TechSpot

Need help looking at a HijackThis log

By basementbrewing
Jun 12, 2008
  1. I recently got a bad infection of CWS. CWS Shredder could find it and remove it but in less than 2 minutes all the malware would reload itself. Unfortunately I let my Norton subscription run out. I renewed it and ran it and it removed most of the CWS that was showing up in the shredder. Most of the problems I am having now are:

    - Internet Explorer will load most pages (but not others like yahoo.com or won't completely load some others)
    - IE itself is fairly slow in actually loading. Most of the time Google times out.
    - Task Manager won't load ( I get "disabled by admin" but I am the admin and only have one log in)
    - Windows search can't find taskmgr.exe just some files associated with it.
    -CWShredder is still finding cws.smartsearch, cws.msconfd, cws.smartfinder

    I have turned Norton off to make sure it is not being too protective and preventing the websites from running. I have deleted all history/temp/cache files. None of this has helped any.

    I downloaded and ran hijack this and have attached my log. Any help would be greatly appreciated! Me and my fiancee are planning a wedding for September and the computer on the fritz has been a big hinderance!
     
  2. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Malwarebytes' Anti-Malware

    Please download Malwarebytes' Anti-Malware to your desktop.
    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • close MBAM for now

    -------------------------------------------------------------------------------

    Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [BM309abbce] Rundll32.exe "C:\WINDOWS\system32\alyrgcmp.dll",s
    O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\jkwnw64r.exe
    O20 - Winlogon Notify: opnlLCTM - opnlLCTM.dll (file missing)

    Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. Reboot into safe mode.

    Print or copy and paste from here down into notepad and save it to your desktop to have in safe mode

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.


    Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these files (if present):

    C:\WINDOWS\system32\alyrgcmp.dll
    C:\WINDOWS\system32\jkwnw64r.exe
    C:\WINDOWS\system32\opnlLCTM.dll


    --------------------------------------------------------------------------

    Scan with MBAM
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please attach this log with your reply
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

    ----------------------------------------------------------------

    Restart normally

    Scan a new Hijackthis scan

    Attach here MBAM log and new Hijackthis log
     
  3. basementbrewing

    basementbrewing TS Rookie Topic Starter

    Did everything you stated except I used SUPERAntiSpyware program instead of MBAM. It worked well (only found one item, a trojan file) I found the alyrgcmp.dll in the system folder and deleted it, now on reboot I am given a dll error "can't find"
    Internet Explorer is working much better now. Haven't found a webpage it can't open and the whole computer seems a bit quicker. I also used a post on this site and was able to fix my problem with task manager and got it working


    Here is the log for the Superantiaspyware ( I couldn't get the log to attach?)

    SUPERAntiSpyware Scan Log


    Generated 06/12/2008 at 09:54 PM

    Application Version : 4.15.1000

    Core Rules Database Version : 3480
    Trace Rules Database Version: 1471

    Scan type : Complete Scan
    Total Scan Time : 00:47:44

    Memory items scanned : 491
    Memory threats detected : 0
    Registry items scanned : 6043
    Registry threats detected : 0
    File items scanned : 28083
    File threats detected : 1

    Trojan.Unclassified/Loader-Suspicious
    C:\WINDOWS\LOADER.EXE

    The Hijackthis log is attached. Thanks so much!
     
  4. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    I still need you to download and run a full system scan with MBAM. We can remove it after we are done. Make sure to let it remove everything that it finds.

    Malwarebytes' Anti-Malware

    • Please download Malwarebytes' Anti-Malware to your desktop.
    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please attach this log with your reply
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

    ----------------------

    Also, **P2P programs = Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur.
    Once upon a time, P2P file sharing was fairly safe. That is no longer true. You may continue to use P2P sharing at your own risk; however, please keep in mind that this practice may be the source of your current malware infestation. see http://spywarewarrior.com/viewtopic.php?t=26216
     
  5. basementbrewing

    basementbrewing TS Rookie Topic Starter

    Here's the MBAM Scan. I know about using Limewire and stuff. My problem this time was I used it to download a program and not just music plus I let my anitvirus expire. Thanks so much for the help!
     
  6. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    That got what I was looking at.

    Let's run an online scan, then show me a fresh Hijackthis log. Then we should be able to clean up.

    Download and Run ATF Cleaner
    Download ATF Cleaner by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it.

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    Firefox or Opera:
    Click Firefox or Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.

    -------------------------------------------------------------------------------

    Run Kaspersky Online AV Scanner

    Order to use it you have to use Internet Explorer.
    Go to Kaspersky and click the Accept button at the end of the page.

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
    • Read the Requirements and limitations before you click Accept.
    • Allow the ActiveX download if necessary.
    • Once the database has downloaded, click Next.
    • Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK.
    • Click on "My Computer"
    • When the scan has completed, click Save Report As...
    • Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    • Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
    Attach the report into your next reply
     
  7. basementbrewing

    basementbrewing TS Rookie Topic Starter

    Sorry it took me so long to reply. Been out of town. Ran the ATF cleaner everything seemed to work ok. Let Kapersky run all night last night and here is what it found
     
  8. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Empty your recycle bin.

    OTMoveit2 by OldTimer
    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      [b]C:\Documents and Settings\Compaq_Owner\Desktop\MusicStuff\New Folder\dont let me down karaoke.mp3
      C:\Documents and Settings\Compaq_Owner\My Documents\My Music\dont let me down karaoke.mp3
      C:\Program Files\Common Files\Wise Installation Wizard\WIS25B052BB7126441299D93D9448235FE4_6_8_0_4.MSI
      C:\WINDOWS\Installer\20ad8f6.msi
      C:\WINDOWS\system32\g11.exe
      C:\WINDOWS\system32\vgnxxatl.dll
      C:\WINDOWS\system32\xejpxfts.dll
      E:\I386\Apps\APP21442\src\HPSummer2005.exe[/b]
    • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
    • Close OTMoveIt2
    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
     
  9. basementbrewing

    basementbrewing TS Rookie Topic Starter

    Completed the OT move it task. Log is attached. Computer seems to be working great except for one problem with my printer. Every 2 minutes exactly two files (unnamed) are sent to the printer document window. The files are 49k and 64k every time. This morning I woke up and there was 144 unprinted files (same files) I cancel them and they come right back. Now my printer won't work at all and won't pick up the memory card slots on the front. I wasn't having this problem during the virus ordeal and it has just showed up in the last day or two. Thanks
     
  10. basementbrewing

    basementbrewing TS Rookie Topic Starter

    Forgot to add OT move it log
     
  11. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    That's really weird about the printer, we didn't do anything that should have effected that. What are the files and the paths of the files that it is printing?

    OTMoveit did what it was supposed to and we are ready to secure the work we have done.

    Uninstall Combofix
    * Click START then RUN
    * Now type Combofix /u in the runbox
    * Make sure there's a space between Combofix and /u
    * Then hit Enter.

    * The above procedure will:
    * Delete the following:
    * ComboFix and its associated files and folders.
    * Reset the clock settings.
    * Hide file extensions, if required.
    * Hide System/Hidden files, if required.
    * Set a new, clean Restore Point.

    -----------------------------------------------------------------------

    OTCleanit! by Oldtimer

    • Launch OTMoveit! and click the GREEN Cleanup! button

      ---------------------------------------------------------------------------

      Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
      1. Set correct settings for files
        • Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
        • Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
        • If unchecked please check Hide protected operating system files (Recommended)
        • If necessary check "Display content of system folders"
        • If necessary Uncheck Hide file extensions for known file types.
        • Click OK

        clear system restore points

        • This is a good time to clear your existing system restore points and establish a new clean restore point:
          • Go to Start > All Programs > Accessories > System Tools > System Restore
          • Select Create a restore point, and Ok it.
          • Next, go to Start > Run and type in cleanmgr
          • Select the More options tab
          • Choose the option to clean up system restore and OK it.
          This will remove all restore points except the new one you just created.

      2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
        1. From within Internet Explorer click on the Tools menu and then click on Options.
        2. Click once on the Security tab
        3. Click once on the Internet icon so it becomes highlighted.
        4. Click once on the Custom Level button.
          • Change the Download signed ActiveX controls to Prompt
          • Change the Download unsigned ActiveX controls to Disable
          • Change the Initialize and script ActiveX controls not marked as safe to Disable
          • Change the Installation of desktop items to Prompt
          • Change the Launching programs and files in an IFRAME to Prompt
          • Change the Navigate sub-frames across different domains to Prompt
          • When all these settings have been made, click on the OK button.
          • If it prompts you as to whether or not you want to save the settings, press the Yes button.
        5. Next press the Apply button and then the OK to exit the Internet Properties page.
      3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

        See this link for a listing of some online & their stand-alone antivirus programs:

        Virus, Spyware, and Malware Protection and Removal Resources

      4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

      5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

        For a tutorial on Firewalls and a listing of some available ones see the link below:

        Understanding and Using Firewalls

      6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.This is done in Vista through control panel -> windows updates.

      7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

        A tutorial on installing & using this product can be found here:

        Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

      8. Or Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

        A tutorial on installing & using this product can be found here:

        Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

      9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

        A tutorial on installing & using this product can be found here:

        Using SpywareBlaster to protect your computer from Spyware and Malware

      10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
      Follow this list and your potential for being infected again will reduce dramatically.

      here are some additional utilities that will enhance your safety
      • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
      • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
      • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
      • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
        Using Winpatrol to protect your computer from malicious software
     
  12. basementbrewing

    basementbrewing TS Rookie Topic Starter

    Thanks so much for all the help. The printer has cleared up after a few days maybe thanks to some of the more recent spyware scanning. I really appreciate what you guys are doing here and hope you continue to help other people.
     
  13. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Thanks for the support that is why we do what we do.

    If you have any more issues please let me know

    Regards,

    BD
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...