What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] I got a virus last night. avg spyware scan and hijack

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I'm not sure what happened here. But you are completely reinfected with Vundo again.

Let's try this:
Let's remove some more things that Kaspersky has found.
Then attack the infection once again.
If you decided to reformat due to time constraints for work I completely understand.
I just hate it when these virus/ crapola win.
It's fairly easy to remove most times.

If you decide to continue do the following.



______________________________
HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

O2 - BHO: {7c009dfd-dda5-cf7a-8434-429a0a3f65d4} - {4d56f3a0-a924-4348-a7fc-5adddfd900c7} - C:\WINDOWS\system32\aqwlgnhm.dll
O2 - BHO: (no name) - {74100C70-A7B0-4E97-9B29-33A525B0ED13} - C:\WINDOWS\system32\jkkll.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\hsxitfcr.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\hsxitfcr.dll


O4 - HKLM\..\Run: [784e749e] rundll32.exe "C:\WINDOWS\system32\fewfxybi.dll",b
O20 - Winlogon Notify: hsxitfcr - C:\WINDOWS\SYSTEM32\hsxitfcr.dll
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\xmjysoeh.exe (file missing)

______________________________
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


    C:\WINDOWS\system32\aqwlgnhm.dll
    C:\WINDOWS\system32\xmjysoeh.exe
    C:\WINDOWS\SYSTEM32\hsxitfcr.dll
    C:\WINDOWS\system32\fewfxybi.dl
    C:\WINDOWS\system32\jkkll.dll
    C:\Documents and Settings\Owner\My Documents\_Copy of WD Sync 09-02-2007\C\Brenda\stuff on cds\MY_PICTURES\WALLPAPER\BLUECMASV2.EXE
    C:\Documents and Settings\Owner\My Documents\_Copy of WD Sync 09-02-2007\C\Brenda\stuff on cds\omegapro32\Mirc32.exe
    C:\Documents and Settings\Owner\My Documents\_Copy of WD Sync 09-02-2007\C\Brenda\stuff on cds\Popin4Jesus7\backup\Popin4Jesus7.exe
    C:\Documents and Settings\Owner\My Documents\_Copy of WD Sync 09-02-2007\C\Brenda\stuff on cds\Popin4Jesus7\mirc.exe


  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
  • Close OTMoveIt
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

_______________________________________________


You need to update SunJava for security reasons.
Updating Java:
Download the latest version of
Java Runtime Environment (JRE) 6 Update 3
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 3
    … allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the [external image: Posted Image] icon next to it.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u3-windows-i586-p.exe
    to install the newest version.
_________________________________________________




Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
  • Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
    • In the Files Created Within group click 30 days
    • In the Files Modified Within group select 30 days
    • In the File String Search group select Non-Microsoft
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.



_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from Combo Fix
  • The report from WinPfind
Post #17 last edited
I think I'm going to go ahead and format. I was waiting for your reply just to make sure that would delete the virus. Am I right in that thinking? Is this something that will remain in memory or boot sectors or something, even with a format? I'm sorry to disappoint you. If I had the time, I would work on it but I just can't lose any more work. When I start it back up and do all the windows updates and things, what is the best protection to have? I tried avg but it never found anything so I deleted it and installed avast, which obviously let all this in. Whenever I download something I always right click on it and click scan with avast. The only place I can imagine I got it from would be giveawayoftheday.com I sometimes get their software of the day. Guess maybe I shouldn't do that anymore. EDIT: also, the formatting I'm doing would be to put the system cd in and have it reinstall to factory settings (since I have the cd, I'm going to remove the dell partition with the OS just in case). Is that what I should do?
Post #18
I understand completely christianirc.
Sorry we lost this one but that's just the way it goes sometimes.

Yes formatting will take this infection out.

Heres what I would do .

Back up everything I need to keep.

Disconnect for the net during the format and reinstall.

First your anti Virus.
Remember that there isn't an anit virus out there that will catch everything.
Have it downloaded and saved to a flash drive or CD for instalation.
This way you will not have to connect back to the web before on is installed. ;)
This will be the first thing you install after windows comes up and is running.

If you have a restore CD from the manufacturer of the computer it may install one for you.
Never run 2. NEVER!

These are free.
AVG FREE
Avast
Avira AntiVir Personal Edition Classic

_____________________________________
Firewall.
Get a good software firewall in place. You may do the same thing. Have it downloaded and saved for installation.

A few words on Microsoft's firewall. It only works in one direction. Incoming.
That means if something gets by it you would never know it was trying
to contact the internet.
Example: A bad program installs itself. You would never know it was contacting the internet.
Downloading other nasties and so forth.

If you decide to run one of these you should be certain Microsofts firewall is disabled.
To disable it.
These also are free.

Zone Alarm
Comodo

_____________________________________

Heres a site with good sound advice on reformatting.
http://spyware-free.us/tutorials/reformat/

_______________________________________



A few things to help with possible threats

These are optional . But will help protect you further.
___________________________________

SpywareBlaster

Install SpywareBlaster

SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs.
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.


______________________________
SiteHound

http://www.firetrust.com/firetrustsitehound.html

This tool bar will help protect you from.

Over 4,000 fake bank and credit sites.
Tens of thousands of pornographic
and adult sites.
The never ending fake phishing sites.
Malicious sites, which can infect you
with spyware and adware if you visit
them.
Sites to download software which
may infect your computer with
spyware, a virus or adware


___________________________________
Download and keep this updated and run weekly if you don't already have it.

spybot seach & destroy
Tutorial




___________________________________
Download and Install a HOSTS File
A Hosts file is a plain text file which prevents your computer from connecting to malware and spyware sites by redirecting the connection request to 127.0.0.1, which is your local address. If you use a proxy server, or if you are on AOL, be sure to read the special instructions.
You can download the MVPS Hosts File and see a HOSTS file tutorial here :
This website also contains useful tips, and links to other resources and utilities.


___________________________________
Make your Internet Explorer more secure
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

6. Next press the Apply button and then the OK to exit the Internet Properties page.




Here's a site with great advise on how to AVOID malware. Much easier to do than removing it.


  • Be certain windows stays updated here

If I can be of anymore help feel free to ask.


___________________________________
Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints Malware Complaints, you do not have to be registered to post.. just find your country room and register your complaint.
The infections you had was Vundo

Safe and Happy Surfing. :)
Post #20
I've installed avast, spywareblaster, windows updates, host files, and I installed and then uninstalled sitehound… it really slowed down my browser. I'm going to buy McAfee VirusScan Plus 2008 with SiteAdvisor. I know you shouldn't have conflicting things on your computer. I haven't put zonealarm yet, I'm going to. But I wondered if it would conflict. I know I will need to uninstall avast too. Do you know if anything else would conflict?
Post #21 last edited
No that all sounds fine.
McAfee VirusScan Plus 2008 If I'm not mistaken comes with it's own firewall. So you won't need Zone Alarm if this is true.

SiteHound.
Yes it does slow down internet explorer from the initial opening . They are working on that issue.
I use site hound for Firefox. This works much better. And with very little time/practice Firefox is as easy to use (if not easier) as IE.

Best of luck to you.
Post #22
I prefer firefox but the dell tech (who I had to breakdown and call because they sent me the wrong drivers cd when I bought the computer) told me it isn't as safe as IE. However, I MUCH prefer it and I think I'll put it back. I thank you SO much for your help. I'm going to go to the donate page in your sig and donate money. You really helped me out and gave me great information for the future. Thank you and God Bless!
Post #23

I prefer firefox but the dell tech (who I had to breakdown and call because they sent me the wrong drivers cd when I bought the computer) told me it isn't as safe as IE. However, I MUCH prefer it and I think I'll put it back.


Non sense.
You go ahead and put it back if you like. You can always use either.
And sitehound works better thus far with FF.

I will have this thread closed now.
It was my pleasure to help you.
Post #24
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI