Many Issues - HELP NEEDED

Viruses and worms
21

Download OTViewIt to your desktop.

* Close all windows and double click OTViewIt
* Place a tick in the  Scan all Users box
* Click Run Scan and let the program run uninterrupted
* On completion it will produce two logs on the Desktop, post the OTViewIt.txt and Extras.txt logs in your next post.

and after a spybot or sas scan please
with a new HJT

22

Ok, here are the files from the OTViewIt scan (attached). I am running a SAS scan now then I will run a new HJT and post that.
Now with regards to software. Here is what I have. Please say either KEEP or DELETE. If you say delete, please recommend a subsitute.

  1. Avast!
  2. Malewarebytes
  3. WinPatrol
  4. SuperAntiSpyware
  5. Ad Aware

I feel like i’m stockpiling software…lol

Thanks again for the help.

23
  1. Avast! Keep
  2. Malewarebytes Keep as on demand scanner- it just takes disk space- no resources
  3. WinPatrol protects your hosts file and has lots of handy tools- I’d keep unless someone can suggest a subsitiute
  4. SuperAntiSpyware same as 2
  5. Ad Aware Yawn although the latest version is better than previous it is the one to cut loose if you are tight on disc space

What we are missing here is a Real Time anti spyware/malware program
remind me what cpu and how much memory you have
Win Patrol is the absolute minimum
Spybot Search and Destroy is usually next resource lite I’d replace Ad-Aware with spybot any day
and use the fine Immunize program and SD-Helper and T-timer for real-time unless another real time is selected
next as to resource usages
Comodo BO Clean (different class of protection)

REal time choices (free)
Windows Defender (old Microsoft Anti Spyware) advantage is that it is compatible with almost everything
Spyware Terminator without AV and Toolbar (I have not tested this one but others here use it
SpywareDoctor Free with GooglePack (no other google add ons)

other free protection is:
a Hosts file
Threat Fire
spywareblaster (mandatory if IE is installed anywhere on your system)
A-Squared anti trojan
Comodo BO Clean

If you do any risky surfing (p2p) then think of System Safety Monitor or another HIPS program

24

Here are my system specs:
CPU is Pentium M 1.73GHZ
Memory 1GB
50GB HD with 19GB free
How did the OTViewIt scan look?

25

I’ll PM Essexboy and Polonus to have a look

26

Hi
I just got a PM back
not to PMers please post directly to Roy’s thead- I’m going to be gone so mesg will get lost- thanks

Hi I have looked at the log and it shows six suspicious boot drivers that are currently stopped. One that is running They may be related to Pandex

Drivers:
vyhpzwmpfhc.sys
Winkq52
Winsa06
Winta86
Winvd63
Winyh64
lddtzso

Files:
C:WINDOWSsystem32driversavuvjra.sys
C:WINDOWSSystem32DriversWinkq52.sys
C:WINDOWSSystem32DriversWinsa06.sys
C:WINDOWSSystem32DriversWinta86.sys
C:WINDOWSSystem32DriversWinvd63.sys
C:WINDOWSSystem32DriversWinyh64.sys
C:WINDOWSsystem32driversvyhpzwmpfhc.sys

I would recommend removal

Quote
(vyhpzwmpfhc.sys) vyhpzwmpfhc.sys [Auto | Running]
[08/28/2008 06:13 AM | 00,086,528 | ---- | M] () - C:WINDOWSsystem32driversvyhpzwmpfhc.sys
(Winkq52) Winkq52 [Boot | Stopped]
File not found - C:WINDOWSSystem32DriversWinkq52.sys
(Winsa06) Winsa06 [Boot | Stopped]
File not found - C:WINDOWSSystem32DriversWinsa06.sys
(Winta86) Winta86 [Boot | Stopped]
File not found - C:WINDOWSSystem32DriversWinta86.sys
(Winvd63) Winvd63 [Boot | Stopped]
File not found - C:WINDOWSSystem32DriversWinvd63.sys
(Winyh64) Winyh64 [Boot | Stopped]
File not found - C:WINDOWSSystem32DriversWinyh64.sys

If you wish I can make an Avenger batch for them

that Means PM Essexboy if you need some help on this Roy best to google PANDEX

Polonus were there some files to be removed- if so post em up

Roy-good luck you have a couple of the best on your side

Roy are these files on your machine??
C:\Program Files\Internet Explorer\javaupdate20080815.exe
C:\Program Files\Internet Explorer\networkupdate20080815.exe
C:\Program Files\Internet Explorer\symantecupdate20080810.exe
C:\Program Files\Internet Explorer\visualbasicupdate20080815.exe
if so delete
if they will not delete post back

27

Hi wyrmrider,

Haven’t see a new hjt log from RoyM, when he attaches one, I will look into it with an entries analysis and a tasks analysis, further ask Essexboy for the avanger write up,

polonus

28

Your wish is my command

  1. Please download The Avenger2 by Swandog46 to your Desktop.
    [*]Right click on the Avenger.zip folder and select “Extract All…”
    [*] Follow the prompts and extract the avenger folder to your desktop
  2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Begin copying here:
Drivers to Delete:
vyhpzwmpfhc.sys
Winkq52
Winsa06
Winta86
Winvd63
Winyh64
lddtzso

Files to delete:
C:WINDOWS\system32\drivers\avuvjra.sys
C:WINDOWS\System32\Drivers\Winkq52.sys
C:WINDOWS\System32\Drivers\Winsa06.sys
C:WINDOWS\System32\Drivers\Winta86.sys
C:WINDOWS\System32\Drivers\Winvd63.sys
C:WINDOWS\System32\Drivers\Winyh64.sys
C:WINDOWS\system32\drivers\vyhpzwmpfhc.sys
C:\Program Files\Internet Explorer\javaupdate20080815.exe   
C:\Program Files\Internet Explorer\networkupdate20080815.exe
C:\Program Files\Internet Explorer\symantecupdate20080810.exe   
C:\Program Files\Internet Explorer\visualbasicupdate20080815.exe


Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

  1. Now, open the avenger folder and start The Avenger program by clicking on its icon.

[*] Right click on the window under Input script here:, and select Paste.
[*] You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
[*] Click on Execute
[*] Answer “Yes” twice when prompted.

  1. The Avenger will automatically do the following:
    [*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Delete” or “Drivers to Disable”, The Avenger will actually restart your system twice.)
    [*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    [*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  2. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh Hijackthis log .
29

I can’t thank you guys enough. There is absolutely nothing in this for you and your just going over and beyond. You’re truly the best!
If you were here, the drinks are on me.
I am running a AV scan now, so when it is done I will do the avenger thingy and post those results with a new HJT log.
BTW - I did have those EXE files in my Internet Explorer folder. I deleted them.

Thanks again to all!

30

Wow - that was scary!. I ran Avenger with the code that was provided, and after it told me it needed to reboot, I received one of those nice blue screen errors that mentioned a unexpected error and something about a physical dump. I rebooted 2x and got another blue screen with this error code: C000021a - Fatal System Error
I booted in safe mode, then in normal mode and here I am.
Anyhow, I was looking at the Avenger text file and it said that those .sys files could not be found. I went back to the OTViewIt text file and in there also it said those files were not found. Is this anything?
Attached is the Avenger text and a new HJT log.
I anxiously await the diagnosis.

Roy

31

Hi 10pm here in California
Polonus is in the Netherlands and I would guess Essexboy is in …
way over my head
just to say that these advanced tools are not for everyday use- that’s why we try and exhaust everything else first
Were those files the same ones as in IE?

32

Yes the files you listed in the IE folder were there. But I manually removed them prior to running Avenger.
Did you have a chance to look at the log files?

33

Log files are in post 29 on page 2