Strange Acting

• Disconnect the infected computer from the internet and from any networked computers until the computer can be cleaned.
• Back up all important data on the machine. Do not back up any Applications (programs). Those should be re-installed from the original source CDs or websites.
• If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
  • Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
• From a clean computer, change ALL your online passwords – for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, games and any online forums or groups you belong to.
• DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
• Take any other steps you think appropriate for an attempted identity theft.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• It will create a report named vundofix.txt on your main drive (C:\vundofix.txt)

• Restart your computer.
• Continually tap the F8 button as your computer is booting a menu appears.
• Use up-arrow key to select Safe Mode and press Enter.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds, then prompt you to press any key to Reboot.
• Press any key and it will restart the PC.
• When the PC restarts, the Fixtool will run again and complete the removal process and then display Finished.
• Press any key to end the script and load your desktop icons.
• Once the desktop icons load, the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).

• The VundoFix report (C:\vundofix.txt)
• The SD Fix report
• A new HijackThis log

i put myself in a bad situation i believe

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once the scan is complete, Right-click inside the listbox (white box) and click add more files
• Copy/paste the following into the top text box: D:\WINDOWS\System32\hxdngcyp.dll
• Click Add Files and click Close Window
• Click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• It will create a report named vundofix.txt on your main drive (C:\vundofix.txt)

• Click Start
• Open My Computer
• Select the Tools menu and click Folder Options
• Select the View tab
• Advanced Settings:
  • Under Hidden files and folders, select Show hidden files and folders
  • Uncheck Hide extensions for known file types
  • Uncheck Hide protected operating system files (Recommended)
• Click Apply to All Folders
• Click Yes to confirm
• Click OK

• Make sure that all browser windows are closed
• Double-click the shortcut on your desktop to run the program.
• Under Main, choose Select All
• Untick Prefetch
• Click Empty Selected
• If you use Firefox browser,
  • Click Firefox at the top and choose Select All
  • Click on Empty Selected
  • NOTE: If you would like to keep any saved passwords, please untick that option.
• Click Exit to close.
• If you use Opera browser,
  • Click Opera at the top and choose Select All
  • Click on Empty Selected
  • NOTE: If you would like to keep any saved passwords, please untick that option.
• Click Exit to close.

• Click the Update icon at the top and under Manual Update click the Start update button.
• The program will either update or inform you that no update was available.
• It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).

• Click the Shield icon at the top and under Resident shield is… click active. This should now change to inactive.
• Click the Update icon and untick the automatic update option.
• Click on Scanner on the toolbar.
• Click on the Settings tab.
• Under How to act? - make sure that Quarantine is selected.
• Under How to scan? - All checkboxes should be ticked.
• Under Possibly unwanted software - All checkboxes should be ticked.
• Under Reports - Select Automatically generate report after every scan and uncheck Only if threats were found.
• Under What to scan? - Select Scan every file.

• Restart your computer.
• Continually tap the F8 button as your computer is booting (a menu appears).
• Use up-arrow key to select Safe Mode and press Enter.

• D:\WINDOWS\NOTEDAD.EXE
• D:\WINDOWS\System32\__c00A7A4.dat
• D:\WINDOWS\System32\__c00D8E90.dat
• D:\WINDOWS\System32\__c00FE83F.dat
• IExplorer.dll <– You will need to look for this. It will probably be in D:\WINDOWS\ or D:\WINDOWS\system32\

• Click on Scanner on the toolbar.
• Click on Complete System Scan to start the scan process.
• Let the program scan your computer.
• When the scan has finished, follow the instructions below:
  • Make sure that Set all elements to: shows Quarantine
  • Important: Click on the Apply all Actions button (*** This must done before saving the report ***)
  • When the program has finished, it will display the message All actions have been applied.
  • Then click the Save Scan Report button.
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Tray Icon and select Exit.

• The VundoFix report (C:\vundofix.txt)
• The AVG Anti-Spyware report
• A new HijackThis log

@echo off
sc stop "MSDisk"
sc delete "MSDisk"
sc stop "MSWindows"
sc delete "MSWindows"
del beynac.bat
exit

D:\WINDOWS\System32\__c00A7A4.dat
D:\WINDOWS\System32\irdvxc.exe
D:\WINDOWS\System32\urdvxc.exe
D:\Windows\System32\IExplorer.dll

• Open Killbox
• Click the option Delete on Reboot
• Click on the All Files button
• Go to File and click on Paste from Clipboard (Note: You must use the file menu–pasting by right-clicking the mouse will only enter one file).
• If no files appear in the drop-down box, please stop and let me know
• Click on the red button with the white 'X' on it (Delete File)
• Wait for the confirmation message that will ask you to Reboot Now
• Click Yes
• Exit the program

• Download this file - ComboFix.exe
• Close all open windows.
• Double click ComboFix.exe and follow the prompts.
• When finished, it will produce a log for you. Please post that log in your next reply

• The ComboFix log
• A new HijackThis log

I'm fairly sure that your Firefox problem is due to malware activity. Let's get rid of the malware and see if the problem is still there.

—————————————–

First, we need to find the path for the file IExplorer.dll. Click on Start, then Search. Click on All files and folders. Type IExplorer.dll into the top text box and click on Search. If the file is found, please make a note of the path (for example: D:\Windows\System32\IExplorer.dll). Please stop and let me know if it is not found. If you find it, check the path in the list for Killbox to delete (see below).

—————————————–

Select the contents of the Code Box below, right-click and copy it, then paste into Notepad.

@echo off
sc stop "MSDisk"
sc delete "MSDisk"
sc stop "MSWindows"
sc delete "MSWindows"
del beynac.bat
exit

Still in Notepad, go to Format (upper menu bar) and untick Word Wrap
Go to File (upper menu bar), and select: Save as
In the Save as prompt:
Save in: Desktop
File Name: beynac.bat
Save as Type: All files
Click: Save
Exit out of Notepad.

On the Desktop, double-click on beynac.bat. A window will open and close - this is normal.

—————————————–

Run HijackThis and click Scan and then check (tick) the following, if present (don't worry if any are missing):

O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - D:\WINDOWS\System32\hxdngcyp.dll (file missing)
O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt
O4 - HKLM\..\RunServices: [IESet] IExplorer.dll .dbt
O20 - Winlogon Notify: __c00A7A4 - D:\WINDOWS\System32\__c00A7A4.dat
O23 - Service: Network helper Service (MSDisk) - Unknown owner - D:\WINDOWS\System32\irdvxc.exe" /service (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - D:\WINDOWS\System32\urdvxc.exe" /service (file missing)


Close down all programs, browsers and other open windows. Make sure that only the above items are checked and then click on Fix checked.

—————————————–

Please download Killbox and save it to your desktop: http://www.killbox.net/downloads/KillBox.exe

I've included "IExplorer.dll" in the list for deletion. If necessary, amend the path for the file.

Copy the entire text within the quote box below.

D:\WINDOWS\System32\__c00A7A4.dat
D:\WINDOWS\System32\irdvxc.exe
D:\WINDOWS\System32\urdvxc.exe
D:\Windows\System32\IExplorer.dll

• Open Killbox
• Click the option Delete on Reboot
• Click on the All Files button
• Go to File and click on Paste from Clipboard (Note: You must use the file menu–pasting by right-clicking the mouse will only enter one file).
• If no files appear in the drop-down box, please stop and let me know
• Click on the red button with the white 'X' on it (Delete File)
• Wait for the confirmation message that will ask you to Reboot Now
• Click Yes
• Exit the program

Reboot your computer

——————————————-

ComboFix by sUBs

• Download this file - ComboFix.exe
• Close all open windows.
• Double click ComboFix.exe and follow the prompts.
• When finished, it will produce a log for you. Please post that log in your next reply

Important: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall

Please split the log into separate posts to ensure that they don't get cut off. It is important that I see the full log.

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

——————————————-

Please post, as a reply to this thread:

• The ComboFix log
• A new HijackThis log