system
April 29, 2009, 12:04pm
1
I really need help. I have the Win32: Trojan(gen) and can’t get rid of it. I ran Avast and moved everything to the chest but I still have pop-ups and my computer is running really slow. I ran a log on HijackThis which is below. Can someone please let me know what I need to get rid of? Please make it as simple as possible, I don’t understand a lot of computer terminology. Thanks!
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway http://www.dell4me.com/myway http://www.netscape.com http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
End of file - 9100 bytes
Download these programs, install them, update and then do scan your computer using those Antispyware:
Malwarebytes Antimalware: http://www.malwarebytes.org/mbam.php http://www.superantispyware.com/ http://www.spybot.info/
after install and update those programs I think it’s better if you go and scan in safe mode.
in your HijackThis log, there are something bad, but I think those scanners would fix your problems, after scan and fix the problems please send another Hijackthis log fine to fix remaining keys manually
system
April 29, 2009, 10:12pm
3
Welcome to the forums, KLC123.
An analysis for your HJT log shows the following problems :
We didn’t detect any active process of a firewall on your system. Reasons maybe:
O2 - BHO: (no name) - {d7f9bc24-7b24-46ab-8d81-c115ba36797a} - C:\WINDOWS\system32\zibipudo.dll (file missing) http://www.prevx.com/filenames/1164905402454182412-X1/ZIBIPUDO.DLL.html
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) http://www.spyandseek.com/Search.php?search_for=BA52B914-B692-46c4-B683-905236F6F655&search=SAS-Search
O4 - HKLM..\Run: [CPMd751d1a1] Rundll32.exe “c:\windows\system32\maligoha.dll”,a http://www.prevx.com/filenames/X879609754773689739-X1/MALIGOHA.DLL.html
O4 - HKUS\S-1-5-19..\Run: [penudususe] Rundll32.exe “C:\WINDOWS\system32\runasate.dll”,s (User ‘LOCAL SERVICE’) http://www.prevx.com/filenames/3297579437819081108-X1/RUNASATE.DLL.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) http://www.spyandseek.com/Search.php?search_for=CD67F990-D8E9-11d2-98FE-00C0F0318AFE&search=SAS-Search (23rd entry on the list)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} - http://www.spyandseek.com/Search.php?search_for=1D6711C8-7154-40BB-8380-3DEA45B69CBF&search=SAS-Search
O20 - AppInit_DLLs: c:\windows\system32\maligoha.dll,C:\WINDOWS\system32\bozakupe.dll http://www.prevx.com/filenames/X371667332283032949-X1/BOZAKUPE.DLL.html
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\maligoha.dll http://www.prevx.com/filenames/X879609754773689739-X1/MALIGOHA.DLL.html
There were several other questionable entries but research determined they were OK.
Please follow Omid’s advice above and then post a new HJT log.
system
April 30, 2009, 2:47am
4
I downloaded and ran Malwarebytes, SUPERAntiSpyware, and Spybot S&D. They removed a bunch of items and I also went back into HijackThis and ran another scan. I fixed the items that CharleyO found in the first log that got missed by the 3 programs.
I also fixed the firewall problem. After I ran all of these programs I found out my firewall was disabled as well as my automatic updates. They have now been restored. I ran a third HijackThis and the log is below. Is there anything else I need to get rid of?
Thanks for all of the help!
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway http://www.dell4me.com/myway http://www.netscape.com @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
system
April 30, 2009, 7:48am
5
A much better HJT log but still one more to fix. It was in the other HJT log but I forgot to include it and I am sorry for that.
O24 - Desktop Component 2: Warning homepage - C:\WINDOWS\warnhp.html
This is an old trojan that avast should be able to take care of. I suggest that you run a boot time scan with avast.
Right click the “a” ball in the tray > select Start avast! antivirus > when the user interface loads, right click near the top left of the interface > select Schedule boot-time scan > be sure Scan all local disks is marked > click Schedule button and follow directions.
Please post back the results.
system
April 30, 2009, 11:10pm
6
Hello. I ran Avast in boot scan. Here is the new HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway http://www.dell4me.com/myway http://www.netscape.com @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
OK … a much better HJT log this time. The only thing shown is the firewall not running but that will happen if you are using Windows firewall.
So, is your computer running better now?
Yes it’s running much better! Thank you for all of the help
avast currently doesn’t have a firewall.
Any malware that manages to get past your defences will have free reign to connect to the internet to either download more of the same, pass your personal data (sensitive or otherwise, user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.
There are many freeware firewalls such as, Comodo (care required now it is a suite not to install the anti-virus element), PCTools Firewall Plus, Online Armor and recently released, Outpost Firewall free 6.5 (2009), etc.
See A Forum discussion on free firewalls http://forum.avast.com/index.php?topic=30808.0 http://www.matousec.com/projects/firewall-challenge/results.php .http://free.agnitum.com/ . Download, http://www.filehippo.com/download_outpost_firewall/
You are welcome, KLC123 … glad to have helped.
Follow David’s advice on firewalls and be sure to continue using avast regardless of what firewall you use.
