[Resolved] wifes comp ---log

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Post a new HijackThis Log.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

VundoFix V6.6.2 Checking Java version… Scan started at 9:38:37 PM 11/19/2007 Listing files found while scanning…. C:\WINDOWS\system32\qomnolm.dll Beginning removal… Attempting to delete C:\WINDOWS\system32\qomnolm.dll C:\WINDOWS\system32\qomnolm.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.6.2 Checking Java version… Scan started at 10:03:44 PM 11/19/2007 Listing files found while scanning…. No infected files were found.

Sorry. I post a fix in a minute

Run HiJackThis then:

1. Click "Misc Tools"
2. Click "Open Process manager"
3. Over on the right side, put a check / tick in the box: Click "show dll's" button in the process manager.
-
Next, while holding down the CTRL key, locate (if present) and click on (highlight) the following:

C:\WINDOWS\system32\qomnolm.dll

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process".

===============

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: (no name) - {464BCCCC-960B-45F2-8ABC-09250669DB2A} - C:\WINDOWS\system32\byvsp.dll
O2 - BHO: (no name) - {80bc7625-8a1b-4aeb-909c-9ae12e07cc52} - C:\WINDOWS\system32\actcfg.dll (file missing)
O20 - Winlogon Notify: actcfg - actcfg.dll (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete this File if listed:
C:\WINDOWS\system32\qomnolm.dll



Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

if my wifes harddrive is connected to mine as a slave, will all these scans find everything in hers as well(shes kind of getting impatient with me about fixing her comp)

You might be able to get you anti-virus scan to scan her hard drive after your's is clean.


Close all windows and browsers.
Open HijackThis

Click on Open Misc Tools
Click on Delete a File On Reboot
Click once on the file below to select it:
C:\WINDOWS\system32\byvsp.dll

Click on the Back button to exit Process Manager

Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.

O2 - BHO: (no name) - {C939AB6D-B8E3-41AB-AC89-A61C05EC47F6} - C:\WINDOWS\system32\byvsp.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

As you can see it's still there.

Please go HERE and do a online scan.


Accept the License Agreement.
Once the ActiveX installs,Click Full System Scan
Once the download completes,the scan will begin automatically.
The scan will take some time to finish,so please be patient.
When the scan completes, click the Automatic cleaning (recommended) button.

Click the Show Report button and Copy&Paste the entire report in your next reply along with a fresh HijackThis log.


Also let me know how the computer is running now.

something isnt going right . i keep getting the error message: Downloaded database file is corrupt. Please close the scanner and try again.

Lets try a different one then.

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
• If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  [external image: Posted Image]
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.

since the F-Secure online scanner didnt work i ran Superantispyware and it detected 33 items. i dont know if this solved the problem(s) or not but i can still run the other scan if necessary


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/20/2007 at 02:26 PM

Application Version : 3.9.1008

Core Rules Database Version : 3346
Trace Rules Database Version: 1347

Scan type : Complete Scan
Total Scan Time : 02:00:49

Memory items scanned : 269
Memory threats detected : 2
Registry items scanned : 3006
Registry threats detected : 13
File items scanned : 51016
File threats detected : 18

Adware.Vundo-Variant/Small
C:\WINDOWS\SYSTEM32\PMNOLIG.DLL
C:\WINDOWS\SYSTEM32\PMNOLIG.DLL
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\pmnolig
C:\WINDOWS\SYSTEM32\NNNMKII.DLL
C:\WINDOWS\SYSTEM32\QOMNOLM.DLL
C:\WINDOWS\SYSTEM32\RQROMLL.DLL

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\BYVSP.DLL
C:\WINDOWS\SYSTEM32\BYVSP.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6391B616-B24F-4648-A960-DDB655B1CA68}
HKCR\CLSID\{6391B616-B24F-4648-A960-DDB655B1CA68}
HKCR\CLSID\{6391B616-B24F-4648-A960-DDB655B1CA68}\InprocServer32
HKCR\CLSID\{6391B616-B24F-4648-A960-DDB655B1CA68}\InprocServer32#ThreadingModel

Unclassified.Unknown Origin
HKLM\Software\Classes\CLSID\{BCC73622-F72D-4277-803C-D65565A0947F}
HKCR\CLSID\{BCC73622-F72D-4277-803C-D65565A0947F}
HKCR\CLSID\{BCC73622-F72D-4277-803C-D65565A0947F}\InprocServer32
HKCR\CLSID\{BCC73622-F72D-4277-803C-D65565A0947F}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{BCC73622-F72D-4277-803C-D65565A0947F}
HKCR\CLSID\{BCC73622-F72D-4277-803C-D65565A0947F}

Adware.Tracking Cookie
C:\Documents and Settings\Admin.BIODROID-001\Cookies\admin@atdmt[2].txt
C:\Documents and Settings\Admin.BIODROID-001\Cookies\admin@msnportal.112.2o7[1].txt

Trojan.Net-RADE
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#Advanced DHTML Enable [ C:\WINDOWS\system32\tuqd.exe ]

Adware.Vundo-Variant
C:\PROGRAM FILES\HIJACKTHIS\BACKUPS\BACKUP-20071119-224308-903.DLL
C:\PROGRAM FILES\HIJACKTHIS\BACKUPS\BACKUP-20071119-230751-572.DLL

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{114CE0C9-715C-41B1-90C3-F38A441C286C}\RP12\A0008704.EXE
C:\WINDOWS\SYSTEM32\BFHYJ.EXE
C:\WINDOWS\SYSTEM32\LJJIGHF.DLL
C:\WINDOWS\SYSTEM32\MLJHFDB.DLL
C:\WINDOWS\SYSTEM32\QOPQRPN.DLL
C:\WINDOWS\SYSTEM32\RQRPNLJ.DLL
C:\WINDOWS\Prefetch\BFHYJ.EXE-13CE7FA1.pf

Worm.Agobot-NI
C:\WINDOWS\SYSTEM32\CSRS.EXE
C:\WINDOWS\Prefetch\CSRS.EXE-368A04E2.pf

In light of what was found, I'd run this.

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
• If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  [external image: Posted Image]
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.