Log files for zlog virus causing pop-ups and fake spyware icons

By getdal
Jan 23, 2008
  1. Hi, I followed the instructions from another thread to get rid of a virus that was causing my PC to have popups including "Security Warning! Worm.win32.netsky detected on your machine ..." and "Windows has detected an internet attack attempt ...". The new icons that appeared on my desktop were "error cleaner", "spyware&malware protection" and "Privacy protector". Internet Explorer also launched itself several times.

    I have followed the 15 steps found in another thread which included downloading several programs such as AVG Antispyware, SS&D, Combofix, CCleaner, Combofix, SmitfraudFix, and ending with running Hijackthis.

    I was optimistic that I had successfully gotten rid of this virus, however, as I am typing this message, different but similar pop-ups came up and also launched internet explorer. One site that was launched was "". One popup is "Notice: your system is not optimized and your computer performance is not at the highest level." ... "would you like to install SystemErrorFixer to optimize your computer's performance now for free?"

    I am attaching the log files for hijackthis (I initially accidentally ran hijack this under the original name and then again using the changed name 'Crusty'). I am also attaching the AVG Antispyware log and the Combofix log . I don't remember the exact wording on the Panda Antirootkit scan results, however, it indicated that no negative ones were found.

    Also, my computer seems to be running slower after downloading, installing, and running all this software than it did before (don't know if the virus is just getting worse or if this is due to more programs running automatically in the background)

    I am frustrated that after going through this time consuming process, the problem doesn't seem to be resolved and am anxious for any further help you might be able to provide. Thank you very much.
  2. momok

    momok TS Rookie Posts: 2,265


    You have psted the wrong ComboFix file. You should post the ComboFix.txt log file instead.

    Meanwhile, fix these entries in HijackThis and also post a new log from HijackThis.

    O2 - BHO: SXG Advisor - {8D93C595-DA51-48D5-AB81-BD26953427A4} - C:\WINDOWS\dopfwrllwr.dll (file missing)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: The egodktf - {8D911181-10AA-4B3E-BC7F-8D4AD359921B} - C:\WINDOWS\egodktf.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O21 - SSODL: aslpmqk - {8696DF7F-0328-4366-944C-6C034AD12D8C} - C:\WINDOWS\aslpmqk.dll
    O21 - SSODL: bxsnvqt - {F9F187D1-D384-4E58-A70A-8000FFCC057F} - C:\WINDOWS\bxsnvqt.dll (file missing)

  3. getdal

    getdal TS Rookie Topic Starter

    Thank you --here are the combofix and new hijackthis logs

    Thank you for your prompt assistance--I don't know that it matters, but the Yahoo toolbar is something that recently was added (either through the virus or through the other recent software downloads---but I didn't add it intentionally).

    Anyway, I look forward to hearing from you.
  4. momok

    momok TS Rookie Posts: 2,265


    You may wish to copy and paste these instructions on notepad for easier reference later.

    1. Boot into safe mode under your normal user name. See how HERE
    2. Next turn on "Show all files and folders, including hidden and system". See how HERE

    3. After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O21 - SSODL: aslpmqk - {419ABA31-53D0-43B0-AA36-DBC4A381E167} - C:\WINDOWS\aslpmqk.dll
      Close HJT.

    4. Open notepad and copy/paste the text in the quote box below into it (all except the word QUOTE):

    5. Save this as CFScript on the desktop.
    6. Referring to the image below, drag CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe.
    7. ComboFix will begin to execute, just follow the prompts. After reboot (in case it asks to reboot), it shall produce a log for you. Post that log (Combofix.txt) in your next reply.
      Note: Do not mouseclick combofix's window while it is running. That may cause your system to hang

    8. Reboot into normal mode and rehide your protected OS files.
    Thereafter, please post fresh HJT and AVG Antispyware logs and the resultant ComboFix log from the above instructions as attachments into this thread.

    momok =)

    This thread is for the use of getdal only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. getdal

    getdal TS Rookie Topic Starter

    Thank you. Here are the requested log files:

    ...anxiously awaiting your reply. Thanx again.
  6. momok

    momok TS Rookie Posts: 2,265


    Please download and run CCleaner via step 9 of the instructions HERE.

    Your AVG log shows 'no action taken' for all items. Please run a scan again and change the default actions to "quarantine" for all. After performing the actions, save the report log and post it back here.

    Also, your hijackthis log is from safe mode. I requested one from normal mode, so please post that in your next reply.

    momok =)

    This thread is for the use of getdal only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and The Web forum.
  7. getdal

    getdal TS Rookie Topic Starter

    Here ya go...

    Ran CCleaner.

    Am including the AVG log even though it still says no action taken. I DO have default set to quarantine under scan and what action to take. Why is it not automatically quarantining? Is there some other setting I need to check? I tried to find one, but couldn't. Also am including my hijackthis log. Thank you again.
  8. momok

    momok TS Rookie Posts: 2,265


    No worries bout AVG. Those files are just a bunch of infected system restore points that we will fix in this final step.
    Your other logs look clean now.

    1. Please download and run CCleaner via step 9 of the instructions HERE.

    2. Delete all the contents of C:\QooBox and AVG Antispyware Quarantine folder. (located in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Quarantine)

    3. Turn off system restore (XP/ME only). Learn how to do that HERE.
      This will remove all the remaining nasties from your old restore points.

    4. After that turn system restore back on.
      This would have created a new safe and clean restore point for your system.

    5. Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
      May I recommend you to read this article.
      This can help to prevent future infections.

    Should you have any further problems, please post in this thread.

    momok =)

    This thread is for the use of getdal only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  9. techflame23

    techflame23 TS Rookie Posts: 58

    I had this too and i fixed it by running smitfraudfix
    i ran my computer in safe mode then i searched and cleaned and then restarted in normal mode. I then did somthing else which i cant remember what is called but is num 3 on the list (type 3 then hit enter)
    This fixed my whole computer of this virus
    I dont know if you have a new version of the virus or somthing that is resistant to smitfraudfix
    but it worked for me and maybe if you tryed it again it would work for you.
  10. momok

    momok TS Rookie Posts: 2,265

    Note: The user's logs are already clean, and he does not appear to be facing any problems so far.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...