TechSpot

My HJT Log...please help!

By Tycho Brahe
Mar 10, 2007
  1. Hi there and thanks in advance for any help that anyone can provide.

    My desktop computer went on the fritz about two months ago and the only Windows 98 CD I could find was the one that had come packaged with my laptop. To make a long story short, I did the stupidest thing I've ever done my computer, mainly looked online for a key generator and I'm currently suffering the consequences as my computer was heavily injected with viruses and trojan horses. Bill Gates had his revenge.

    In an attempt to repent I purchased a brand new copy of Windows XP, installed it successfully and legally, and vowed to never even consider looking for an illegal key again. My computer has been less than forgiving--I run Firefox 2.0 but occasionally Internet Explorer pop-up windows appear. Sometimes the pop-up ads take the form of "windows alerts" and I take care to avoid ever clicking anything other than close.

    I followed all of the instructions found elsewhere on this thread but in order to gain redemption from my past sins, I still think I might have a problem. Thus, I present to you my HJT log.

    Please diagnose any problems and I will follow your advice. If you feel the need to call me an *****, I accept that as well. This is the first time I have ever had a major infection on my computer in over fifteen years--I am usually extremely careful.

    Again, thank you.

    I should note that when I was checking the properties of my HJT file, it said that it opens with "NOTEDAD" instead of Notepad. I changed it, but I'm pretty sure that's a bad thing so I thought I'd mention that. I've also noticed "explarer.exe" running in task manager.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Your system is infected with several nasties.

    Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

    If after reading the above, you wish to clean your system, do the following.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

    Also, let me know the results of the AVG Antirootkit scan.

    Regards Howard :wave: :wave:

    This thread is for the use of Tycho Brahe only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Tycho Brahe

    Tycho Brahe TS Rookie Topic Starter

    Okay, better but not fixed yet

    I followed all the instructions and now I'm not getting any pop-up windows, but things still seem amiss. Occasionally as I am typing this my browser window is no longer my "active" window and I am unable to type without clicking back on this text, if that makes sense.

    Here are all the logs. Let me know if I did something wrong. Thank you!
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You didn`t attach an AVG Antispyware log as requested, nor did you let me know the results of the AVG Antirootkit scan. Please do so in your next reply.

    Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    IESet

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    chkntfs.exe
    ??chost.exe<Not to be confused with svchost.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R3 - URLSearchHook: (no name) - {5AAFF854-419E-681B-B9EE-41A67B2ACCC9} - (no file)

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

    O4 - HKLM\..\Run: [zlldhbd.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Charlie\Local Settings\Application Data\zlldhbd.dll",izvsrud

    O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt

    O4 - HKLM\..\RunServices: [IESet] IExplorer.dll .dbt

    O4 - HKCU\..\Run: [Auwu] "C:\DOCUME~1\Charlie\APPLIC~1\ASEMBL~1\chkntfs.exe" -vt yazb

    O4 - HKCU\..\Run: [Blfoo] C:\Program Files\Common Files\??crosoft.NET\??chost.exe

    O4 - HKCU\..\Run: [IESet] IExplorer.dll .dbt

    O20 - Winlogon Notify: winxry32 - winxry32.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Common Files\??crosoft.NET<Delete the entire folder.
    C:\DOCUME~1\Charlie\APPLIC~1\ASEMBL~1<Delete the entire folder.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    These are the filepaths you need to enter into killbox.

    C:\windows\system32\IExplorer.dll
    C:\Documents and Settings\Charlie\Local Settings\Application Data\zlldhbd.dll

    Once your system has rebooted, rehide your protected OS files.

    Post an AVG Antispyware log as well as a fresh HJT log and let me know the results of the AVG Antirootkit scan.

    Regards Howard :)

    This thread is for the use of Tycho Brahe only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. Tycho Brahe

    Tycho Brahe TS Rookie Topic Starter

    So far so good...

    As far as I can tell everything seems good since I followed your most recent instructions. Here's the most recent AVG and HJT logs. AVG Rootkit found nothing this time.

    Thank you very much! Am I safe now?
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is now clean.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

    Turn off the AVG Antispyware resident shield. See HERE for details.

    Delete the Killbox backups.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of Tycho Brahe only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...