Tech Support Forum - View Single Post

CTSNKY · 10-24-2004, 10:36 AM

Did you make sure to turn on Hidden Files to be visible? These files cannot be reported on your log, then not be on your machine unless you missed that step.

Let's try again.....

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

I will assume you did turn off System Restore.

Run an online virus scan at TrendMicro or RAV Antivirus. Select the Autoclean option if you use TrendMicro.

Reboot into Safe Mode (hit F8 key until menu shows up).

Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):

C:\WINDOWS\wininit.ini:omegs
C:\WINDOWS\apiis.exe
C:\WINDOWS\System32\t?skmgr.exe

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

180Solutions

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\johbv.dll/sp.html#27859
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\johbv.dll/sp.html#27859
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://johbv.dll/index.html#27859
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://johbv.dll/index.html#27859
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\johbv.dll/sp.html#27859
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\johbv.dll/sp.html#27859
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\johbv.dll/sp.html#27859
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://johbv.dll/index.html#27859
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\johbv.dll/sp.html#27859
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\johbv.dll/sp.html#27859
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {75DF767A-8F98-D240-FB11-406F16816D6D} - C:\WINDOWS\javady32.dll
O4 - HKLM\..\Run: [atlzq32.exe] C:\WINDOWS\system32\atlzq32.exe
O4 - HKLM\..\Run: [AutoLoader7F0s1MILadaa] "C:\WINDOWS\System32\cdm30dsa.exe" /PC="AM.WILD" /HideUninstall
O4 - HKLM\..\Run: [7srQ32V] cdm30dsa.exe
O4 - HKLM\..\Run: [48e] C:\documents and settings\jerren\local settings\temp\48e.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKCU\..\Run: [MB04RSZFl] syngwrbk.exe
O4 - HKCU\..\Run: [Mvehamhy] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [query] C:\WINDOWS\System32\query.exe
O4 - HKCU\..\Run: [cmprops] C:\WINDOWS\System32\cmprops.exe
O4 - Startup: PowerReg Scheduler V3.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\fxjdjoa.exe
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocach...etup1.0.0.6.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O21 - SSODL: SystemCheck - {54645654-2225-4455-44A1-9F4543D34544} - C:\WINDOWS\System32\vbsys.dll (file missing)

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\apiis.exe
C:\WINDOWS\System32\t?skmgr.exe
C:\WINDOWS\javady32.dll
C:\WINDOWS\johbv.dll

Also delete ALL those EXE and DLL files (in their corresponding directory) listed above in RED.

Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean.

10-24-2004, 10:36 AM	#7 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	Did you make sure to turn on Hidden Files to be visible? These files cannot be reported on your log, then not be on your machine unless you missed that step. Let's try again..... Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below. Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked. I will assume you did turn off System Restore. Run an online virus scan at TrendMicro or RAV Antivirus. Select the Autoclean option if you use TrendMicro. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\WINDOWS\wininit.ini:omegs C:\WINDOWS\apiis.exe C:\WINDOWS\System32\t?skmgr.exe Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: 180Solutions Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\johbv.dll/sp.html#27859 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\johbv.dll/sp.html#27859 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://johbv.dll/index.html#27859 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://johbv.dll/index.html#27859 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\johbv.dll/sp.html#27859 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\johbv.dll/sp.html#27859 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\johbv.dll/sp.html#27859 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://johbv.dll/index.html#27859 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\johbv.dll/sp.html#27859 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\johbv.dll/sp.html#27859 R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {75DF767A-8F98-D240-FB11-406F16816D6D} - C:\WINDOWS\javady32.dll O4 - HKLM\..\Run: [atlzq32.exe] C:\WINDOWS\system32\atlzq32.exe O4 - HKLM\..\Run: [AutoLoader7F0s1MILadaa] "C:\WINDOWS\System32\cdm30dsa.exe" /PC="AM.WILD" /HideUninstall O4 - HKLM\..\Run: [7srQ32V] cdm30dsa.exe O4 - HKLM\..\Run: [48e] C:\documents and settings\jerren\local settings\temp\48e.exe O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe O4 - HKCU\..\Run: [MB04RSZFl] syngwrbk.exe O4 - HKCU\..\Run: [Mvehamhy] C:\WINDOWS\System32\t?skmgr.exe O4 - HKCU\..\Run: [query] C:\WINDOWS\System32\query.exe O4 - HKCU\..\Run: [cmprops] C:\WINDOWS\System32\cmprops.exe O4 - Startup: PowerReg Scheduler V3.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\fxjdjoa.exe O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocach...etup1.0.0.6.cab O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB O21 - SSODL: SystemCheck - {54645654-2225-4455-44A1-9F4543D34544} - C:\WINDOWS\System32\vbsys.dll (file missing) Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\WINDOWS\apiis.exe C:\WINDOWS\System32\t?skmgr.exe C:\WINDOWS\javady32.dll C:\WINDOWS\johbv.dll Also delete ALL those EXE and DLL files (in their corresponding directory) listed above in RED. Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean. __________________ GO BIG BLUE!!