Tech Support Forum - View Single Post - Pop-ups, Slowness, Oh My!

Ried · 06-28-2007, 09:43 PM

Hi Alec22, let's continue.

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.

***************************************************

Open notepad and copy/paste the text in the quotebox below into it:

Code:

@echo off 

For %%g in ( 
C:\WINDOWS\awtqqq.dll
C:\WINDOWS\gebbxx.dll
C:\WINDOWS\geedeb.dll
C:\WINDOWS\mlkklm.dll
C:\WINDOWS\pmnkih.dll
C:\WINDOWS\system32\ddccy.exe
C:\WINDOWS\system32\gebcy.exe
C:\WINDOWS\system32\gebyw.exe
C:\WINDOWS\system32\jkhhi.exe
C:\WINDOWS\system32\mljjk.exe
c:\windows\system32\mlljgee.dll
C:\WINDOWS\system32\pmkhi.exe
C:\WINDOWS\system32\tmp12FE.tmp.dll
C:\WINDOWS\system32\tmp132.tmp.dll
C:\WINDOWS\system32\tmp1390.tmp.dll
C:\WINDOWS\system32\tmp15A.tmp.dll
C:\WINDOWS\system32\tmp1A2.tmp.dll
C:\WINDOWS\system32\tmp1E.tmp.dll
C:\WINDOWS\system32\tmp21.tmp.dll
C:\WINDOWS\system32\tmp23A.tmp.dll
C:\WINDOWS\system32\tmp25.tmp.dll
C:\WINDOWS\system32\tmp2EE.tmp.dll
C:\WINDOWS\system32\tmp306.tmp.dll
C:\WINDOWS\system32\tmp30F.tmp.dll
C:\WINDOWS\system32\tmp34.tmp.dll
C:\WINDOWS\system32\tmp3B.tmp.dll
C:\WINDOWS\system32\tmp415.tmp.dll
C:\WINDOWS\system32\tmp49.tmp.dll
C:\WINDOWS\system32\tmp61.tmp.dll
C:\WINDOWS\system32\tmp7D.tmp.dll
C:\WINDOWS\system32\tmp97.tmp.dll
C:\WINDOWS\system32\tmpA4.tmp.dll
C:\WINDOWS\system32\tmpB0.tmp.dll
C:\WINDOWS\system32\vturs.exe
C:\WINDOWS\tuvtqo.dll
C:\WINDOWS\vttqpo.dll
C:\WINDOWS\vttssp.dll
C:\WINDOWS\xxxuvs.dll
C:\WINDOWS\xxywur.dll
) do catchme -l nul -k %%g >nul 

For %%g in ( 
C:\WINDOWS\awtqqq.dll
C:\WINDOWS\gebbxx.dll
C:\WINDOWS\geedeb.dll
C:\WINDOWS\mlkklm.dll
C:\WINDOWS\pmnkih.dll
C:\WINDOWS\system32\ddccy.exe
C:\WINDOWS\system32\gebcy.exe
C:\WINDOWS\system32\gebyw.exe
C:\WINDOWS\system32\jkhhi.exe
C:\WINDOWS\system32\mljjk.exe
c:\windows\system32\mlljgee.dll
C:\WINDOWS\system32\pmkhi.exe
C:\WINDOWS\system32\tmp12FE.tmp.dll
C:\WINDOWS\system32\tmp132.tmp.dll
C:\WINDOWS\system32\tmp1390.tmp.dll
C:\WINDOWS\system32\tmp15A.tmp.dll
C:\WINDOWS\system32\tmp1A2.tmp.dll
C:\WINDOWS\system32\tmp1E.tmp.dll
C:\WINDOWS\system32\tmp21.tmp.dll
C:\WINDOWS\system32\tmp23A.tmp.dll
C:\WINDOWS\system32\tmp25.tmp.dll
C:\WINDOWS\system32\tmp2EE.tmp.dll
C:\WINDOWS\system32\tmp306.tmp.dll
C:\WINDOWS\system32\tmp30F.tmp.dll
C:\WINDOWS\system32\tmp34.tmp.dll
C:\WINDOWS\system32\tmp3B.tmp.dll
C:\WINDOWS\system32\tmp415.tmp.dll
C:\WINDOWS\system32\tmp49.tmp.dll
C:\WINDOWS\system32\tmp61.tmp.dll
C:\WINDOWS\system32\tmp7D.tmp.dll
C:\WINDOWS\system32\tmp97.tmp.dll
C:\WINDOWS\system32\tmpA4.tmp.dll
C:\WINDOWS\system32\tmpB0.tmp.dll
C:\WINDOWS\system32\vturs.exe
C:\WINDOWS\tuvtqo.dll
C:\WINDOWS\vttqpo.dll
C:\WINDOWS\vttssp.dll
C:\WINDOWS\xxxuvs.dll
C:\WINDOWS\xxywur.dll
) do ( 
catchme -l nul -c %%g "%%~g.vir" 
catchme -l nul -k "%%~g.vir" 
if exist "%%~g.vir" del /a/f "%%~g.vir" 
)>nul 2>&1 
echo.Please submit the file, catchme.zip located on Desktop 
pause 
exit

Save this as Submit.bat Choose to "Save type as - All Files"
It should look like this:

Double click on Submit.bat & allow it to run

This will generate a archive on your desktop, catchme.zip
Please submit it to this site → http://www.bleepingcomputer.com/subm....php?channel=4 and include a link to this topic in the message.

--------------------------------------------------------------------

Close any open browsers.

--------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries:

O2 - BHO: (no name) - {ed652ace-34de-49de-8b5d-71c81e34d7fa} - C:\WINDOWS\system32\5E6tub.dll (file missing)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab
O20 - AppInit_DLLs: c:\windows\system32\mlljgee.dll

Click 'Fix Checked' and close HijackThis.

--------------------------------------------------------------------

Please ensure Hidden files and folders are viewable:

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading:
* select Show hidden files and folders.
* Uncheck Hide protected operating system files (recommended) option.
*Also, make sure there is no checkmark beside Hide file extensions for known file types.
* Click OK.

--------------------------------------------------------------------

Using 'My Computer', navigate to and delete the following Folders

C:\Program Files\MyWebSearch
C:\Program Files\FunWebProducts
C:\VundoFix Backups

--------------------------------------------------------------------

Reboot your system.

--------------------------------------------------------------------

Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on located at the bottom of the page.
A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting

If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------------

Run a new scan with dss.exe.

--------------------------------------------------------------------

Please include the following in your next reply:

Panda results
main.txt
Update on system behavior

I'm seeing remnants of Symantec on your system. What version did you have installed?

06-28-2007, 09:43 PM	#5 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,012 OS: WinXP and Vista	Re: Pop-ups, Slowness, Oh My! Hi Alec22, let's continue. Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. ************************************************* Open notepad and copy/paste the text in the quotebox below into it: Code: @echo off For %%g in ( C:\WINDOWS\awtqqq.dll C:\WINDOWS\gebbxx.dll C:\WINDOWS\geedeb.dll C:\WINDOWS\mlkklm.dll C:\WINDOWS\pmnkih.dll C:\WINDOWS\system32\ddccy.exe C:\WINDOWS\system32\gebcy.exe C:\WINDOWS\system32\gebyw.exe C:\WINDOWS\system32\jkhhi.exe C:\WINDOWS\system32\mljjk.exe c:\windows\system32\mlljgee.dll C:\WINDOWS\system32\pmkhi.exe C:\WINDOWS\system32\tmp12FE.tmp.dll C:\WINDOWS\system32\tmp132.tmp.dll C:\WINDOWS\system32\tmp1390.tmp.dll C:\WINDOWS\system32\tmp15A.tmp.dll C:\WINDOWS\system32\tmp1A2.tmp.dll C:\WINDOWS\system32\tmp1E.tmp.dll C:\WINDOWS\system32\tmp21.tmp.dll C:\WINDOWS\system32\tmp23A.tmp.dll C:\WINDOWS\system32\tmp25.tmp.dll C:\WINDOWS\system32\tmp2EE.tmp.dll C:\WINDOWS\system32\tmp306.tmp.dll C:\WINDOWS\system32\tmp30F.tmp.dll C:\WINDOWS\system32\tmp34.tmp.dll C:\WINDOWS\system32\tmp3B.tmp.dll C:\WINDOWS\system32\tmp415.tmp.dll C:\WINDOWS\system32\tmp49.tmp.dll C:\WINDOWS\system32\tmp61.tmp.dll C:\WINDOWS\system32\tmp7D.tmp.dll C:\WINDOWS\system32\tmp97.tmp.dll C:\WINDOWS\system32\tmpA4.tmp.dll C:\WINDOWS\system32\tmpB0.tmp.dll C:\WINDOWS\system32\vturs.exe C:\WINDOWS\tuvtqo.dll C:\WINDOWS\vttqpo.dll C:\WINDOWS\vttssp.dll C:\WINDOWS\xxxuvs.dll C:\WINDOWS\xxywur.dll ) do catchme -l nul -k %%g >nul For %%g in ( C:\WINDOWS\awtqqq.dll C:\WINDOWS\gebbxx.dll C:\WINDOWS\geedeb.dll C:\WINDOWS\mlkklm.dll C:\WINDOWS\pmnkih.dll C:\WINDOWS\system32\ddccy.exe C:\WINDOWS\system32\gebcy.exe C:\WINDOWS\system32\gebyw.exe C:\WINDOWS\system32\jkhhi.exe C:\WINDOWS\system32\mljjk.exe c:\windows\system32\mlljgee.dll C:\WINDOWS\system32\pmkhi.exe C:\WINDOWS\system32\tmp12FE.tmp.dll C:\WINDOWS\system32\tmp132.tmp.dll C:\WINDOWS\system32\tmp1390.tmp.dll C:\WINDOWS\system32\tmp15A.tmp.dll C:\WINDOWS\system32\tmp1A2.tmp.dll C:\WINDOWS\system32\tmp1E.tmp.dll C:\WINDOWS\system32\tmp21.tmp.dll C:\WINDOWS\system32\tmp23A.tmp.dll C:\WINDOWS\system32\tmp25.tmp.dll C:\WINDOWS\system32\tmp2EE.tmp.dll C:\WINDOWS\system32\tmp306.tmp.dll C:\WINDOWS\system32\tmp30F.tmp.dll C:\WINDOWS\system32\tmp34.tmp.dll C:\WINDOWS\system32\tmp3B.tmp.dll C:\WINDOWS\system32\tmp415.tmp.dll C:\WINDOWS\system32\tmp49.tmp.dll C:\WINDOWS\system32\tmp61.tmp.dll C:\WINDOWS\system32\tmp7D.tmp.dll C:\WINDOWS\system32\tmp97.tmp.dll C:\WINDOWS\system32\tmpA4.tmp.dll C:\WINDOWS\system32\tmpB0.tmp.dll C:\WINDOWS\system32\vturs.exe C:\WINDOWS\tuvtqo.dll C:\WINDOWS\vttqpo.dll C:\WINDOWS\vttssp.dll C:\WINDOWS\xxxuvs.dll C:\WINDOWS\xxywur.dll ) do ( catchme -l nul -c %%g "%%~g.vir" catchme -l nul -k "%%~g.vir" if exist "%%~g.vir" del /a/f "%%~g.vir" )>nul 2>&1 echo.Please submit the file, catchme.zip located on Desktop pause exit Save this as Submit.bat Choose to "Save type as - All Files" It should look like this: Double click on Submit.bat & allow it to run This will generate a archive on your desktop, catchme.zip Please submit it to this site → http://www.bleepingcomputer.com/subm....php?channel=4 and include a link to this topic in the message. -------------------------------------------------------------------- Close any open browsers. -------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries: O2 - BHO: (no name) - {ed652ace-34de-49de-8b5d-71c81e34d7fa} - C:\WINDOWS\system32\5E6tub.dll (file missing) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab O20 - AppInit_DLLs: c:\windows\system32\mlljgee.dll Click 'Fix Checked' and close HijackThis. -------------------------------------------------------------------- Please ensure Hidden files and folders are viewable: Go to My Computer->Tools->Folder Options->View** tab: * Under the Hidden files and folders heading: * select Show hidden files and folders. * Uncheck Hide protected operating system files (recommended) option. Also, make sure there is no checkmark beside Hide file extensions for known file types. Click OK. -------------------------------------------------------------------- Using 'My Computer', navigate to and delete the following Folders C:\Program Files\MyWebSearch C:\Program Files\FunWebProducts C:\VundoFix Backups -------------------------------------------------------------------- Reboot your system. -------------------------------------------------------------------- Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Perform an online scan with Internet Explorer with Panda ActiveScan Click on located at the bottom of the page. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it * Enter your e-mail address, country, and state & click "Free Online Scan" The download of the 8 MB Panda's ActiveX control will take place Begin the scan by selecting If it finds any malware, it will offer you a report. Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later. Click on then click * You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. * Turn off the real time scanner of any existing antivirus program while performing the online scan -------------------------------------------------------------------- Run a new scan with dss.exe. -------------------------------------------------------------------- Please include the following in your next reply: Panda results main.txt Update on system behavior I'm seeing remnants of Symantec on your system. What version did you have installed? __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."