I'm Infected With SPYWARE!

Sir_Itchlot · December 18, 2005

A couple months ago, when trying to use IE, it was going all buggy and closing and crap. I restarted my computer, and everytime since then when I try to use it, this "Winfixer" thing pops up, and keeps trying to install itself, apparently to fix IE?

I thought it was spyware, so I got firefox. But I just tried the Spyware Remover that's recommended somewhere on these forums, and it didn't find any spyware. So I'm using IE right now, playing RS and it's working better than Firefox! Even with High Detail on it, it's better than low detail was on Firefox. I want to continue using IE, because RS is working better with it, but if Winfixer is spyware, then they could get my passwords right?

If someone knows whether Winfixer is the real deal (Microsoft) or not, please tell me so I can install the stupid thing so it stops annoying me, and fixes IE or whatever.

Thanks. :)

EDIT: HOLY CRAP. I just searched Winfixer on google and the first like 10 things are Winfixer REMOVALS! :shock: Which should I use? I need to get rid of this, and Spybot: Search And Destroy didn't detect it! AHH!

AND: I found this: "It is a rogue anti-spyware program

that hijacks your computer."

coltm4carbine · December 18, 2005

post a HJT log while your here.

I give you the tools (not using symantec taking it out the hard way)

p.s I won't even think about worrying about rs accounts. I am a bit concerned about your computer...

Sir_Itchlot · December 18, 2005

My HJT Log:

Logfile of HijackThis v1.99.1

Scan saved at 10:50:48 PM, on 17/12/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss[Caution: ExecutableFile]

C:\WINDOWS\system32\winlogon[Caution: ExecutableFile]

C:\WINDOWS\system32\services[Caution: ExecutableFile]

C:\WINDOWS\system32\lsass[Caution: ExecutableFile]

C:\WINDOWS\system32\svchost[Caution: ExecutableFile]

C:\WINDOWS\System32\svchost[Caution: ExecutableFile]

C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr[Caution: ExecutableFile]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc[Caution: ExecutableFile]

C:\WINDOWS\System32\svchost[Caution: ExecutableFile]

C:\WINDOWS\Explorer[Caution: ExecutableFile]

C:\WINDOWS\System32\hkcmd[Caution: ExecutableFile]

C:\Program Files\CyberLink\PowerDVD\DVDLauncher[Caution: ExecutableFile]

C:\Program Files\Java\j2re1.4.2_03\bin\jusched[Caution: ExecutableFile]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc[Caution: ExecutableFile]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc[Caution: ExecutableFile]

C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB[Caution: ExecutableFile]

C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]

C:\WINDOWS\System32\svchost[Caution: ExecutableFile]

C:\PROGRA~1\MOZILL~1\FIREFOX[Caution: ExecutableFile]

C:\Documents and Settings\Mitch\Desktop\hijackthis\HijackThis[Caution: ExecutableFile]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant ... gn=wdz0605

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.accoona.com/search_assistant ... gn=wdz0605

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;

R3 - Default URLSearchHook is missing

O1 - Hosts: 69.20.16.183 auto.search.msn.com

O1 - Hosts: 69.20.16.183 search.netscape.com

O1 - Hosts: 69.20.16.183 ieautosearch

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {06a34ccb-f185-40c4-b367-15f01a0d7996} - C:\WINDOWS\system32\gdbrdwsw.dll

O2 - BHO: (no name) - {19ca005a-8716-4e8d-b232-70451fe73635} - C:\WINDOWS\system32\gdbrdwsw.dll

O2 - BHO: (no name) - {49c5f9e3-63fc-4ced-a16c-77bea61396f5} - C:\WINDOWS\system32\gdbrdwsw.dll

O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\mljji.dll

O2 - BHO: LinkTracker Class - {85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1} - C:\WINDOWS\system32\hlwin.dll

O2 - BHO: Accoona Search Assistant - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll (file missing)

O2 - BHO: (no name) - {e16b8728-c829-40bf-8aa8-c1bb2e387fcb} - C:\WINDOWS\system32\gdbrdwsw.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray[Caution: ExecutableFile]

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd[Caution: ExecutableFile]

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched[Caution: ExecutableFile]

O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan[Caution: ExecutableFile]

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc[Caution: ExecutableFile] /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc[Caution: ExecutableFile]

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB[Caution: ExecutableFile]

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]" /background

O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli[Caution: ExecutableFile]

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] (file missing)

O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu ... 0.0.15.cab

O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares ... cracks.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b32846.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Filter: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - C:\WINDOWS\system32\hlwin.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr[Caution: ExecutableFile]

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc[Caution: ExecutableFile]

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc[Caution: ExecutableFile]

coltm4carbine · December 18, 2005

Please print these instructions as they will be needed later when Internet access is not available.

1) go http://www.atribune.org/downloads/VundoFix[Caution: ExecutableFile]

Change the .e3e (CAUTION- executable file) to [Caution: ExecutableFile]

2) Download the file to your desktop.

3) Double-click VundoFix[Caution: ExecutableFile] to extract the files

4) This will create a VundoFix folder on your desktop.

5) After all the files have been extracted, please go into safemode (pressing f8 while booting up then select safemode)

6) Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat

7) You will first be presented with a warning.

It should look like this:

VundoFix V2.15 by Atri

By using VundoFix you agree that you are doing so at your own risk

Press enter to continue....

At this point press enter once.

Next you will see:

Please Type in the filepath as instructed by the forum staff

and then press enter:

(ignore the staff bit- it doesn't matter)

At this point type in:

C:\WINDOWS\system32\mljji.dll

Press Enter to continue with the fix.

Next you will see:

Please type in the second filepath as instructed by the forum

staff then press enter:

again ignore the staff bit.

C:\WINDOWS\system32\ijjlm.*

Press Enter to continue with the fix. If HijackThis opens, simply shut it down as we will instruction you when to use it later.

Press enter to exit the program then manually reboot your computer.

Once your machine reboots please continue with the instructions below.

google and Download CCleaner from here to clean temp files from your computer.

Double click on the file to start the installation of the program.

Select your language and click OK, then next.

Read the license agreement and click I Agree.

Click next to use the default install location. Click Install then finish to complete installation.

Double click the CCleaner shortcut on the desktop to start the program.

On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).

If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.

Click Run Cleaner to run the program.

Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.

After CCleaner has completed its process, click Exit.

post a new HJT log.

I can see a lot that needs to be fixed but i take out vundo first.

Sir_Itchlot · December 18, 2005

2 Things:

A: No Printer, Copy And Paste To Notepad?

B: I have CCleaner already, it helped me get rid of a ProRat Trojan Once. :) Very Handy.

..Anywho, I'm gonna try that, give me a sec.

coltm4carbine · December 18, 2005

not looking good then... erm got another computer that you can read the instructions from?

if not save a copy of the instructions to you desktop. you must close it while running the fix though.

To anyone else with winfixer- don't follow these instructions the entries are different each time.

Sir_Itchlot · December 18, 2005

Bloopity blop.

*EDITED, USELESS NOW*

Sir_Itchlot · December 18, 2005

Okay, I've done everything up to the CCleaner part. (In safemode, I couldn't see my desktop, so I went ctrl + alt + delete, then run, found Vundofix, and everything worked or whatever)

My CCleaner isn't at the defaults for what to check and uncheck (boxes), because I've used it before and set to what I wanted to clean. So could you by any chance tell me what to check and want to uncheck before I do this? Thanks. :)

Sir_Itchlot · December 18, 2005

Went ahead with it anyway..

After CCleaner Part:

Logfile of HijackThis v1.99.1

Scan saved at 12:11:28 AM, on 18/12/2005