Plagued by Win32.Myzor.FK@yf

[Tirdan]

My son managed to infect our desktop with this trojan-downloader and all that came with it. I have been battling it for two days without success. I followed the steps offered in a thread I saw and this is the result so far:
Scanned with e-trust - found no viruses
Scanned with bitdefender - found 2
Ran TrojanRemover and removed 2 trojan-downloader files and tracking cookies
Ran SpySweeper and found 140 traces and removed
Ran the Look2Me-Destroyer and removed
Ran the VundoFix and found nothing
Went to the how to remove Trojans, Begin2 and Coolwebsearch and found nothing when I ran AboutBuster, CWShredder, SmartKiller, AdAware and Spybot.
Followed RealBlackStuff's instructions about removing items in Safe Mode and ran Hijackthis log. Deleted items found on list and rebooted. Installed Firefox. System seemed to be okay and then "System Alert" popups returned telling me system was infected with spyware managing popups and several popups actually appeared.

Needless to say I am getting quite frustrated. Attached is my Hijackthis.txt file.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programme in your control panel and uninstall anything to do with(if there).

The Weather Channel FW\Desktop Weather

Close control panel.


Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

atmclk.exe
dcomcfg.exe
DesktopWeather.exe

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hpE773.tmp

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files(if there).

C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"

C:\WINDOWS\system32\hpE773.tmp

C:\WINDOWS\system32\atmclk.exe

C:\WINDOWS\system32\dcomcfg.exe

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log.

Regards Howard

 

[Tirdan]

Phase Two

Thanks for the welcome and the help. I followed your steps and am attaching the new HJT log. How will I be able to tell if I've cleaned every bit of this mess up? My computer seems to be running okay right now...but as you can imagine, I'm a little jittery.

Tir

 

[howard_hopkinso]

Have HJT fix the following entries.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

Post a fresh HJT log please.

Regards Howard

 

[Tirdan]

Phase Three

Okay had HJT fix the seven you had listed and attaching the newest log.

Tir

 

[howard_hopkinso]

You still have these two entries in your HJT log.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

Go and download these three programmes. Update them to the latest deffinitions and then run them in safe mode, with system restore turned off.

http://www.intermute.com/products/cwshredder.html

http://www.majorgeeks.com/download4113.html

http://www.spychecker.com/program/aboutbuster.html

Run AboutBuster first.

Next run CWShredder.

Then run CoolWWWSearch.SmartKiller.

Run HJT and have HJT fix all R0 and R1 entries.

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log.

Regards Howard

 

[Tirdan]

And Yet Again

okay, I ran About Buster, CWShredder and the CoolWWWSearch.SmartKiller and they found nothing on my system. I ran the HJT and checked all the R0 and R1 entries, rebooted and when I ran the new log, these were still there:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

newest HJT log is attached

Tir

 

[howard_hopkinso]

You have a new variant of smitFraud.

I want you to click on this link. http://www.atribune.org/ccount/click.php?id=10

It will download a file called SysProtect Remover.exe'

Simply Download and run SysProtect Remover.exe. Once it is running click the "Remove Now" button and follow the on screen instructions.

Once done, please post a fresh HJT log.

I can`t guarantee this will work. If it doesn`t we`ll have to try something else.

Regards Howard

 

[Tirdan]

Again

Downloaded and ran this and these two lines are still there. New log attached.

Tir

 

[howard_hopkinso]

Ok. I`ve just had someone fix this problem.

Go HERE and follow the instructions in step 3 please. I have only just updated these instructions.

Post a fresh HJT after doing that.

Regards Howard

 

[Tirdan]

Final I hope...

Okay, I followed the fix instructions and here is the latest HJT log. Am I clean? If so, you have my heartiest thanks! This has been an interesting learning experience. If not...what's my next step?

 

[Spike]

You are completely clean Congrats to you, and maybe a thankyou to Howard would be nice

 

[Tirdan]

Thanks to all of you

Thanks, Spike, that's good to know. I was determined to try to work through this without having to wipe my hard drive. Howard made all that possible with precise and clear instructions and very timely responses to my posts. I am most favorably impressed with all of you here at TechSpot and will highly recommend this site to others who run into virus/trojan trouble. Thank you again.

Tir

 

[howard_hopkinso]

I`ve just received your pm.

Thanks for your kind words.

Glad we could help.

Because the infection you had was a new variant, I had to do some research to find a fix that worked, hence the various instruction changes. It appears that Step 3 in my instructions finally did the trick.

I thank you for your feedback, as this will help many more members who are unfortunate enough to find themselves with the same infection.

Regards Howard

 

[jejoue]

Hi Howard,
I am having the same problem
I followed the link you provided but I can't find the thread and an error message is displayed:
"No Thread specified. If you followed a valid link, please notify the administrator"
Can you please provide the steps?
Thanks a lot