TechSpot

IE slow, IE screen blanks out inbetween loading pages, popups, computer freezes, help

By OmniProbe
May 18, 2007
Topic Status:
Not open for further replies.
  1. I have Webroots spy sweeper + anti virus and scanned a trojan horse then it started happening. Also vitrumonde keeps coming up after i quarantine it.
  2. momok

    momok TS Rookie Posts: 2,272

    Hi OmniProbe and welcome to techspot =)

    Your system is infected with the vundo trojan and adware.

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Download Vundofix from HERE.

    Double click the Vundofix.exe to run it.
    Right click in the vundofix window and click add files.

    Enter the following file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button:
    C:\WINDOWS\system32\ljjgeed.dll
    C:\WINDOWS\system32\vtuts.dll


    Click the remove vundo button and let Vundofix do its stuff.

    Once you click yes, your desktop will go blank as it starts removing Vundo.
    When completed, it will prompt that it will shutdown your computer, click OK.
    Turn your computer back on.

    Boot into safe mode under your normal user name. See how HERE

    Next turn on "Show all files and folders, including hidden and system". See how HERE

    Go to start > run and type services.msc. Press the enter key.
    Search for the following services(if there) double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    zzzHPSETUP
    Viewpoint Manager Service


    Go to start > Control Panel > Add and Remove Programs.
    Remove anything related to the following:

    Viewpoint Service/Manager/Media Player etc

    Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

    ViewpointService.exe

    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

    O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\ljjgeed.dll
    O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\qstjsyrs.dll
    O2 - BHO: (no name) - {6A9B166F-768E-4F7D-90A3-5A6D9F29D6EE} - C:\WINDOWS\system32\vtuts.dll

    O4 - HKLM\..\Run: [zzzHPSETUP] "E:\Setup.exe" \RESET
    O4 - Global Startup: LaunchU3.exe.lnk = ?

    O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130 < only fix this if the domain does not belong to your ISP

    O20 - Winlogon Notify: ljjgeed - C:\WINDOWS\SYSTEM32\ljjgeed.dll
    O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    Close HJT.


    Navigate in Windows Explorer and delete the following files and folders in bold.

    C:\WINDOWS\system32\ljjgeed.dll
    C:\WINDOWS\system32\qstjsyrs.dll
    C:\WINDOWS\system32\vtuts.dll
    C:\Program Files\Viewpoint

    Reboot into normal mode and rehide your protected OS files.

    Thereafter, please post fresh HJT, ComboFix, AVG Antispyware logs and C:\vundofix.txt from normal mode as attachments into this thread.


    Regards,
    Your friendly Momok =)

    This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. OmniProbe

    OmniProbe TS Rookie Topic Starter

    THank you Great instructions and great forums! Here is my new log:
    View attachment 17490
    I couldnt delete ljjgeed.dll in safe mode after I followed everystep but the other files were not present.
    Thanks again
  4. momok

    momok TS Rookie Posts: 2,272

    Hi,

    I noticed you have not followed all my instructions to the letter.

    Viewpoint is still not uninstalled and running on your computer. I also need the other requested logs.

    Please follow these instructions carefully.

    1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt (from my attachment) and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.


    You may wish to copy and paste these instructions on notepad for easier reference later.

    Boot into safe mode under your normal user name. See how HERE

    Next turn on "Show all files and folders, including hidden and system". See how HERE

    Go to start > run and type services.msc. Press the enter key.
    Search for the following services(if there) double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    ViewpointService.exe
    ViewMgr.exe


    Go to start > Control Panel > Add and Remove Programs.
    Remove anything related to the following:

    Viewpoint

    Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

    ViewpointService.exe
    ViewMgr.exe


    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

    O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\ljjgeed.dll
    O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\qstjsyrs.dll
    O2 - BHO: (no name) - {6A9B166F-768E-4F7D-90A3-5A6D9F29D6EE} - C:\WINDOWS\system32\vtuts.dll

    O4 - Global Startup: LaunchU3.exe.lnk = ?
    O4 - HKLM\..\Run: [zzzHPSETUP] "E:\Setup.exe" \RESET
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130

    O20 - Winlogon Notify: ljjgeed - C:\WINDOWS\SYSTEM32\ljjgeed.dll
    O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll

    Close HJT.


    Navigate in Windows Explorer and delete the following files and folders in bold.

    C:\Program Files\Viewpoint
    C:\WINDOWS\system32\ljjgeed.dll
    C:\WINDOWS\system32\qstjsyrs.dll
    C:\WINDOWS\system32\vtuts.dll

    Reboot into normal mode and rehide your protected OS files.

    Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as well as C:\avenger.txt as attachments into this thread.


    Regards,
    Your friendly Momok =)

    This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

    Attached Files:

  5. OmniProbe

    OmniProbe TS Rookie Topic Starter

  6. momok

    momok TS Rookie Posts: 2,272

    Hi,

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Reboot into safe mode like earlier and unhide all your files and folders.

    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130

    Close HJT.

    Navigate in Windows Explorer and delete the following files and folders in bold.

    C:\WINDOWS\system32\stutv.bak2
    C:\WINDOWS\system32\stutv.bak1
    C:\WINDOWS\system32\OggDSuninst.exe

    Reboot into normal mode and rehide your protected OS files.

    Thereafter, please post a fresh HJT and ComboFix log from normal mode as attachments into this thread.


    Regards,
    Your friendly Momok =)

    This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  7. OmniProbe

    OmniProbe TS Rookie Topic Starter

    The dns server was mine, I think it is showing up because I am using a static IP address, so my dns server is manually inputted.


    here are my new logs as you requested: View attachment 17784 View attachment 17785
  8. momok

    momok TS Rookie Posts: 2,272

    Hi,

    Your system is still far from clean. In fact it seems to be reinfected with something new everytime. May I request that you run through the cleaning process in my signature, and post fresh ComboFix, AVG antispyware and HijackThis logs in your next reply. Also let me know the results of the Antirootkit scan.

    Please also uninstall anything related to WinAntiSpyware 2007 Free as it is a rogue program that actually does more harm to your system than any good.

    Meanwhile, I request that you do not use your system to surf the internet or download anything for any other reason other than coming back to check for updates here in order to prevent new infections.


    Regards,
    Your friendly Momok =)

    This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  9. OmniProbe

    OmniProbe TS Rookie Topic Starter

    I am sorry that it took a while but i finally found time to do all the steps found in the guide and here are my new logs:

    View attachment 18326 View attachment 18327

    my combo fix log was too big to upload as an attachment.

    THe root kit found nothing and the only symptoms I have is a little lag in page loading on the web and misdirection (ie: i click enter on myspace after inputing password it directs me back to home which is the home page but suppose to direct me to my home page profile)
  10. momok

    momok TS Rookie Posts: 2,272

    Hi,

    Your logs look clean now. However, considering your history of bad infection, I would request to see a ComboFix log before giving you an 'all clear'.

    Could you try running another combofix scan and attaching the new log here?


    Regards,
    Your friendly momok =)

    This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  11. OmniProbe

    OmniProbe TS Rookie Topic Starter

    HOw do i reduce the size of the combofix log, currently its at 140kb, which is pass the limit.
     
  12. momok

    momok TS Rookie Posts: 2,272

    Hi,

    Could you try opening Notepad and pasting half the log in a new .txt file? Then save the .txt as "ComboFix_firsthalf.txt" or something like that, and see what's the size of the file.

    Did you run another ComboFix scan? I'm wondering if a second scan would produce a smaller log, since the first log could be huge due to tonnes of deletions in the first scan.


    Regards,
    Your friendly momok =)

    This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.