[Resolved] Help me get rid of adware.agent.BN

• Hello, and welcome to the forum.
  
  My name is Simon V., and I'll be glad to help you with your computer problems.
  
  HijackThis logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happens.
  
  I'd be grateful if you would note the following:
  
• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
  
  I'll get back to you as soon as possible.

• Hi
  
  If your System Restore is still disabled, please re-enable it:
  
  Re-Enable System Restore
  
• On the desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Uncheck Turn off System Restore.
  • Click Apply, and then click OK.
  SmitfraudFix
  
• Please download SmitfraudFix (By S!ri).
  • Double-click on SmitfraudFix.exe. A screen will pop up. Select Option 1 (Search) by typing 1 and hit enter. A text file will appear, which will list the infected files. Save it to a convenient location.
  • The log will also be saved here: C:\rapport.txt
  • Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
  Make an Uninstall List
  
• To access the Uninstall Manager you would do the following:
  
  1. Start HijackThis
  2. Click on the Config button
  3. Click on the Misc Tools button
  4. Click on the Open Uninstall Manager button.
  5. Click on the Save list… button and save the file to a convenient location. When you press Save, Notepad will open with the contents of that file.
  
  Report Back
  
• Please post the report from SmitfraudFix and the Uninstall List, along with a new HijackThis log in your next reply.

• Hi
  
  P2P Warning
  
• I understand that downloading music and other files may be important to you; however, the P2P programs that you are using to do that, even if they are not infected with malware, will bring malware into your system. Therefore, the chances of you becoming infected again are very high. This obviously can result in disabling your computer and could even lead to someone stealing sensitive personal data from your computer. Beyond the inconvenience this causes you, these programs also tend to use your computer as a server to spread more infection all over the internet, so your computer becomes a part of the malware problem.
  
  Remember that no matter how clean the program you're using for Peer-to-Peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via P2P filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Any program or file that offers you the ability to access non-freeware programs at no cost, e.g., pirated software and/or cracks/key generators for gaining access to legitimate software, is 100% guaranteed to contain malware.
  
  Here is some information that looks at the rates of infection:
  
  http://www.benedelman.org/spyware/p2p/
  
  With that being said, I recommend that you remove the following P2P program(s):
  
  LimeWire 4.14.8
  
  AVG Anti-Spyware
  
• Please download and install AVG Anti-Spyware.
  
  After the installation, open AVG Anti-Spyware and do the following:
• Under 'Status', click on Change state, next to 'Resident shield' (this will change from Active to Inactive)
• Under the 'Update' tab, click on 'Start update'.
• Under 'Scanner', click on the 'Settings' tab:
• Under 'How to act?', click on 'Recommended actions', and select Quarantine.
• Under 'Reports', select 'Do not automatically generate reports'.

• A screen will pop up. Select Option 2 (Clean) by typing 2 and hit Enter.
• You will be prompted: 'Registry Cleaning - Do you want to clean the registry?' Answer Yes by typing Y and press Enter in order to clean registry keys associated with the infection.
• The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file; answer Yes by typing Y and hit Enter.
• The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart Windows into Normal Mode.
• A text file will appear onscreen, with results from the cleaning process; please copy the content of that report and paste it in your next reply. The report can also be found at C:\rapport.txt.

• Click on the 'Scan' tab.
• Click on 'Complete System Scan' to start the scan process.
• After the scan, do the following:Important: Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
• Make sure that Set all elements to: shows Quarantine (1), if not, click on the link and select 'Quarantine' from the popup menu. (2)
• At the bottom of the window click on the Apply all Actions button. (3)
• When done, click the 'Save Report' (4) button, and save the file to your desktop.

@echo off

if exist C:\export.txt del /q C:\export.txt
regedit /a C:\export.txt "HKEY_CURRENT_USER\Software\FCRMFC"
start C:\export.txt
exit

• Hi
  
  Backup the Registry
  
• Download ERUNT
  • Save it to your desktop. Install the program, then run it.
  • In the box that opens place a check next to all items, then click OK. It may take a minute. Just let it go until it's done.
  • Click OK again when it's finished.
  • Close ERUNT.
  This is so the registry can be restored to this point if we need it.
  
  Fix Entries with HijackThis
  
• Open HijackThis, perform a scan and put a check next to the following items (if present):
  
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: MSVPS System - {90CF5384-7C70-4CD6-A30D-B2F14537B5C3} - C:\WINDOWS\movctrlwxq.dll
  O3 - Toolbar: The nssfrch - {7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC} - C:\WINDOWS\nssfrch.dll (file missing)
  O4 - HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFix\registrycleanfix.exe
  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
  
  Close all programs except HijackThis and click on Fix checked.
  
  Run a .reg File
  
• Copy the text below into a Notepad (Go to Start > Run, type Notepad and hit Enter) document:
  
  

  REGEDIT4
  
  [-HKEY_CURRENT_USER\Software\FCRMFC]

  
  Note: Make sure there is no blank line before REGEDIT4 and one blank line at the end.
  
• Go to File > Save As:. Save the file as "Fix.reg" (Including the quotes)
  
• Double-click on Fix.reg. When asked if you want to merge the file with the registry, click Yes.
  
  Download and Run OTMoveIt
  
• Download OTMoveIt by OldTimer from here.
  • Double click on OTMoveIt to start OTMoveIt.
    [external image: Posted Image]
  • Untick the option to Unregister Dll's and Ocx's (1).
  • Select the contents of the below codebox, then press Ctrl+C to copy it to the clipboard.
    

    C:\WINDOWS\movctrlwxq.dll
    C:\WINDOWS\nssfrch.dll
    C:\Program Files\RegistryCleanFix

  • In OTMoveIt right-click on the box labelled Paste List of Files/Folders to be Moved.
  • Click Paste (2).
  • Click MoveIt! (3).
  • If it asks you to reboot allow that.
  • A logfile will be created at C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log (where mmddyyyy_hhmmss are numbers giving date and time the log was created).
  Report Back
  
• Please post the report from OTMoveIt, along with a new HijackThis log in your next reply. Also tell me how everything is working.

• Hi
  
  

  The OTMoveIt thing doesn't work - I click 'MoveIt!', but it says the files can't be found and it can't create folder C:\_OTMoviteIt\MovedFiles\…

  
  That's OK, it means the files were deleted already
  
  

  Everything has been working fine since yesterday after I did everything you told me to do - just a little slow at start up, but I think that's because I have so many new anti-virus/spyware programs running now. Is it alright if I delete some of them later?

  
  We'll remove everything I've let you download, but there are a few programs you should have/keep (for instance, be sure to keep Ad-Aware and McAfee) in order to prevent future infections:
  
  Prevention
  
• Congratulations, your log looks clean. Please advise of any problems you are still experiencing, or follow these simple steps to keep your computer clean in the future:
  • OTMoveIt Cleanup
  • Please open OTMoveIt.
    • Click on the CleanUp! button. If your Firewall gives a warning about OTMoveIt wanting to download a file, allow it.
    • Answer Yes to the prompt.
    • The program will ask for a reboot. Answer Yes.
  • Disable and Enable System Restore - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
    • Turn off System Restore.
    • On the desktop, right-click My Computer
    • Click Properties
    • Click the System Restore tab
    • Check Turn off System Restore
    • Click Apply, and then click OK
    • Reboot.
    • Turn on System Restore.
    • On the desktop, right-click My Computer
    • Click Properties
    • Click the System Restore tab
    • Uncheck Turn off System Restore
    • Click Apply, and then click OK
    NOTE: only do this ONCE, NOT on a regular basis!
  • Make your Internet Explorer more secure
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab.
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Update your Anti-Virus Software - It is very imprtant that you update your Anti-Virus software at least once a week (even more if you wish). If you do not update your Anti-Virus software then it will not be able to catch any of the new variants that may come out.
• Visit Microsoft's Update Site Frequently - It is important that you visit http://update.microsoft.com/ regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
  This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
  Instructions for - Spybot S & D and Ad-aware
• Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. An article on anti-malware products with links for this program and others can be found here:
  Computer Safety on line - Anti-Malware
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  Follow this list and your potential for being infected again will reduce dramatically.
• Stand Up and Be Counted!
  
  Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints Malware Complaints, you have to be registered to post after registering just find your country room and register your complaint.
  The infection you had was Smitfraud.