system
March 20, 2007, 9:37pm
1
When I log on to Windows,something is making Internet Explorer go online automatically, then I closed it. This is the Highjack this log: Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com @msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxhttp://kl.bar.need2find.com/KL/menusearch.html?p=KL http://install.anark.com/client/version4/windows-ie/en/AMClient.cab http://go.microsoft.com/fwlink/?linkid=39204 http://downloads.netscape.com/search/toolbar/netscape.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164049803229 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164325175162 http://www.popcap.com/games/popcaploader_v6.cab
Can somebody help me get rid of this problem?
system
March 20, 2007, 9:47pm
2
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
Try this
Click Start>Programs>Accessories>Synchronize>Setup
Uncheck all the synchronize options and click OK.
EDIT: Also open an instance of Windows Explorer (not Internet Explorer), click Tools, Folder Options, Offline Files. Makes sure Enable Offline Files is not checked if it is present.
Hi flygirl,
Yes, I can see some bad things in the log.
Have you tried using the usual free anti-malware scanners in addition to avast!?
Download, install and update any of the below you don’t already have. When you have installed all the programs, go offline (pull the plug on your internet connection) and run scans with all.
If you’re not behind a hardware firewall, I’d recommend you download a software firewall and install it after cleaning and before coming back online.
I recommend Zone Alarm:
http://dl2.zonelabs.com/bin/free/1023_zl/zlsSetup_70_337_000_en.exe
When you have finished, come back online and post a fresh HijackThis! log please.
Are you behind a hardware firewall because there’s no sign of a software firewall in your log?
AVG Anti-spyware (requires Win2k/XP):
http://www.ewido.net/en/product/
a-Squared Free:
http://www.emsisoft.com/en/software/free/
Ad-Aware:
http://www.download.com/3000-2144-10045910.html
Spybot Search & Destroy:
http://www.safer-networking.org/en/download/index.html
Virtumondo infection. Delete the following with HJT
O20 - Winlogon Notify: ljjkifd - ljjkifd.dll (file missing)http://www.popcap.com/games/popcaploader_v6.cab
Some of them are now proving a bit resistant to Vundofix
Please download VundoFix.exe
[*]Double-click VundoFix.exe to run it.Scan for Vundo button.Remove Vundo button.YES OK .Please post the contents of C:[b]vundofix.txt and a new HiJackThis log in a reply to this thread.Scan for Vundo button” when VundoFix appears upon rebooting
Hi flygirl & essexboy,
There is also a special removal tool for the virtumondo adware to be downloaded from here:http://www.spywareremove.com/removeAdware__Virtumondo.html
polonus
Hi Damien stsrting to show your age now, looking at your picture :o
system
March 20, 2007, 11:58pm
7
Ok, this is my new log from HJT: Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com @msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxhttp://kl.bar.need2find.com/KL/menusearch.html?p=KL http://install.anark.com/client/version4/windows-ie/en/AMClient.cab http://go.microsoft.com/fwlink/?linkid=39204 http://downloads.netscape.com/search/toolbar/netscape.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164049803229 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164325175162
What do I do know?
DavidR
March 21, 2007, 1:07am
8
I would be suspicious of these as the file name doesn’t get any hits on a google search. Probably worth a check by VirusTotal and Jotti multi-engine scanners.
O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINNT\system32\wmolbqvs.dll
This was in your previous log and essexboy suggested deletion.
system
March 21, 2007, 1:35am
9
Yeepy! Everything is alright and back to normal. Here’s my new log fromHJT: Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com @msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxhttp://kl.bar.need2find.com/KL/menusearch.html?p=KL http://install.anark.com/client/version4/windows-ie/en/AMClient.cab http://go.microsoft.com/fwlink/?linkid=39204 http://downloads.netscape.com/search/toolbar/netscape.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164049803229 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164325175162
Hi flygirl,
There are still some suspicious entries. Can you confirm that you have run all the scanners I mentioned in my previous post?
DavidR
March 21, 2007, 1:20pm
11
Fix:
These were previously mentioned, but still appear on your HJT log.
These were previously mentioned, but still appear on your HJT log.
Exactly the suspicious entries I was looking at.
I only like to recommend dealing with HijackThis! entries after running thorough scans with multiple scanners, as the scanners usually deal with most of the malware entries.
flygirl, if you’ve run the scans I recommended, you could upload these two files to VirusTotal to see what they are:
C:\WINNT\system32\qomkl.dll
http://www.virustotal.com/en/indexf.html
To enable the viewing of Hidden files follow these steps:
http://www.bleepingcomputer.com/tutorials/tutorial62.html#win2000
DavidR
March 21, 2007, 4:40pm
13
Which is basically what I suggested in reply #7
I would be suspicious of these as the file name doesn’t get any hits on a google search. Probably worth a check by VirusTotal and Jotti multi-engine scanners.
O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINNT\system32\wmolbqvs.dll
This was in your previous log and essexboy suggested deletion.
If suggestions aren’t being followed and feed back given, it make it very frustrating trying to help.
Sorry, hadn’t noticed. :-[
DavidR
March 21, 2007, 10:50pm
15
No worries Frank, it wasn’t directed at you but a comment that those trying to help keep having to cover the same ground because the suggestions haven’t been actioned or acknowledged.
You can’t be expected to keep going over the topic to see if it has been suggested before, you are responding to the latest HJT log.
system
March 21, 2007, 11:51pm
16
Here’s my new log Frank. I don’t see the things listed in your last reply, but here it is: Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com @msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxhttp://kl.bar.need2find.com/KL/menusearch.html?p=KL http://download.windowsupdate.com http://install.anark.com/client/version4/windows-ie/en/AMClient.cab http://go.microsoft.com/fwlink/?linkid=39204 http://downloads.netscape.com/search/toolbar/netscape.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164049803229 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164325175162
I don't see the things listed in your last reply
No problem. there were obviously malware as suspected and one of the scanners must have removed them.
The log looks clean now apart from this entry:
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
http://www.computing.net/windowsme/wwwboard/forum/46324.html
The link seems to be dead so it might not be bothering you any more, but have a look for the following entry in Start>Control Panel>Add/Remove and uninstall if found:
need2find
Otherwise, run HijackThis! agian, tick the box next to this entry and click ‘fix’.
I see you instaled Zone Alarm- this link may be useful for reference:
http://www.zonealarm.com/store/content/support/zasc/gettingStarted.jsp?anchor=alerts&lid=zasupp_u
system
March 22, 2007, 6:51pm
18
I done what you said, I ran HJT again and I ticked the box next to the entry and click Fix. The Need 2 Find is history. By the way, what is TweakUI? Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com @msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxhttp://download.windowsupdate.com http://install.anark.com/client/version4/windows-ie/en/AMClient.cab http://go.microsoft.com/fwlink/?linkid=39204 http://downloads.netscape.com/search/toolbar/netscape.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164049803229 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164325175162
It’s a geek toy power user tool:
Tweak UI
This PowerToy gives you access to system settings that are not exposed in the Windows XP default user interface, including mouse settings, Explorer settings, taskbar settings, and more.
http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx
Name: tweak ui 1.33 deutsch
Filename: RUNDLL32.EXE TWEAKUI.CPL, TweakMeUp
Command: Unknown at this time.
Description: Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed - German version
File Location: Unknown
Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
HijackThis Category: O4 Entry
http://www.bleepingcomputer.com/startups/RUNDLL32.EXE_TWEAKUI.CPL_TweakMeUp-9937.html
The log looks fine now.