IE slow, IE screen blanks out inbetween loading pages, popups, computer freezes, help
- Thread starter OmniProbe
- Start date
- Status
momok
Posts: 2,127 +6
Hi OmniProbe and welcome to techspot =)
Your system is infected with the vundo trojan and adware.
You may wish to copy and paste these instructions on notepad for easier reference later.
Download Vundofix from HERE.
Double click the Vundofix.exe to run it.
Right click in the vundofix window and click add files.
Enter the following file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button:
C:\WINDOWS\system32\ljjgeed.dll
C:\WINDOWS\system32\vtuts.dll
Click the remove vundo button and let Vundofix do its stuff.
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Boot into safe mode under your normal user name. See how HERE
Next turn on "Show all files and folders, including hidden and system". See how HERE
Go to start > run and type services.msc. Press the enter key.
Search for the following services(if there) double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.
zzzHPSETUP
Viewpoint Manager Service
Go to start > Control Panel > Add and Remove Programs.
Remove anything related to the following:
Viewpoint Service/Manager/Media Player etc
Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:
ViewpointService.exe
After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\ljjgeed.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\qstjsyrs.dll
O2 - BHO: (no name) - {6A9B166F-768E-4F7D-90A3-5A6D9F29D6EE} - C:\WINDOWS\system32\vtuts.dll
O4 - HKLM\..\Run: [zzzHPSETUP] "E:\Setup.exe" \RESET
O4 - Global Startup: LaunchU3.exe.lnk = ?
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130 < only fix this if the domain does not belong to your ISP
O20 - Winlogon Notify: ljjgeed - C:\WINDOWS\SYSTEM32\ljjgeed.dll
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Close HJT.
Navigate in Windows Explorer and delete the following files and folders in bold.
C:\WINDOWS\system32\ljjgeed.dll
C:\WINDOWS\system32\qstjsyrs.dll
C:\WINDOWS\system32\vtuts.dll
C:\Program Files\Viewpoint
Reboot into normal mode and rehide your protected OS files.
Thereafter, please post fresh HJT, ComboFix, AVG Antispyware logs and C:\vundofix.txt from normal mode as attachments into this thread.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Your system is infected with the vundo trojan and adware.
You may wish to copy and paste these instructions on notepad for easier reference later.
Download Vundofix from HERE.
Double click the Vundofix.exe to run it.
Right click in the vundofix window and click add files.
Enter the following file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button:
C:\WINDOWS\system32\ljjgeed.dll
C:\WINDOWS\system32\vtuts.dll
Click the remove vundo button and let Vundofix do its stuff.
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Boot into safe mode under your normal user name. See how HERE
Next turn on "Show all files and folders, including hidden and system". See how HERE
Go to start > run and type services.msc. Press the enter key.
Search for the following services(if there) double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.
zzzHPSETUP
Viewpoint Manager Service
Go to start > Control Panel > Add and Remove Programs.
Remove anything related to the following:
Viewpoint Service/Manager/Media Player etc
Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:
ViewpointService.exe
After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\ljjgeed.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\qstjsyrs.dll
O2 - BHO: (no name) - {6A9B166F-768E-4F7D-90A3-5A6D9F29D6EE} - C:\WINDOWS\system32\vtuts.dll
O4 - HKLM\..\Run: [zzzHPSETUP] "E:\Setup.exe" \RESET
O4 - Global Startup: LaunchU3.exe.lnk = ?
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130 < only fix this if the domain does not belong to your ISP
O20 - Winlogon Notify: ljjgeed - C:\WINDOWS\SYSTEM32\ljjgeed.dll
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Close HJT.
Navigate in Windows Explorer and delete the following files and folders in bold.
C:\WINDOWS\system32\ljjgeed.dll
C:\WINDOWS\system32\qstjsyrs.dll
C:\WINDOWS\system32\vtuts.dll
C:\Program Files\Viewpoint
Reboot into normal mode and rehide your protected OS files.
Thereafter, please post fresh HJT, ComboFix, AVG Antispyware logs and C:\vundofix.txt from normal mode as attachments into this thread.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
THank you Great instructions and great forums! Here is my new log:
View attachment 17490
I couldnt delete ljjgeed.dll in safe mode after I followed everystep but the other files were not present.
Thanks again
View attachment 17490
I couldnt delete ljjgeed.dll in safe mode after I followed everystep but the other files were not present.
Thanks again
momok
Posts: 2,127 +6
Hi,
I noticed you have not followed all my instructions to the letter.
Viewpoint is still not uninstalled and running on your computer. I also need the other requested logs.
Please follow these instructions carefully.
1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.
2. Download the attached avengerscript.txt (from my attachment) and save it to your desktop
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by double clicking on its icon on your desktop.
Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
You may wish to copy and paste these instructions on notepad for easier reference later.
Boot into safe mode under your normal user name. See how HERE
Next turn on "Show all files and folders, including hidden and system". See how HERE
Go to start > run and type services.msc. Press the enter key.
Search for the following services(if there) double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.
ViewpointService.exe
ViewMgr.exe
Go to start > Control Panel > Add and Remove Programs.
Remove anything related to the following:
Viewpoint
Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:
ViewpointService.exe
ViewMgr.exe
After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\ljjgeed.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\qstjsyrs.dll
O2 - BHO: (no name) - {6A9B166F-768E-4F7D-90A3-5A6D9F29D6EE} - C:\WINDOWS\system32\vtuts.dll
O4 - Global Startup: LaunchU3.exe.lnk = ?
O4 - HKLM\..\Run: [zzzHPSETUP] "E:\Setup.exe" \RESET
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130
O20 - Winlogon Notify: ljjgeed - C:\WINDOWS\SYSTEM32\ljjgeed.dll
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll
Close HJT.
Navigate in Windows Explorer and delete the following files and folders in bold.
C:\Program Files\Viewpoint
C:\WINDOWS\system32\ljjgeed.dll
C:\WINDOWS\system32\qstjsyrs.dll
C:\WINDOWS\system32\vtuts.dll
Reboot into normal mode and rehide your protected OS files.
Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as well as C:\avenger.txt as attachments into this thread.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
I noticed you have not followed all my instructions to the letter.
Viewpoint is still not uninstalled and running on your computer. I also need the other requested logs.
Please follow these instructions carefully.
1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.
2. Download the attached avengerscript.txt (from my attachment) and save it to your desktop
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by double clicking on its icon on your desktop.
Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
You may wish to copy and paste these instructions on notepad for easier reference later.
Boot into safe mode under your normal user name. See how HERE
Next turn on "Show all files and folders, including hidden and system". See how HERE
Go to start > run and type services.msc. Press the enter key.
Search for the following services(if there) double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.
ViewpointService.exe
ViewMgr.exe
Go to start > Control Panel > Add and Remove Programs.
Remove anything related to the following:
Viewpoint
Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:
ViewpointService.exe
ViewMgr.exe
After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\ljjgeed.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\qstjsyrs.dll
O2 - BHO: (no name) - {6A9B166F-768E-4F7D-90A3-5A6D9F29D6EE} - C:\WINDOWS\system32\vtuts.dll
O4 - Global Startup: LaunchU3.exe.lnk = ?
O4 - HKLM\..\Run: [zzzHPSETUP] "E:\Setup.exe" \RESET
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130
O20 - Winlogon Notify: ljjgeed - C:\WINDOWS\SYSTEM32\ljjgeed.dll
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll
Close HJT.
Navigate in Windows Explorer and delete the following files and folders in bold.
C:\Program Files\Viewpoint
C:\WINDOWS\system32\ljjgeed.dll
C:\WINDOWS\system32\qstjsyrs.dll
C:\WINDOWS\system32\vtuts.dll
Reboot into normal mode and rehide your protected OS files.
Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as well as C:\avenger.txt as attachments into this thread.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
I am certain i followed every step, here is my new logs:
View attachment 17545 View attachment 17546 View attachment 17547 View attachment 17548
View attachment 17545 View attachment 17546 View attachment 17547 View attachment 17548
momok
Posts: 2,127 +6
Hi,
You may wish to copy and paste these instructions on notepad for easier reference later.
Reboot into safe mode like earlier and unhide all your files and folders.
After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130
Close HJT.
Navigate in Windows Explorer and delete the following files and folders in bold.
C:\WINDOWS\system32\stutv.bak2
C:\WINDOWS\system32\stutv.bak1
C:\WINDOWS\system32\OggDSuninst.exe
Reboot into normal mode and rehide your protected OS files.
Thereafter, please post a fresh HJT and ComboFix log from normal mode as attachments into this thread.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
You may wish to copy and paste these instructions on notepad for easier reference later.
Reboot into safe mode like earlier and unhide all your files and folders.
After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA05979A-3B9A-4CB2-ABC7-A06983C550FF}: NameServer = 68.87.77.130,68.87.72.130
Close HJT.
Navigate in Windows Explorer and delete the following files and folders in bold.
C:\WINDOWS\system32\stutv.bak2
C:\WINDOWS\system32\stutv.bak1
C:\WINDOWS\system32\OggDSuninst.exe
Reboot into normal mode and rehide your protected OS files.
Thereafter, please post a fresh HJT and ComboFix log from normal mode as attachments into this thread.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
The dns server was mine, I think it is showing up because I am using a static IP address, so my dns server is manually inputted.
here are my new logs as you requested: View attachment 17784View attachment 17785
here are my new logs as you requested: View attachment 17784View attachment 17785
momok
Posts: 2,127 +6
Hi,
Your system is still far from clean. In fact it seems to be reinfected with something new everytime. May I request that you run through the cleaning process in my signature, and post fresh ComboFix, AVG antispyware and HijackThis logs in your next reply. Also let me know the results of the Antirootkit scan.
Please also uninstall anything related to WinAntiSpyware 2007 Free as it is a rogue program that actually does more harm to your system than any good.
Meanwhile, I request that you do not use your system to surf the internet or download anything for any other reason other than coming back to check for updates here in order to prevent new infections.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Your system is still far from clean. In fact it seems to be reinfected with something new everytime. May I request that you run through the cleaning process in my signature, and post fresh ComboFix, AVG antispyware and HijackThis logs in your next reply. Also let me know the results of the Antirootkit scan.
Please also uninstall anything related to WinAntiSpyware 2007 Free as it is a rogue program that actually does more harm to your system than any good.
Meanwhile, I request that you do not use your system to surf the internet or download anything for any other reason other than coming back to check for updates here in order to prevent new infections.
Regards,
Your friendly Momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
I am sorry that it took a while but i finally found time to do all the steps found in the guide and here are my new logs:
View attachment 18326View attachment 18327
my combo fix log was too big to upload as an attachment.
THe root kit found nothing and the only symptoms I have is a little lag in page loading on the web and misdirection (ie: i click enter on myspace after inputing password it directs me back to home which is the home page but suppose to direct me to my home page profile)
View attachment 18326View attachment 18327
my combo fix log was too big to upload as an attachment.
THe root kit found nothing and the only symptoms I have is a little lag in page loading on the web and misdirection (ie: i click enter on myspace after inputing password it directs me back to home which is the home page but suppose to direct me to my home page profile)
momok
Posts: 2,127 +6
Hi,
Your logs look clean now. However, considering your history of bad infection, I would request to see a ComboFix log before giving you an 'all clear'.
Could you try running another combofix scan and attaching the new log here?
Regards,
Your friendly momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Your logs look clean now. However, considering your history of bad infection, I would request to see a ComboFix log before giving you an 'all clear'.
Could you try running another combofix scan and attaching the new log here?
Regards,
Your friendly momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
momok
Posts: 2,127 +6
Hi,
Could you try opening Notepad and pasting half the log in a new .txt file? Then save the .txt as "ComboFix_firsthalf.txt" or something like that, and see what's the size of the file.
Did you run another ComboFix scan? I'm wondering if a second scan would produce a smaller log, since the first log could be huge due to tonnes of deletions in the first scan.
Regards,
Your friendly momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Could you try opening Notepad and pasting half the log in a new .txt file? Then save the .txt as "ComboFix_firsthalf.txt" or something like that, and see what's the size of the file.
Did you run another ComboFix scan? I'm wondering if a second scan would produce a smaller log, since the first log could be huge due to tonnes of deletions in the first scan.
Regards,
Your friendly momok =)
This thread is for the use of OmniProbe only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
- Status
