Hijackthis log

[gbrockw]

My Internet Explorer browser has been hijacked. What can I do? I have attached my HJT log.

Thanks,

gbrockw

 

[tw0rld]

Removal instructions

Start here https://www.techspot.com/vb/topic109461.html

 

[Bobbye]

You are badly infected. Start with Step 3 on the referenced site. Run all the programs as indicated. After Malwarebytes and SuperAntispyware have been run, reopen HijackThis and scan again. Post all three logs here.

Please follow the renaming instructions for HijackThis. I wonder if your McAfee program is up to date and if you do any scans with it.

 

[gbrockw]

Response to Bobbye, 665333

You are badly infected. Start with Step 3 on the referenced site. Run all the programs as indicated. After Malwarebytes and SuperAntispyware have been run, reopen HijackThis and scan again. Post all three logs here.

Please follow the renaming instructions for HijackThis. I wonder if your McAfee program is up to date and if you do any scans with it.

Bobbye,

McAfee is scheduled to check for updates daily, it is set for real time scanning, and I have manually scanned several times since I started having problems. The scan logs come back with nothing detected.

I will follow the instructions in the linked site and get back to you.

Thanks,

gbrockw

 

[Bobbye]

McAfee isn't the only game in town! It doesn't catch everything which is why most of us recommend an antivirus program, firewall and at least two spyware/adware programs!

For starters:

O2 - BHO: (no name) - {E6D8E3C2-88E8-4100-9F91-A40A1EC36863} - C:\WINDOWS\system32\fccYPIXn.dll
O4 - HKLM\..\Run: [40a7235f] rundll32.exe "C:\WINDOWS\system32\shubicco.dll",b
O4 - HKLM\..\Run: [BM439410c3] Rundll32.exe "C:\WINDOWS\system32\jcvjbnln.dll",s
O20 - AppInit_DLLs: gkjxdi.dll
O20 - Winlogon Notify: geBssqOF - C:\WINDOWS\SYSTEM32\geBssqOF.dll

 

[gbrockw]

Hijackthis log2

Bobbye,

I had to run the malwarebytes twice because the computer froze up the first time. I have included both logs. We will see if the fixes work.

Thanks for reviewing these logs.

Gbrockw

 

[Bobbye]

McAfee didn't do you much good! Your system is badly infected with Vundo in addition to other malware. This log is even different from the original one! This is showing now:
Bad:

O20 - AppInit_DLLs: uwvftk.dll

SAS finds the following: Bad:

Adware.MovieLand/MediaPipe> AppId\AMNotifier.EXE>>>> This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.
Adware.ClickSpring/Outer Info Network> Software\OINAnalytics>>>> OINAnalytics.dll is Trojan/Backdoor.

Bad:
MBAM show (Trojan.Vundo.H) with nothing fixed! Did you check the Malwarebytes as instructed for removal? Nothing was removed- I'm not sure it will handle the Vundo. The malware is also in the memory, so it loads from there and stays.

I am going to ask someone else to take you through this cleaning. They will guide you through. Please be patient. Do NOT do any System Restores or set any new restore points. Do NOT install any new programs or update with the exception of McAfee.

 

[Bobbye]

Sorry for the delay. Are you still having the same problems? If so let's proceed like this:
Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please attach the C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

When you ran Malwarebytes. Did you follow the directions for checking to fix? There are 2 lines in the instructions saying: "* When the scan is complete, click OK, then Show Results to view the results.* Make sure that everything is checked, and click Remove Selected."
If you did not, run Malwarebytes again. "after" Vundo, The HijackThis and attach all three logs.