWS\system32\uofhueio.exe Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.1.2
Checking Java version…
Scan started at 3:14:40 PM 8/31/2006
Listing files found while scanning….
No infected files were found.
Logfile of HijackThis v1.99.1
Scan saved at 3:18:24 PM, on 8/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard C:\WINDOWS\system32\xrbwiopj.exe
C:\WINDOWS\system32\eeultibx.exe
C:\WINDOWS\system32\hdlhmvrp.exe
C:\WINDOWS\system32\byapiiqj.exe
C:\WINDOWS\system32\gbddjrsl.exe
C:\WINDOWS\system32\ermldaqn.exe
C:\WINDOWS\system32\hrftnwqx.exe
C:\WINDOWS\system32\edcttunb.exe
C:\WINDOWS\system32\sblqcgfp.exe
C:\WINDOWS\system32\btjjiovs.exe
C:\WINDOWS\system32\aolyrcpx.exe
C:\WINDOWS\system32\sfydvtoe.exe
C:\WINDOWS\system32\dsqqgnsl.exe
C:\WINDOWS\system32\nmkxkjrt.exe
C:\WINDOWS\system32\mrhrdqpi.exe
C:\WINDOWS\system32\uldmojpj.exe
C:\WINDOWS\system32\rqvoegsr.exe
C:\WINDOWS\system32\lmopgsxf.exe
C:\WINDOWS\system32\lpwhtmpb.exe
C:\WINDOWS\system32\gxvdttxp.exe
C:\WINDOWS\system32\mqognvao.exe
C:\WINDOWS\system32\ytxxgima.exe
C:\WINDOWS\system32\ksbohxgv.exe
C:\WINDOWS\system32\bhipssqk.exe
C:\WINDOWS\system32\gobyglxu.exe
C:\WINDOWS\system32\vbgyeanv.exe
C:\WINDOWS\system32\ashmuupp.exe
C:\WINDOWS\system32\tehqoual.exe
C:\WINDOWS\system32\wweyhmmj.exe
C:\WINDOWS\system32\powgnonq.exe
C:\WINDOWS\system32\ukogbpin.exe
C:\WINDOWS\system32\fqxscubk.exe
C:\WINDOWS\system32\wxopwvfj.exe
C:\WINDOWS\system32\avjerlwx.exe
C:\WINDOWS\system32\njmrmelv.exe
C:\WINDOWS\system32\uimcybhb.exe
C:\WINDOWS\system32\dbnvalwg.exe
C:\WINDOWS\system32\hrwgseor.exe
C:\WINDOWS\system32\sxhgulfv.exe
C:\WINDOWS\system32\rjuttuys.exe
C:\WINDOWS\system32\cbhtkrkk.exe
C:\WINDOWS\system32\ctshowhb.exe
C:\WINDOWS\system32\oylngurr.exe
C:\WINDOWS\system32\rortugcx.exe
C:\WINDOWS\system32\vtafhhkl.exe
C:\WINDOWS\system32\xqcyoctm.exe
C:\WINDOWS\system32\xpadfrc.dll
C:\WINDOWS\system32\GGE910cp.dll
C:\WINDOWS\system32\onnmp.ini2
C:\WINDOWS\system32\onnmp.bak2
C:\WINDOWS\system32\onnmp.bak1
C:\WINDOWS\system32\pmnno.dll
C:\WINDOWS\system32\xhnc14e9.dll
C:\WINDOWS\system32\xhnc14e9.sys
C:\WINDOWS\pf78.exe
C:\WINDOWS\system32\wnsapisv.exe
C:\WINDOWS\system32\oins.exe
C:\WINDOWS\system32\winbue32.dll
In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed (Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
Click the option to Delete on Reboot
Click End Explorer Shell while Killing File
Click All Files right of the flashing green "Single files"
Click Yes when it asks "Files will be Removed on Reboot, Do you want to reboot now?"
(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)
If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.
If you use Opera browser
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE:If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
STEP 2.
======
This scan works with Internet Explorer.
Panda Active Scan
Please go to Panda ActiveScan.
Once you are on the Panda site click the Scan your PC button
A new window will open…click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on Local Disks to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Scan with HijackThis. Place a check against each of the following: O2 - BHO: (no name) - {84B7550B-C132-4958-BC6C-8D9BFC41860B} - C:\WINDOWS\system32\pmnno.dll
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - (no file)
O20 - Winlogon Notify: logons - C:\WINDOWS\system32\redist.dll (file missing)
O20 - Winlogon Notify: pmnno - C:\WINDOWS\system32\pmnno.dll
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\znnaphq.exe (file missing)
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.
Post the contents of the Panda scan report, along with a new HijackThis Log, by using Add Reply.
Logfile of HijackThis v1.99.1
Scan saved at 5:12:02 PM, on 9/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Virus:Trj/Downloader.HPZ Not disinfected C:\!KillBox\pf78.exe[pms111x.exe]
Virus:Trj/VB.MC Not disinfected C:\!KillBox\pf78.exe[SYSC00.exe]
Virus:Trj/Downloader.HPZ Not disinfected C:\!KillBox\pf78.exe( 3)[pms111x.exe]
Virus:Trj/VB.MC Not disinfected C:\!KillBox\pf78.exe( 3)[SYSC00.exe]
Things are looking much better! Let's do the following:
Scan with HijackThis. Place a check against each of the following: O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://locator1.cdn.imageservr.com
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.
Delete all the files in the folder C:\!KillBox\all files
Empty your recycle bin.
Now run this online scan using Internet Explorer: Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner
Next Click on Launch Kaspersky Online Scanner
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Standard
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:
Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information from Kapersky in your next post.
Please post the results from Kapersky along with another hijackthis log.
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
