TechSpot

Help Darksma and Vundo are ruining my life

By fatman01923
Apr 26, 2008
  1. Can anyone help me remove these nasty viruses, and Trojans permanently? Please step by step process, and no spyware detectors cause nothing works with them. So please look at my Hijack this file and tell me what to delete please somebody its a pain in the a**.
     
  2. kritius

    kritius TS Guru Posts: 2,084

    This next step is purely optional however viewpoint is considered foistware and is not needed on your computer,


    Go to Start > Run and copy/paste or type: taskmgr
    • Under the Processes tab find the following tasks or processes:
      ViewpointService.exe
      ViewMgr.exe
    • Highlight and click "End Process".
    • Exit Task Manager.
    Click on Start > Run and type: services.msc
    • Press "OK".
    • Click the "Extended tab".
    • Scroll down the list and find the service called "Viewpoint Manager Service"
    • When you find the service, double-click on it.
    • In the Properties Window > General Tab that opens, click the "Stop" button.
    • From the drop-down menu next to "Startup Type", click on "Disabled".
    • Now click "Apply", then "OK" and close any open windows.
    Click on Start > Settings > Control Panel > Add/Remove Programs > highlight and remove all references to Viewpoint - i.e. Viewpoint, Viewpoint Manager, Viewpoint Media Player.

    Finally, delete the following folders if they still exist:
    C:\Program Files\ViewManager\ <-- and delete this folder
    C:\Program Files\Viewpoint\ <-- and delete this folder

    Fix entries using HiJackThis
    • Launch HiJackThis
    • Click the Do a system scan only button
    • Put a check next to the entries listed below
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O4 - HKLM\..\Run: [e0430732] rundll32.exe "C:\WINDOWS\system32\xsijpgxj.dll",b
    O4 - HKLM\..\Run: [BMe37034ae] Rundll32.exe "C:\WINDOWS\system32\ecpqvnab.dll",s

    • IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
    • Click the Fix checked button and close HiJackThis
    • Reboot HijackThis if necessary

    Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

    Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present):

    C:\Program Files\AskSBar\

    Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these files (if present):

    C:\WINDOWS\system32\xsijpgxj.dll
    C:\WINDOWS\system32\ecpqvnab.dll


    After that, Reboot

    : Download and Run DSS

    Download Deckard's System Scanner (DSS) to your Desktop. You must be logged onto an account with administrator privileges.
    • Close all applications and windows.
    • Double-click on dss.exe to run it, and follow the prompts.
    • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<- this one will be minimized.
    • Attach the main.txt and the extra.txt in your reply.
     
  3. fatman01923

    fatman01923 TS Rookie Topic Starter

    Results

    These are my results...
     
  4. kritius

    kritius TS Guru Posts: 2,084

    I would recommend unistalling the following, the first two are optional but the others need to be removed.

    BitTorrent
    BitTorrent DNA
    Download Accelerator Plus (DAP)
    J2SE Runtime Environment 5.0 Update 8
    Java(TM) 6 Update 3
    LiveUpdate


    Fix entries using HiJackThis
    • Launch HiJackThis
    • Click the Do a system scan only button
    • Put a check next to the entries listed below
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
    O2 - BHO: (no name) - {446A0DE1-7CDD-4142-9528-FD1FF3A57DBE} - (no file)
    O2 - BHO: {be90317e-3892-fd08-9ac4-1773813d4eb4} - {4be4d318-3771-4ca9-80df-2983e71309eb} - C:\WINDOWS\system32\shlkectc.dll
    O2 - BHO: (no name) - {4f30f509-5151-410c-ab04-4f1cdf99e4fd} - (no file)
    O2 - BHO: (no name) - {7607DD28-4982-4A91-B550-1E7F3FCDB81A} - C:\WINDOWS\system32\qoMdETKe.dll
    O2 - BHO: (no name) - {8625194E-B724-465C-83C8-1C14C99A0DEF} - (no file)
    O2 - BHO: (no name) - {B338F97B-26A0-40D1-B070-FECF81C5DA25} - (no file)
    O2 - BHO: (no name) - {C3F37ECA-A8D9-4633-92C6-FE24C7D16ABA} - C:\WINDOWS\system32\urqPfGWp.dll (file missing)
    O2 - BHO: (no name) - {DEEB11F7-A760-426D-B87C-6F02F6D1FCF9} - (no file)
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [BMe37034ae] Rundll32.exe "C:\WINDOWS\system32\uaqlkrul.dll",s

    • IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
    • Click the Fix checked button and close HiJackThis
    • Reboot HijackThis if necessary

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post and attach a new HJT log.
     
  5. fatman01923

    fatman01923 TS Rookie Topic Starter

    File/Folder not found.
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\ojyqtntm.dll
    C:\WINDOWS\system32\ojyqtntm.dll NOT unregistered.
    C:\WINDOWS\system32\ojyqtntm.dll moved successfully.
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\shlkectc.dll
    C:\WINDOWS\system32\shlkectc.dll NOT unregistered.
    C:\WINDOWS\system32\shlkectc.dll moved successfully.
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\ecpqvnab.dll
    C:\WINDOWS\system32\ecpqvnab.dll NOT unregistered.
    C:\WINDOWS\system32\ecpqvnab.dll moved successfully.
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\qoMdETKe.dll
    C:\WINDOWS\system32\qoMdETKe.dll NOT unregistered.
    File move failed. C:\WINDOWS\system32\qoMdETKe.dll scheduled to be moved on reboot.
    C:\WINDOWS\system32\eKTEdMoq.ini2 moved successfully.
    C:\WINDOWS\system32\jTBIPXyb.ini2 moved successfully.
    C:\WINDOWS\system32\eNpYaccf.ini2 moved successfully.
    C:\WINDOWS\system32\PYFOVvut.ini2 moved successfully.
    C:\WINDOWS\system32\uBdKlnpo.ini2 moved successfully.
    C:\WINDOWS\system32\HQqWycdd.ini2 moved successfully.
    C:\WINDOWS\system32\LUBbKkkj.ini2 moved successfully.
    C:\WINDOWS\system32\ps3sixaxis_en.exe moved successfully.
    C:\Program Files\AskSBar\SrchAstt\1.bin moved successfully.
    C:\Program Files\AskSBar\SrchAstt moved successfully.
    C:\Program Files\AskSBar\bar\Settings moved successfully.
    C:\Program Files\AskSBar\bar\History moved successfully.
    C:\Program Files\AskSBar\bar\Cache moved successfully.
    C:\Program Files\AskSBar\bar\1.bin moved successfully.
    C:\Program Files\AskSBar\bar moved successfully.
    C:\Program Files\AskSBar moved successfully.
    C:\VundoFix Backups moved successfully.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{446A0DE1-7CDD-4142-9528-FD1FF3A57DBE} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{446A0DE1-7CDD-4142-9528-FD1FF3A57DBE}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4be4d318-3771-4ca9-80df-2983e71309eb} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4be4d318-3771-4ca9-80df-2983e71309eb}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f30f509-5151-410c-ab04-4f1cdf99e4fd} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f30f509-5151-410c-ab04-4f1cdf99e4fd}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7607DD28-4982-4A91-B550-1E7F3FCDB81A} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7607DD28-4982-4A91-B550-1E7F3FCDB81A}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8625194E-B724-465C-83C8-1C14C99A0DEF} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8625194E-B724-465C-83C8-1C14C99A0DEF}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B338F97B-26A0-40D1-B070-FECF81C5DA25} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B338F97B-26A0-40D1-B070-FECF81C5DA25}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3F37ECA-A8D9-4633-92C6-FE24C7D16ABA} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3F37ECA-A8D9-4633-92C6-FE24C7D16ABA}\\ not found.
    < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DEEB11F7-A760-426D-B87C-6F02F6D1FCF9} >
    Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DEEB11F7-A760-426D-B87C-6F02F6D1FCF9}\\ not found.
    < HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} >
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}\ deleted successfully.
    File/Folder -HKEY_CLASSES_ROOT\CLSID\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} not found.
    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BMe3 7034ae >
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BMe3 7034ae not found.
    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ ShellExecuteHooks\\{C3F37ECA-A8D9-4633-92C6-FE24C7D16ABA} >
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ ShellExecuteHooks not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3F37ECA-A8D9-4633-92C6-FE24C7D16ABA}\ deleted successfully.
    < purity >
    Explorer started successfully

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04262008_180348

    Files moved on Reboot...
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\qoMdETKe.dll
    C:\WINDOWS\system32\qoMdETKe.dll NOT unregistered.
    File move failed. C:\WINDOWS\system32\qoMdETKe.dll scheduled to be moved on reboot.
     
  6. kritius

    kritius TS Guru Posts: 2,084

    That looks pretty much clean.

    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.
     
  7. fatman01923

    fatman01923 TS Rookie Topic Starter

    Thanks a bunch

    I will perfrom this scan, and i want to thank you for all of your hard work, I will try to help anyone new here with this problem like you did with me, now i will be more careful ,and do this final scan like u said, Thanks again!
     
  8. kritius

    kritius TS Guru Posts: 2,084

    No problem, once we see what that scan says we should be in the final stretch.
     
  9. fatman01923

    fatman01923 TS Rookie Topic Starter

    Results

    This is my results to the scan...
     
  10. kritius

    kritius TS Guru Posts: 2,084

    Please open the OTMoveIt2 by OldTimer
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      [kill explorer]
      C:\WINDOWS\system32\bjrgihrr.dll_old
      C:\WINDOWS\system32\byXPIBTj.dll_old
      C:\WINDOWS\system32\pbwgwbyu.dll_old
      C:\WINDOWS\system32\qoMdETKe.dll
      purity
      [start explorer]
          
    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
     
  11. fatman01923

    fatman01923 TS Rookie Topic Starter

    This is my result of the new scan

    C:\WINDOWS\system32\bjrgihrr.dll_old moved successfully.
    C:\WINDOWS\system32\byXPIBTj.dll_old moved successfully.
    C:\WINDOWS\system32\pbwgwbyu.dll_old moved successfully.
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\qoMdETKe.dll
    C:\WINDOWS\system32\qoMdETKe.dll NOT unregistered.
    File move failed. C:\WINDOWS\system32\qoMdETKe.dll scheduled to be moved on reboot.
    < purity >
    Explorer started successfully

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04272008_103946

    Files moved on Reboot...
    DllUnregisterServer procedure not found in C:\WINDOWS\system32\qoMdETKe.dll
    C:\WINDOWS\system32\qoMdETKe.dll NOT unregistered.
    File move failed. C:\WINDOWS\system32\qoMdETKe.dll scheduled to be moved on reboot.
     
  12. kritius

    kritius TS Guru Posts: 2,084

    1. Please download The Avenger2 by Swandog46 to your Desktop.
    • Right click on the Avenger.zip folder and select "Extract All..."
    • Follow the prompts and extract the avenger folder to your desktop
    2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
    Code:
    Files to delete:
    C:\WINDOWS\system32\qoMdETKe.dll
    
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
    • Right click on the window under Input script here:, and select Paste.
    • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V).
    • Click on Execute
    • Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:
    • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
    • On reboot, it will briefly open a black command window on your desktop, this is normal.
    • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip
     
  13. fatman01923

    fatman01923 TS Rookie Topic Starter

    Alright all cleaned up now

    Thanks for all the troubles, those were some nasty Trojans. Hope to be of some help here in the forums in the future.
    Take care man.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...