What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

vmmdiag32.exe

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi i_know_nothing
Welcome back and lets start from the begining again.
First off I don't know what you did but you don't have
your HIJACKTHIS.EXE in a temp file again.

C:\WINDOWS\TEMP\WZ1BDE\HIJACKTHIS.EXE
Please put it in a stand alone foldeer like before:

C:\MEUS DOCUMENTOS\HIJACKTHIS.EXE

Also I see you have 2 anti virus programs running.
KASPERSKY and AVAST4, this is not good. Pleass disable one.

Now after disabling one and putting the HJT in a seperat folder.
Lets do this please.
Go to the folder you just made for hijack this and RIGHT click on the
HIJACKTHIS.EXE and rename it analize this.exe
The reason is some viruses hide from HJT.
Now once all this is done Please follow this complete:
==================================
Next:
run the Trend-Micro online scan:
Trend-Micro Housecall
Put on 'Autoclean' and delete what it can't clean.

.A new HijackThis log
good luck mschroe919
Post #17
well… ok…
here is the new log file… it wasn't on a temp folder anymore… welll i had to do that way cause i wasn't been able to open any ".exe" out of the temp folders… now it's ok i guess…


Logfile of HijackThis v1.99.1
Scan saved at 19:13:56, on 01/11/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HJT\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ashWebSv.exe
O4 - HKLM\..\Run: [LightStart] E:\STFLASH.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE -r"
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab

waiting for the next step…
Post #18
Hi i_know_nothing

I am here again trying to help as well we can. I would like to keep all posts in this forum now.
First of all on the last post I asked you to do a few things. One you did and that was movuing
the HJT folder. That you did but I don't see where you did the rest here:

Also I see you have 2 anti virus programs running.
KASPERSKY and AVAST4, this is not good. Pleass disable one.

Now after disabling one and putting the HJT in a seperat folder.
Lets do this please.
Go to the folder you just made for hijack this and RIGHT click on the
HIJACKTHIS.EXE and rename it analize this.exe
The reason is some viruses hide from HJT.
Now once all this is done Please follow this complete:
==================================
Next:
I also can;t see where you done this either.
run the Trend-Micro online scan:
Trend-Micro Housecall
Put on 'Autoclean' and delete what it can't clean
==============================================

Please do the on line scan as above.
Please after scan and if they found anything please reboot and do another HJT log
Good luck mschroe919
.
Post #19
welll, did what you asked, and run that free scan… i tried to fix and delete the files, but something stopped me from a few ones… look what it found…

Pe_parite.a.exe
Pe_sality.ac-0
bkdr_sality.a.dll
bkdr.dragonbot.a
troj_generic
pe_sality.ac.exe
bkdr_generic
tspy_goldun.gy

here is the new log, after changed the namo of hjt to analizethis.exe… well…

logfile of HijackThis v1.99.1
Scan saved at 02:23:37, on 02/11/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\MEUS DOCUMENTOS\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ashWebSv.exe
O4 - HKLM\..\Run: [LightStart] E:\STFLASH.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE -r"
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab


Avast keeps interupinting my actions on my pc… it keeps telling that all files are infected, and then i can't open anything… isn't it better for me to disable avast, and put all .exe back on my pc?? just while you help me??? well… waiting…
Post #20 last edited
Hi_know_nothing
There was a couple of things I asked you to do before the scan: Please do them now.
It is important!
Also I see you have 2 anti virus programs running.
KASPERSKY and AVAST4, this is not good. Pleass disable one.

Now after disabling one
Lets do this please.
Go to the folder you just made for hijack this and RIGHT click on the
HIJACKTHIS.EXE and rename it analize this.exe
After renaming it you must hit the enter button to save its new name
The reason is some viruses hide from HJT.
Now once all this is done Please follow this complete:
==================================
For sure you need to disable one of the anti virus programs.
Please do the on line scan again
Trend-Micro Housecall
Put on 'Autoclean' and delete what it can't clean.
==============================================
Did you also do this yet?
Start - Run - (type)msconfig - press - Enter

Remain on the - General(tab) - Press - Create Backup

Answer - Yes - OK

Select - System.ini(tab)

Expand - [boot] - by clicking the + (plus sign)

DO NOT "check" or "uncheck" any items in the list that appears

Highlight - by clicking with cursor in the body of the text: "shell=explorer.exe vmmdiag32.exe"

Press - Edit

In the "Edit highlighted" box surrounding the text - (type): "shell=Explorer.exe" without the quotation marks (this will cause the old text to disappear and be replaced by what is typed)

Click OK

Click "yes" to allow the machine to reboot
==========================================================
After reboot do another HJT log
Good luck mschroe919
Post #21
Hi!
well… i guess this time i've done everything exactly as you said… well… you said i have 2 anti-virus… well… in fact i have only one… as i said, there isn't just one user on this pc… somebody may had installed kaspersky, but when i saw it… i unistalled right away… i know two anti-virus is no good… but i've done it already 5 to 6 days ago… well… is it still runnig? anyway… i've stop avast them, aparently, during the scan on that trend micro site you gave me was running without any anti-virus runnig togheter… "aparently".
i did the scan, it gave me less results this time… just two malwares, that i couldn't remove… the system didn't let me do it… 21 infections from Pe_sality.ac-0, and 3 from the bkdr.a.sality.dll, there were no way to remove them, i've done that last thing you told me too, that about renaming shell=explorer, well now when i boot my pc there are no more erros about vmmdiag32.exe missing, but yet, i can't configure my video…

here is the new logfile from ''analize this.exe", hope i've done right this time! sorry for the last ones!

i know that somehow, kaspersky is this on my logfile!!! but i swear i've already deleted it, and there is no sign of him on my pc! i've already searched 1000 times!

Logfile of HijackThis v1.99.1
Scan saved at 16:03:24, on 02/11/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\ARQUIVOS DE PROGRAMAS\VELOX\DISCADOR\DISCADOR.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HJT\ANALIZE THIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ashWebSv.exe
O4 - HKLM\..\Run: [LightStart] E:\STFLASH.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE -r"
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab

when, waiting for any next instrucitions!
Post #22
Hi i_know_nothing,
I know you said its not there buts lets look some more acording to your log its there.

know that somehow, kaspersky is this on my logfile!!!
but i swear i've already deleted it, and there is no sign of him on my pc! i've already searched 1000 times!

FIRST:
Go to add/remove progrems in the control pannel,
and see if its there:
KASPERSKY LAB or
KASPERSKY ANTI-VIRUS 6.0
If there highlight and click on remove.
If not there Please run a scan on ANALIZE THIS.EXE and put a check by the following:
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE
Please remember to close all other windows, including browsers then click Fix checked
Using Windows Explorer, navigate and delete the following folders and files,the ones inRED
C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE
========================================================================
NEXT:
Once you done that the next step agin is reboot to safe mode
Here is how:


* Click Start.
* Select Shutdown.
* Select Restart The Computer and click OK.
* During restart, hold down the Ctrl key on your keyboard until the Windows Startup menu appears.
* If your PC starts beeping then release the key for a few seconds before holding it down again.
* Select Safe Mode from the Startup menu, and press the Enter button on your keyboard.
* Windows should start in Safe Mode. If Windows doesn't restart in Safe Mode then please try again.
While in safe mode, Please run a scan on ANALIZE THIS.EXE and put a check by the following:
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
Please remember to close all other windows, including browsers then click Fix checked
NEXT:
Still in safe mode:
we need to show some hidden files. Click Start>>>>Control Panel>>>>Folder Options and double click.
Under the View tab scroll down to Hidden Files and Folders
Check Show hidden files and folders
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files (Recommended} Answer Yes
Click Apply and click OK
NEXT:
Using Windows Explorer, navigate and delete the following files,the ones in RED
C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
reboot and get another ANALIZE THIS.EXE log and post it here
good luck mschroe919
Post #23 last edited
hi!
well, guess that two anti-virus in't a problem anymore… but, about the things you asked me to do, the 02-bho file you asked me to fix, in safe mode, i tried, got in safe mode, "cheked", fix cheked, and ok, but i didn't foun the file on windows>dowloaded program files, tha "dll" you asked me to delete wasn't there, yet, you told me to show some hidden files, my operational system is windows 98, the folder options isn't at control panel, its on "start>Configurations>Folder options>(tab)view mode" i cheked "show all files", and the other stuff you asked me, but "hide protected operating system files" wasn't there… but i marked the options "show all files", so it's ok, isn't it? well, i 've done what you askedm the way you asked, but gieh.dll, wasn't the, by the way, the folder "windows\dowloaded program files" is the one with the internet exlporer symbol, right?

here is the new log:

Logfile of HijackThis v1.99.1
Scan saved at 15:21:17, on 04/11/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ARQUIVOS COMUNS\REAL\UPDATE_OB\REALSCHED.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\ARQUIVOS DE PROGRAMAS\MSN MESSENGER\MSNMSGR.EXE
C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\ARQUIVOS DE PROGRAMAS\VELOX\DISCADOR\DISCADOR.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\NOVA PASTA JTH\ANALIZE THIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ashWebSv.exe
O4 - HKLM\..\Run: [LightStart] E:\STFLASH.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab



thanks for your help! waiting!
Post #24 last edited
hi again… i've been reading a lot lately about win32/sality… well, and found this… "When an infected file is executed the virus decrypts itself and drops a DLL file into the %System% directory. The DLL file is injected into other running processes. The virus then executes the host program code." they showed a list below this informations, with the name of the dll this virus uses… i found it on my pc "olemdb32.dll", this is the only single file i found, they showed a lot of names, including ones the virus downloads, and the operational files this viirus uses… u can't delete tat file, it says windows is using that dll… by the way this were the files on "dowloaded program files" {31564D57-0000-0010-8000-00AA00389B71} {33564D57-0000-0010-8000-00AA00389B71} GbPluginObj Class Java Runtime Environment 1.5.0 Java Runtime Environment 1.5.0 MsnMessengerSetupDownloadControlCLas QuickTIme Object Shockwave Flash Object well, hope it was of any help! waiting the instructions!
Post #25 last edited
Hi i_know_nothing,
Sorry about the delay I got tied up and got back later.
I also will be gone Thursday and Friday

well, i 've done what you askedm the way you asked, but gieh.dll, wasn't there,


This is okay cause the gieh.dll is only bad in a different setting, yours is okay.

"windows\dowloaded program files" is the one with the internet exlporer symbol, right?

I am not sure what you mean,
The folder I mean is
right click on start/
left click on explore/
left click on Local drive C/
Then on the right left click on windows/
then left click on downloaded programs files/

But this doesn't need to be done now cause the gieh.dll I was asking you to delete is okay and should stay.

do you know what this program is?
LightStart
STFLASH.EXE

O4 - HKLM\..\Run: [LightStart] E:\STFLASH.EXE
I am pretty sure it is okay too.


by the way this were the files on "dowloaded program files"
{31564D57-0000-0010-8000-00AA00389B71}
{33564D57-0000-0010-8000-00AA00389B71}
GbPluginObj Class
Java Runtime Environment 1.5.0
Java Runtime Environment 1.5.0
MsnMessengerSetupDownloadControlCLas
QuickTIme Object
Shockwave Flash Object

These seem to be okay


they showed a list below this informations, with the name of the dll this virus uses…
i found it on my pc "olemdb32.dll", this is the only single file i found, they showed a lot of names, including ones the virus downloads, and the operational files this viirus uses… u can't delete tat file, it says windows is using that dll..


Lets do this again:
Next:
run the Trend-Micro online scan:
Trend-Micro Housecall
get it here:
http://housecall.trendmicro.com/housecall/start_corp.asp
Put on 'Autoclean' and delete what it can't clean.

Let me know what if any thing found and you delete.

reboot and get another ANALIZE THIS.EXE log and post it here
good luck mschroe919
Post #26
I've already done this lots and lots of times, but i can't delete anything more, the site tells me i can't, some error keeps happening…

the new log is here…



Logfile of HijackThis v1.99.1
Scan saved at 22:36:42, on 09/11/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\ARQUIVOS DE PROGRAMAS\ARQUIVOS COMUNS\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\WINPOS.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\NOVA PASTA JTH\ANALIZE THIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [winpos] C:\WINDOWS\winpos.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
Post #27
Hi i_know_nothing

I've already done this lots and lots of times, but i can't delete anything more, the site tells me i can't, some error keeps happening.


What is the error coming up and describe what your PC is doing now.
Did you figure out what this program is or was??

LightStart
STFLASH.EXE
Post #28
Well, somehow, i guess my pc is working a litle better now, but that virus that infects my ".exe" files is still here… i wonder if there aren't any vaccine, or any anti-virus that is able to remove it from my pc? well, anyway: Trend Micro says that some files could not be cleaned up, and gave me another option, remove it manually, but the window that pops up, isn't showed, cause my pc can only work on 16 bits color mode, it's not compactible with the site, so i can't do any further actions… heve no idea about what STFlash.exe is… don't remember to install it! anyway, on my last on trend micro scan i couldn't clean this: PE_SALITY.AC (24) BKDR_SALITY.A (1) And i could clean this: TROJ_AGENT.CSE (CLEANED) Well, i can do almost anything on my pc, but yet my video is unchangeble… so i have to keep seeing my pc on 640*480*16, that dll mentioned before, that win32:sality uses is still here… i can't do anything with it… that's all i guess… waiting any further instructions… **If you want me to do any more complicated step, there is no problem, i can call somebody to do it for me, my brother maybe…
Post #29 last edited
Hi i_know_nothing,
sorry about the delay I lost comcast cable and was without the net.

First
Found another one to get rid of:
I think we got rid of it in one of the first tries, but its back and a bad one.:

Restart in in safe mode. Please run a scan only in ANALIZE THIS.EXE and put a check by the following:

O4 - HKLM\..\Run: [winpos] C:\WINDOWS\winpos.exe

Please remember to close all other windows, including browsers then click Fix checked

NEXT:

Still in safe mode:
we need to show some hidden files. Click Start>>>>Control Panel>>>>Folder Options and double click.
Under the View tab scroll down to Hidden Files and Folders
Check Show hidden files and folders
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files (Recommended} Answer Yes
Click Apply and click OK

NEXT:

Using Windows Explorer, navigate and delete the following files,the ones in RED

C:\WINDOWS\winpos.exe
reboot and get another ANALIZE THIS.EXE log and post it here
good luck mschroe919

on my last on trend micro scan i couldn't clean this:
PE_SALITY.AC (24)
BKDR_SALITY.A (1)

Lets try this and if you need help understanding this maybe you can ask someone.
Terminating the Malware Program
This procedure terminates the running malware process. You will need the name of the file PE_SALITY.A detected earlier.
If the process you are looking for is not in the list displayed by Task Manager, proceed to the succeeding solution set.
Open Windows Task Manager.
• On Windows 98 and ME,
press CTRL+ALT+DELETE
In the list of running programs*, locate the malware file PE_SALITY.ACor BKDR_SALITY.A detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
======================================================
Also since you have AVAST4 check this site:
http://www3.ca.com/securityadvisor/virusin…s.aspx?ID=53384
and try doing one of the: View Removal Instructions .
Let me know what happens, I don't see in your log where these malware is on your pc, but lets try it.
If you find these and remove them just send me another log, with what you did find if anything.

post another log.
As far as your video being unchangeble, you may have to check your video card drivers.
good luck mschroe919
Post #30
hi!

well, there are only this programs running on my pc…

msnmsgr
qqtask
Systray
Rnaapp
Ashmaisv
Ashwebsv

just this, and i've done a scan on that site it found the same virus avast found, it had the option to clean, so i cleaned, YET it had few ones that couldn't be cleaned, one of them was that ".dll" the virus uses to infiltrate on my pc. but it removed all others. i can't change my video, but i doubt it is a hardware problem, cause i read somewhere that win32:sality:0 changes my video configuration, and blocks any move i try to get it fixed, making me use my personal passwords to try to fix it… that's it…

here is the new logfile

Logfile of HijackThis v1.99.1
Scan saved at 18:23:46, on 15/11/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\ARQUIVOS DE PROGRAMAS\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\ARQUIVOS DE PROGRAMAS\VELOX\DISCADOR\DISCADOR.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\MEUS DOCUMENTOS\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\ARQUIVOS DE PROGRAMAS\JAVA\JRE1.5.0_09\BIN\SSV.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI