Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

seems like a virtumonde/zlob deal here

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

seems like a virtumonde/zlob deal here

Unread postby VtecBankai » December 17th, 2008, 3:00 am

But of course I'm new at this and this is the first time I'm totally stumped trying to get rid of this sucker. Computer seems to run everything else fine but on some sites it will have pop ups upon visiting certain sites/forums. Also when searching using Yahoo, if you try to open a link in a new page/tab it will redirect to some random page but if you click the actual listed link on Yahoo it will usually take you to the intended site. Then I noticed reputable sites kept advertising this "vimax enlargement pills" stuff for.... well... you know. The same exact ads popping up everywhere on other sites.

Here are my HJT and DNSCheck logs. The DNSCheck log looks pretty rough.
And yes, I am using a router now and problem seemed to start as soon as I switched to using this router.

Logfile of HijackThis v1.99.1
Scan saved at 00:52:53, on 12/17/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\AOL\1188025937\ee\aolsoftware.exe
C:\Documents and Settings\Owner\My Documents\Ballin.exe <---- just to be clear this is HJT, just renamed

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2559D161-CD70-4D64-AE5B-1772A8733870}: NameServer = 85.255.113.149;85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\..\{834A2B7D-55DC-49DC-AD50-399B68207408}: NameServer = 85.255.113.149;85.255.112.218
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.149;85.255.112.218
O17 - HKLM\System\CS1\Services\Tcpip\..\{2559D161-CD70-4D64-AE5B-1772A8733870}: NameServer = 85.255.113.149;85.255.112.218
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.149;85.255.112.218
O17 - HKLM\System\CS2\Services\Tcpip\..\{2559D161-CD70-4D64-AE5B-1772A8733870}: NameServer = 85.255.113.149;85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.149;85.255.112.218
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
________________________________________________________________________
DNSCheck v.0.8.15
Checking No-Exist Redirector
Fake name: ouwkokffwahsddixryul.com
127.0.0.1: NSLOOKUP.EXE reverse resolution failed. Failing over to local DNS.
Resolves to: localhost -- HIJACKED!
Checking site: google.com
DNSAPI and NSLOOKUP are not in agreement. -- HIJACKED!
NSLOOKUP returns:
127.0.0.1: NSLOOKUP.EXE reverse resolution failed. Failing over to local DNS.
Resolves to: localhost -- HIJACKED!
DNSAPI returns:
209.85.171.100: resolves to cg-in-f100.google.com -- OK!
72.14.205.100: resolves to qb-in-f100.google.com -- OK!
74.125.45.100: resolves to yx-in-f100.google.com -- OK!
Checking site: yahoo.com
DNSAPI and NSLOOKUP are not in agreement. -- HIJACKED!
NSLOOKUP returns:
127.0.0.1: NSLOOKUP.EXE reverse resolution failed. Failing over to local DNS.
Resolves to: localhost -- HIJACKED!
DNSAPI returns:
206.190.60.37: resolves to w2.rc.vip.re4.yahoo.com -- OK!
68.180.206.184: resolves to w2.rc.vip.sp1.yahoo.com -- OK!
Checking site: bleepingcomputer.com
DNSAPI and NSLOOKUP are not in agreement. -- HIJACKED!
NSLOOKUP returns:
127.0.0.1: NSLOOKUP.EXE reverse resolution failed. Failing over to local DNS.
Resolves to: localhost -- HIJACKED!
DNSAPI returns:
208.43.87.2: resolves to http://www.bleepingcomputer.com -- OK!
Checking site: geekstogo.com
DNSAPI and NSLOOKUP are not in agreement. -- HIJACKED!
NSLOOKUP returns:
127.0.0.1: NSLOOKUP.EXE reverse resolution failed. Failing over to local DNS.
Resolves to: localhost -- HIJACKED!
DNSAPI returns:
208.43.44.138: resolves to geek15.geekstogo.com -- OK!
Checking site: malwarebytes.org
DNSAPI and NSLOOKUP are not in agreement. -- HIJACKED!
NSLOOKUP returns:
127.0.0.1: NSLOOKUP.EXE reverse resolution failed. Failing over to local DNS.
Resolves to: localhost -- HIJACKED!
DNSAPI returns:
69.162.79.74: resolves to alpha.malwarebytes.org -- OK!

Any help would be awesome, it'd be nice to have my computer back to normal

Thank you,

----Patrick
VtecBankai
Active Member
 
Posts: 1
Joined: December 17th, 2008, 2:38 am
Advertisement
Register to Remove

Re: seems like a virtumonde/zlob deal here

Unread postby silver » December 28th, 2008, 4:12 am

Hi VtecBankai,

I'm sorry it's taken so long for you to get a response, if you still need help please do as follows:

You appear to have no antivirus software running. Without antivirus software your computer is very vulnerable and can easily be infected at any time so it it is essential you have one active at all times.

There are several free packages available, two of the most popular are here:
Antivir: http://www.free-av.com/
Avast!: http://www.avast.com/eng/download-avast-home.html

If you have no antivirus program then download and install one immediately, update the definitions and set it to update automatically.
Please ensure you have one antivirus program installed before continuing

------------------------------------------------------------------------

Download RSIT by random/random to your Desktop (right-click the link, select Save Target As..., select your Desktop and press Save)

  • Double click RSIT.exe to start the program, and click Continue at the disclaimer screen.
  • When the scan is complete, two text files will open - log.txt <- this one will be maximized and info.txt <-this one will be minimized
  • Make sure Format->Word Wrap is unchecked
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt and info.txt in your reply

Once complete, please post both RSIT logs, you won't need to produce a new HijackThis log as RSIT produces one for you.
User avatar
silver
Regular Member
 
Posts: 9219
Joined: August 7th, 2006, 9:40 pm
Location: GMT+7

Re: seems like a virtumonde/zlob deal here

Unread postby silver » December 30th, 2008, 9:58 pm

Do you still need help with your machine?

If the instructions are unclear or something isn't working, please let me know before proceeding.
User avatar
silver
Regular Member
 
Posts: 9219
Joined: August 7th, 2006, 9:40 pm
Location: GMT+7

Re: seems like a virtumonde/zlob deal here

Unread postby silver » January 2nd, 2009, 9:19 pm

Due to a Lack of Response this topic is now closed.

If you still require help, please open a new thread in the Malware Removal forum.

If you have been helped and wish to donate to help with the costs of this volunteer site,
please read Donations For Malware Removal
User avatar
silver
Regular Member
 
Posts: 9219
Joined: August 7th, 2006, 9:40 pm
Location: GMT+7
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 37 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware