Spyware Infection - out of ideas

[Freshy]

After running a crack off a cd I was given my laptop has become infected with some sort of spyware, its a little redshield with a white cross (similar to the windows security alerts one) in the bottom right of the screen that says "Spyware infection has detected !" (the same as Hijack077's post).

So far I was followed your preliminary removal instructions, however it has'nt removed it, the Rootkit finder finds nothing either.

I have attached the reports from the various spyware scanners listed in your tutorial. I have a HP recovery parition - is this an option?

A small note - the laptop I am on is a tablet pc so there are alot of different things I woulding find on a normal pc listed. Any help would be greatly appreciated, thank you.


*at the moment the attach button doesnt do anything it says "error on page" at the bottom of IE - I will keep trying

sorry for the double post - I cant attach files on a edit.

anywho, attached are the logs.

Thanks again.

 

[howard_hopkinso]

Hello and welcome to Techspot.

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

Regards Howard :wave: :wave:

This thread is for the use of Freshy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Freshy]

Howard, you are an amazing man.

I followed your instructions and the logs are attached. The little shield thing and popup has gone now - does this mean I'm clean?

 

[howard_hopkinso]

Download Vundofix from HERE.

Double click the Vundofix.exe to run it.

Right click in the vundofix window and click add files.

Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

This is the filepath you need to enter into Vundofix.

C:\WINDOWS\system32\vlljqgdk.dll

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

cykndb.exe
tcpipmon.exe
accwiz.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [ShareSearcher] C:\cykndb.exe

O4 - HKLM\..\Run: [tcpipmon] tcpipmon.exe

O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\vlljqgdk.dll",setvm

O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'Default user')

O4 - Startup: Sticky Notes.lnk = C:\WINDOWS\system32\accwiz.exe

O20 - Winlogon Notify: awtqn - C:\WINDOWS\system32\awtqn.dll (file missing)

O20 - Winlogon Notify: ddcaayw - ddcaayw.dll (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\cykndb.exe

tcpipmon.exe<Search your system for this file and delete all instances found.

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log.

Regards Howard

This thread is for the use of Freshy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[momok]

Hi Howard,

Would you mind explaining to me the use of The Avenger program and Vundofix?

 

[howard_hopkinso]

momok: IM me on yahoo messenger(ID in my public profile) and I`ll send you the details of both programmes, plus some other stuff.

Regards Howard

This thread is for the use of Freshy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Freshy]

Hi,

I have followed the steps in your last post.

There was one slight porblem this was not present in hijack this:

O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')

so I couldnt tick it to fix it.

Attached: new hijack log. Also I'd like to thank you for your time spent so far on this matter, It is greatly appreciated.

 

[howard_hopkinso]

You`ve posted your HJT log from safe mode, when it needs to be posted from normal mode.

Post a fresh HJT log.

Regards Howard

This thread is for the use of Freshy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Freshy]

Sorry my bad, log attached.

also a few problems to report, some of my tablet funcionality is missing, the box that opens up the handwriting window on text boexes doesnt popup anymore, also the stickynotes program that i use to write notes with the tablet is no present, and for some reason when the dead exe is clicked it loads up accessibility wizard. any ideas?

 

[howard_hopkinso]

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\njyhkyve.dll (file missing)

O2 - BHO: (no name) - {88C7B305-74EE-4AA4-9357-F09C60CB47A7} - C:\WINDOWS\system32\awtqn.dll (file missing)

O2 - BHO: (no name) - {A416D604-EAA3-4618-958C-2ECA22414616} - C:\WINDOWS\system32\ddcaayw.dll (file missing)

O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe

O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')

Click on the fix checked button.

Close HJT and reboot your system.

Post a fresh HJT log if you`re still having problems, otherwise you look good to go.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of Freshy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Freshy]

Howard,

everything seems to be working brilliantly - the tablet functionality is working fine after the restart and the pc seems clean and fast.

Thanks for all the help today I really appreciate it, this is a brilliant forum and you've been a brilliant help. Thanks Again.