rookie with virus problem

[rookie47]

Hi - new to this, rookie with a major problem, can't seem to get rid of these items,, hijack log attached ,,, please help!

Drowor D Trojan   c:\WINDOWS\SYSTEM\INTERNAT.EXE

EliteKeylogger      c:\WINDOWS\SYSTEM\MCIOLE.DLL

Virus.Win32.Delf.ak   c:\WINDOWS\RUNDLL32.EXE

Smitfraud      c:\WINDOWS\WUPDMGR.EXE

[getting disk space - attachment deleted by admin]

[rookie47]

I see there are no takers on this. Does this mean it does not have enough information?  or  Is this task too difficult to handle here? I've been watching all day and I'm probably doing further damage by not having this corrected immediately. ??

I am a ROOKIE at this stuff ,,, Windows ME ,,, I'll have a lot of questions I'm sure.

[evilfantasy]

Run this Online Scan.

Run the BitDefender Online Scanner.

Agree to the license and then select Scan. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. That will make your logs huge and we don't need to see clean files.

Once Bitdefender completes the scan:
Click-on the Detected Problems tab.
Then select Click here to export the scan report.

When the window comes up to save the report, change the Save as type: box to:
Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save.

This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later).
This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us.

Post the bdscan.txt file.
Thanks To Chaslang For The Bitdefender Guide!

[dairyman]

I'll take a look at the log file.

[dairyman]

Before I tell you what to clean in HijackThis, you need to install a firewall.

Comodo Firewall is NOT compatible with Windows ME, but you can install Jetico Personal Firewall instead. Click Here to go to the site.

[patio]

Why does he need to have a firewall installed before you look at his log ? ?
What are your HJT qualifications ? ?

[rookie47]

OK ,, thanks, I did the defender and here is the log ,,, I hope I did it correctly ,,,

I appreciate all the help ,,,

[getting disk space - attachment deleted by admin]

[dairyman]

Why does he need to have a firewall installed before you look at his log ? ?
What are your HJT qualifications ? ?

Sorry, I mean he should install a firewall.

I contacted CBMatt and he showed me a link to old post, which had another link to a web page that showed me how to read a log file.

[dairyman]

1 ) Print out the following instructions.
2 ) Download and install Spybot Search and Destroy.
3 ) Place a tick next to:

O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL (file missing)

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL (file missing)

4 ) Click on Fixed Checked.
5 ) Reboot into Safe Mode.
6 ) Run Spybot S&D and run a full scan.

[rookie47]

I do have a question, I ran the Xoftspy again and Keylogger and Smitfraud were present, however, when I deleted them, rebooted and scanned again with Xoftspy they were gone, Does this mean I zapped them? or, Are they still running in the background undetected?

In your opinion, How good are these programs?, I run these all the time,

XoftspySE
PConPoint
Ad-AwareSE
McAFEE
HistoryKill

The reason I ask is these programs pick up things some of the other programs don't and vice versa ,,

[evilfantasy]

I am not sure about XoftspySE as I don't use it. There are plenty of free alternative that work very well.
=====
You need to clear you Java Cache. See link below for instructions:
http://www.java.com/en/download/help/5000020300.xml
=====
CCleaner
If you do not have CCleaner please install it. Download CCleaner
* Once CCleaner is open use the default options.
* Click Analyze and it will show a log of what will be removed.
* Next click Run Cleaner to remove everything.
=====
Next please install Superantispyware (SAS)

SUPERAntispyware Free Edition

Install it and double-click the icon on your desktop to run it.
*  It will ask if you want to update the program definitions, click Yes.
*  Under Configuration and Preferences, click the Preferences button.
*  Click the Scanning Control tab.
*  Under Scanner Options make sure the following are checked:
+  Close browsers before scanning
+  Scan for tracking cookies
+  Terminate memory threats before quarantining.
+  Please leave the others unchecked.
+  Click the Close button to leave the control center screen.
*  On the main screen, under Scan for Harmful Software click Scan your computer.
*  On the left check C:\Fixed Drive.
*  On the right, under Complete Scan, choose Perform Complete Scan.
*  Click Next to start the scan. Please be patient while it scans your computer.
*  After the scan is complete a summary box will appear. Click OK.
*  Make sure everything in the white box has a check next to it, then click Next.
*  It will quarantine what it found and if it asks if you want to reboot, click Yes.
*  To retrieve the removal information for me please do the following:
+  After reboot, double-click the SUPERAntiSpyware icon on your desktop.
+  Click Preferences. Click the Statistics/Logs tab.
+  Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
+  It will open in your default text editor (such as Notepad/Wordpad).
+  Please save the notepad file to your desktop by clicking (in notepad) "File" "Save As".
*  Click close and close again to exit the program.
*  Please add the log as an attachment along with a new HijackThis log in the next post.

[rookie47]

OK, I have just done what you've instructed with Java and I ran the Cleaner, I have not deleted anything with the cleaner as of yet until I clear it with you, I am not going to loose anything important by "Cleaning" am I? I am putting a lot of trust in you here, Should I proceed? There are a lot of files going to be deleted there.

[evilfantasy]

If you have never ran CCleaner then there will be a lot of stuff there.

It will not remove anything important unless you specifically tell it to. And that is done by creating a Custom Folders option to clean.

If you look at the list it has produced you will see stuff like cookies, temp folders, Recently Typed URLs etc, etc. The reason I ask you to run it is because it will reduce the time when running the SUPER AntiSpyware scan. If you are uncomfortable using CCleaner then it is not completely necessary. I have used it for years with no problems.

Click Here for a list of what it removes.

[rookie47]

OK, I've done that, I'm onto the Antspy

[rookie47]

Scanning, Complete scan correct?

Scan completed ,,, it says no infected files found!

What do you think? However, XoftspySE still shows these after a scan:

Drowor D Trojan           c:\WINDOWS\SYSTEM\INTERNAT.EXE
Virus.Win32.Delf.ak      c:\WINDOWS\RUNDLL32.EXE

HJT Log attached

[getting disk space - attachment deleted by admin]

[evilfantasy]

Yep.

On the right, under Complete Scan, choose Perform Complete Scan.

[rookie47]

It said no infected files, question: when I checked those items in the scanning control, should evrything else be unchecked?

Look at my last post before this one,,, I added stuff there and the HJT Log

[evilfantasy]

Yes, the items that are unchecked are only useful with the paid version of SAS.

What do you think? However, XoftspySE still shows these after a scan:

Drowor D Trojan           c:\WINDOWS\SYSTEM\INTERNAT.EXE
Virus.Win32.Delf.ak      c:\WINDOWS\RUNDLL32.EXE

I don't fully trust XoftspySE.

Read the reviews on This Page to see why.

Looking at the HJT log.........

[evilfantasy]

You need to go and change the HijackThis log to a text (.txt) file and attach it again so I can open it.

[rookie47]

HJT Log

The scan came up with "No infected files" ,,, after over 1 hr of scanning I might add ,,, talk about a long process,,,

I just ran Xoftspy again,,, the same two warnings come up ,,, when I remove this one:

Virus.Win32.Delf.ak   c:\WINDOWS\RUNDLL32.EXE

and then I go to - Start - Control panel - Internet options -

I get this error message: Windows cannot find C\WINDOWS\rundll32.exe

[getting disk space - attachment deleted by admin]

[CBMatt]

I contacted CBMatt and he showed me a link to old post, which had another link to a web page that showed me how to read a log file.

Whoa, whoa, whoa...I think you may have misunderstood me.  In my PM to you, I stated:

If you're truly interested in getting involved with the program, you'll want to try out one of the schools mentioned by oddjob.

It takes a lot more than reading a few tutorials to be able to fully understand logs.  There are many special cases and treatment methods that aren't covered in these tutorials.  Your desire to help is appreciated, but until you can truly comprehend everything in the logs, you won't be able to properly help.  This is why I advise taking a course if you really want to help out.

[evilfantasy]

I don't know what else I can say about XysoftXE except UNINSTALL IT and DO NOT trust it's findings!!!

I linked you to the site advisor report which includes

If you download XsoftSpy trial and take a scan, the app will find "spyware" on your computer. But you have to buy the software to get rid of it. And if you then buy the software, you suddently doesn't have any spyware on your computer. So it trick you to buy the program.

Paretologic's products has aslo been listen as rogue spyware programs at spyware warriors. It's de-listed now though. But so people know.

You are also getting advice from at least one other help forum that I know of. This is risky, not only to your computer but to MY ability to spot the problems.
You are running fixes that I am unaware of. It could easily be seen as something I advise has done damage when it wouldn't be the case. So therefore I am stepping away from this thread.

Good luck.

Safe surfing.

[rookie47]

That's crazy, I was on CNET Forums and only showed them the HJT Log and  did a SuperAtispy Scan, that was all. Look at the posts over there, I opted out of that one a while ago. I was making progress with your ideas and felt comfortable with your help. I have done nothing to my computer other than what you have instructed me to do. I'm sorry if you feel you have been wronged but it's not like that at all. If you don't want to continue to help me because I was trying to correct a problem and you have a false sense of trustworthyness, then that's just lame.

[evilfantasy]

I don't feel wronged, I am just being safe.

Trustworthiness goes both ways.

I have warned twice against trusting the XysoftSE findings.

BitDefender only showed infections in the java cache which you removed. I have complete faith in the BitDefender scanner.

SUPERAntiSpyware showed no threats. I have faith in SAS as well.

XysoftSE on the other hand.......I do not trust at all.

Remove XysoftSE, run CCleaner, reboot, scan with Spybot, SUPERAntiSpyware and your antivirus and see what (if anything) is found.

[rookie47]

OK, thanks ,, glad to have your input back.

I just ran Spybot and it says I have 5979 infected files ,,,

Is this possible?

Do I have to Purchase Spybot to remove these?

Should i buy it, I have the form ready to go ,,, Do you recommend it?

[Broni]

Spybot is free. Where did you go to get it?
Here? http://www.safer-networking.org/en/index.html

[evilfantasy]

As Broni stated, where did you get it from?

Is it Spybot Search & Destroy (spybot s&d)? Or is it another name?

Spybot is and always has been free. Use Bronis link for a safe download of the program.

[Aussie]

Aussie (new member) here.
I have identical symptoms as Rookie47.  I run WinMe with AVG Antivirus, Spybot S&D, AdAware & XoftspySE.  Xoftspy was the only program to pick up a block of four problems which I 'removed' to quarantine. Upon reboot,  Drowor D Trojan comes back.
Decided to close restore function as often this carries and reinstates deleted problem, only to find cannot run C:/windows/rundll32.exe to open from control panel to deactivate restore function.
Both Rookie47 and myself have 'picked up' same problem.  I wonder did quarantine remove the rundll32.exe function? Should I reinstate the 'deleted quarantined' items and try different approach? Where are you now with your problem Rookie47?


 

[Broni]

Welcome aboard, Aussie
You need to post a new topic about your problem.

[rookie47]

Right at this moment I am having problems. I can't access anything from the control panel without getting the error message. I also checked for updates on the Spybot (which will not open everytime) and now I'm having more problems, It's telling me it detected an important registry key that's been changed, asks if I want to allow the change or deny it? I have no clue what to do. I closed all my programs and rebooted, brought up Internet Explorer, clicked on my favorite files and got this message. Now what's going on? I'm a novice at this stuff, I use this computer for my work and if I lose it I'm in deep trouble. The only thing I can think to do is shout a big - HELP!

" Should I reinstate the 'deleted quarantined' items and try different approach?"

I no longer have this option, last night I completely removed Xoftspy from my computer

[evilfantasy]

Post a new HijackThis log please.

[Broni]

Look...
We have to start with some basics...
You have to answer questions asked, and you have to strictly follow instructions given to you.
So let's start fresh.
Did you install Comodo firewall, as asked by dairyman?
Did you uninstall XysoftSE, as asked by evilfantasy?
Did you install Spybot from a link given by myself, not from wherever you wanted?

Now, I'm gonna take a look at your HJT log, and I'm gonna post my findings.
In your next post, you'll answer the above three questions, and follow instructions from my HJT log findings.
If you'll do so, we'll work together to resolve your computer problem, if you won't, I'm out of this thread.

[Broni]

1. Print this post out, since you won't have an access to it, at some point.

2. Download, and install Spybot (if you don't have it) from here: http://www.safer-networking.org/en/download/index.html

3. Close all windows, except for HJT.

4. Put a checkmark next to following HJT entries:

- O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL (file missing)

- O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL (file missing)

- O4 - HKCU\..\Run: [bprsRWe7T] QTWWSOCK.EXE

- O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

- O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

- O16 - DPF: {A0EAC162-A012-4AD8-B2E1-D5A0BBBCDA51} (PopupSh Control) - http://206.222.17.186/images/PopupSh.ocx

5. Click on "Fix It" button.

6. Restart your computer in Safe Mode (F8)

7. Run Spybot (click on updates, first), and fix whatever it asks you to fix.

8. Open Windows Explorer. Go Tools>Folder Options, put a checkmark next to "Show hidden files, and folders".

9. Delete following files (if they still exist):

Nothing to delete

10. Turn off System Restore.

11. Restart in Normal Mode.

12. Turn System Restore on.

13. Run HJT again, and post back its log back here.

[rookie47]

OK, I'm going to do these last things as asked, the only thing I haven't done is the firewall, I'll do that, I know I must seem to be a pain in the *censored* and I apologize for that, I'm not good with the computer things at all, that's why I'm here,  so when I am doing something you guys ask I'm always wondering if I'm doing it correctly, no need to bail, trust me, I'm doing the best I can.

Here's another stupid question from me, I'm running Windows ME, these are the requirements for the firewall, Is it compatible with ME?

Windows 2000 (32 bit ALL)
Windows XP (32 bit ALL)
Windows 2003 (32 bit ALL)
64 MB available RAM
32 MB of available free hard disk space

[Broni]

Is it compatible with ME?

Good question...let me do some search...

[Broni]

As far, as I can see, the only free firewall compatible with ME, would be older version of Jetico firewall:
http://www.jetico.com/download.htm
(second to last)

[WillyW]

...
Here's another stupid question from me, I'm running Windows ME, these are the requirements for the firewall, Is it compatible with ME?

For what it is worth:

I use Win98SE.
Quick check through some files, and I have the original ZoneAlarm install program,  filename = zlsSetup_61_744_000_en.exe
It is about 10 meg.    I guess I could use an online host, ... upload it, and you could d/l it.....  if that would help you.
I checked the url that I kept with it.... where I got it...
http://pcworld.com/downloads/file/fid,7228-order,1-page,1-c,firewalls/description.html
and it looks to me like they've updated it, and the version there is no longer Win98 compatible.
( I'm assuming that if it works with Win98, that you can use it with WinME )

Next idea:
I also have the original install file for Sygate firewall.
filename =  sygate562808.exe
Again,  I could upload it somewhere, if that would help you.
I tried it too, with Win98.
Upon checking the url from where I got it,  this might not be necessary! 
http://www.pcworld.com/downloads/file/fid,8132-order,1-page,1-c,firewalls/description.html
And it looks to me like it is still available for download.
It specifically lists WinME as an os.   

Another link to check out:
http://www.oldversion.com/program.php?n=sygate
You'll see what it is as soon as you get there. 

Same for:
http://www.oldversion.com/program.php?n=zalarm

Then:
http://www.oldversion.com
and scroll down to     Security     .    Others are listed there.


As far as which software is best, which version to use, etc. , from anything I've mentioned above  -- get with Broni first.    The best I could tell you to try would be the two I've already mentioned that I've tried.   They worked.
Perhaps Broni knows more about which is best though.

I hope something here is useful to you. 

[Broni]

Nice finds, Willy...
That Jetico firewall is also outdated (they have newer version, but it doesn't support ME), but it's better, then nothing.

[evilfantasy]

All good suggestions.

The only problem with older versions is, well they are old and not updated with the current protections.

A firewall that will work with ME and is current is Outpost http://filehippo.com/download_outpost_firewall/

It is good and easy to figure out.

[Broni]

Surely, it looks like the best choice...

[rookie47]

Well, before I saw the last post by Evil I went and downloaded the Jetico, only to be told it's non compatible, now there is no uninstall folder to uninstall it, seems this is a common problem from some of the threads I saw when doing a search to uninstall it.

So, it looks like I've run into my own personal firewall myself, as usual

[Broni]

Nothing under Add/Remove in Control Panel?

[evilfantasy]

If you got the incompatible warning then it did not install properly, i.e. no uninstaller will be there.

Look in C:\program files\jetico Open the folder and look for an uninstaller.

If there run it, if not then delete the entire folder.

Then delete the installer from the desktop (or wherever you had it) and it should be gone.

You can run CCleaner afterwards to be sure it is gone.

[rookie47]

Can't open the control panel, keep getting this when I try ,,,

I get this error message: Windows cannot find C\WINDOWS\rundll32.exe


Jetico Uninstaller - Not to be found, searched the net and have seen posts about this problem yet no solutions.

Any advice, other than telling me to put the computer back on the desk ,,, I'm about to throw it out the window!

I do have a question, What is the typical cost to upgrade to say XP or better? What is better I should ask,, AND, can you guys make sure I install it correctly? I could use the upgrade anyway, I use it for business and can't open certain files like xls for example ,,,, You know with all these fixes and everything I've kind of lost track of how many I've done, Have I done 5 fixes or 6? So I guess the question I have to ask is, Do I feel lucky enough to install a new OS with your help, Well do I ,,,,?

[Broni]

First of all, you have to see, if your computer is ready for Windows XP:
System Requirements for Windows XP Service Pack 2:
http://www.microsoft.com/windowsxp/sp2/sysreqs.mspx
(you better have those numbers double, or better yet, triple)

You are gonna need full version of XP. At Amazon, you can get it for $123:
http://www.amazon.com/Microsoft-Windows-Home-FULL-VERSION/dp/B00022PTRU

[rookie47]

First I need to take care of this problem:
Windows cannot find C\WINDOWS\rundll32.exe

Seems I can't open anything without this message.

Any thoughts on this?

[evilfantasy]

Do you have your ME install disk?

[rookie47]

Yes ,,,

[evilfantasy]

This is a copy/pasted guide and not mine so please read carefully and ask any questions if you are unclear on what to do.

Make sure your Windows CD-ROM's in the drive.
Go to Start/run, and type SFC.
Choose 'Extract One File From Installation Disk'.
Type rundll32.exe, not worrying about its location. Then, click Start.
Next to 'Restore From', type in or browse for the file’s location, which is probably in the WinME folder of your installation CD-ROM (typically D:\WinME), or in your Windows\Options\Cabs folder, as the case may be.
Then, next to 'Save File In', enter, or browse to C:\Windows, and click OK. System File Checker looks for the file, saves it as you requested, and then tells you that 'the file has been successfully extracted'.
That should put things right.

[rookie47]

Just want to say thanks for all the help. I did a system restore and removed all the anti-virus stuff I had running. I ran the SuperAntiSpyware and everything is gone and the computer appears to be running quite normal.

I'm not getting the error message any longer regarding this file either:

rundll32.exe

Any thoughts?

[evilfantasy]

Sounds like you took the system beck to a point before the error occurred.

Run an online scan to be sure all is well. http://housecall.trendmicro.com/

[rookie47]

This is a pretty long scan ,, I'll let you know how I make out. Thanks