Technology Need Help Fast

TG1 Ghetto One · Sep 24, 2005

Yeah i got a virus i know the name of it and everythin its a W32/Agent.ABG virus and i download this ting to get rid of it and as soon as it detected it and went to start deletin it, it restarted my computer, its a hackin virus i tried deletin it in safe mode but it says the disk is write protected and i even turned my internet off while i did the search so it couldnt get through but it still restarted my computer can anyone help me out, i cant wipe my hard drive man i jus cant do it HELP

Illuminattile · Sep 24, 2005

Move this to Tech Talk, please.

Illuminattile · Sep 24, 2005

Does it give a file name and path for the infected file?

TG1 Ghetto One · Sep 24, 2005

yeah this is the path for it: q2860921_disk.dll ive tried deletin it in safe mode and with a one tool but it reset my computer and it said it was write protected

Illuminattile · Sep 25, 2005

You have a CoolWebSearch variant, a particularly nasty little fucker.

Download and run CWShredder.

TG1 Ghetto One · Sep 25, 2005

Illuminattile said:

Thanks man for real that has helped alot, repped but the main ting im tryin to get rid of is still here man its real nasty, its come up as a different name aswell for the same file this aswell in a different spyware remover: W32/DLoader.HPY it says its a trojan man is there anychance ya could help me out anymore? thanks in advance

Illuminattile · Sep 25, 2005

Do you have an anti-Trojan? There are two free anti-trojans in the Knowledge Base. Download and run either of those.

You can try using KillBox to delete the file, see if that works. Select Replace on Reboot and check the box marked Use Dummy.

Also download and run Hijackthis (also available in the Knowledge Base) and post the log in this thread or the Hijackthis Log thread.

TG1 Ghetto One · Sep 25, 2005

i tried with that killbox ya gave me and this is what it said when it tried to remove it: "PendingFileRenameOperations Registry Data has been Removed by External Process!" (thats it word for word and how its spaced and lettered) and here's my hijack log file hope ya can help me out thanks

Logfile of HijackThis v1.99.1
Scan saved at 22:50:13, on 24/09/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\blueyonder\PCguard\fws.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\blueyonder\PCguard\RPS.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Valve\Steam\Steam.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\Program Files\blueyonder IST\bin\mpbtn.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Python\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.vroomsearch.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
R3 - URLSearchHook: (no name) - {0F8070D2-25E7-F6A0-CC81-24B490B47214} - MNTP.dll (file missing)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\iyspk.dll (file missing)
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\blueyonder\PCguard\pkR.dll
O2 - BHO: C:\WINDOWS\adsldpbc.dll - {405132A4-5DD1-4BA8-A181-95C8D435093A} - C:\WINDOWS\adsldpbc.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\blueyonder\PCguard\FBHR.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: C:\WINDOWS\q2860921_disk.dll - {B212D577-05B7-4963-911E-4A8588160DFA} - C:\WINDOWS\q2860921_disk.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\iyspk.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [hsgcgqqtysp] C:\WINDOWS\System32\xehrzy.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ExchangeMaster] MONITER.exe
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\blueyonder\PCguard\RPS.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [muiz] C:\PROGRA~1\COMMON~1\muiz\muizm.exe
O4 - Global Startup: blueyonder Instant Support Tool.lnk = C:\Program Files\blueyonder IST\bin\matcli.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .au: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F3EE0D4-76F0-41BB-88E2-0811A7A232B1}: NameServer = 69.50.177.203,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{4354E14D-86EA-4B79-B04D-7DD5C607DBB5}: NameServer = 69.50.177.203,85.255.112.24
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\q2860921_disk.dll
O23 - Service: Video Card Clock Rate Manager (Actmovie) - Unknown owner - C:\WINDOWS\security\cookies\rsvsp.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Documents and Settings\Python\Desktop\cwshredder.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - C:\Program Files\blueyonder\PCguard\fws.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Illuminattile · Sep 25, 2005

TG1 Ghetto One said:

Restart manually and it should remove it. Hopefully.

Remove the following, in Safe Mode.

Do you know what:

Is? Unknown program, making me think the file name is randomly generated. If so, it's probably malicious.

TG1 Ghetto One · Sep 25, 2005

Ive done it man its still here, do you think its gonna be one of them one's where i have to wipe my hard drive to get rid of it?, aight ill delete em in safe mode shall i use to remove them, hijackthis?, naa i dont know what that file is myself but the main malicious file i was talking about you jus put it in the list to remove in safe mode so it might be safe but if ya need further info let me know

TG1 Ghetto One · Sep 25, 2005

Yo i done what ya said in safe mode and i deleted all of em except for this one:

O20 - Winlogon Notify: style32 - C:\WINDOWS\q2860921_disk.dll

i swear its drivin me nuts now i can jus see it there but it wont go away man do ya think there's anychance of this goin?

Illuminattile · Sep 25, 2005

Don't despair, still got a few tricks up my sleeve.

Boot into Safe Mode
If you're using XP, turn off System Restore (Control Panel>System)
Find winstyle2.dll in the C:\Windows\System32 or C:\Winnt\System32 folder and delete it
Open notepad and paste the following into it;

cd %windir%
attrib -s -r -h q3685796_disk.dll
del q3685796_disk.dll

Save the file as Test.bat

Double click Test.bat.

Open a new file in notepad and paste the following into it;

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\CLSID\{6AC3806F-8B39-4746-9C38-6B01CB7331FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\style2]
[-HKEY_CURRENT_USER\Software\Microsoft\style2]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AC3806F-8B39-4746-9C38-6B01CB7331FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\style32]
[-HKEY_CURRENT_USER\Software\Microsoft\style32]

Save the file as Fix.reg

Double click Fix.reg and select Yes.

Reboot normally.

TG1 Ghetto One · Sep 25, 2005

I couldnt find winstyle2.dll so i couldnt get rid of that, and this is what happened when i clicked yes on the registry file ya told me to create: "Cannot import C:\DOCUME~1\Python\Desktop\Fix.reg: The specified file is not a registry script.
You can only import binary registry files from within the registry editor"

i also tried goin on registry editor then clickin import then clickin on Fix.reg and it said: "Cannot import C:\Documents and settings\Python\Desktop\Fix.reg: The specified file is not a registry file.
You can only import registry files"

Illuminattile · Sep 26, 2005

Find those keys in the registry editor and delete them manually.

TG1 Ghetto One · Sep 26, 2005

Ive done that now and i ran another scan of hijack this jus for measures and i found out this: it says it doesnt actuallly delete the file it jus deletes the registry value and registry key in there, now the file has stayed but in the registry edit files i cant find the file so i think it has worked but my anti virus software still picks up the file as if it still has the virus and i still get warnings that spyware activity is going on (i only recieved these warnings when i got the virus) so is it jus saying this cause the file remains on my computer or is it still running? thanks for ya time

Illuminattile · Sep 27, 2005

Can you delete the file now, or does it still say it's in use?

TG1 Ghetto One · Sep 27, 2005

It says its still in use

TG1 Ghetto One · Sep 27, 2005

Yo man try and help me out soon cause my msn's started playin up since now aswell im sendin msgs but no ones replyin and it keeps sayin the msg failed to reach em :|

Technology Need Help Fast

TG1 Ghetto One

New Member

Illuminattile

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

TG1 Ghetto One

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

Illuminattile

New Member

TG1 Ghetto One

New Member

TG1 Ghetto One

New Member

Latest posts

Donate

Members online