Help Please !!!Serious Virus

[thejones]

Still a no go with Explorer. No object show.

 

[pskelley]

click Post Reply then look for manage attachments. Attach it as a txt if you can:bigthumb:

I do not understand what this means:

Still a no go with Explorer. No object show.

could you explain.

 

[thejones]

When I open Internet Explorer only the background shows. The text and objects don't load. My home site is msn.com...only the blue background shows up. So when i go to the KAV site only the whit background show and no text or buttons.

The message I was getting "mobsync.dll" has gone away after running Combo fix.

The combo fix txt. file size is 85k do you want me to load it in pieces. On the forum. It won't load through the manager.

thanks

 

[pskelley]

zip the file and attach it, allows 97.7 KB's

Internet Explorer 6.0 try some of these ideas

http://windowsxp.mvps.org/IEFIX.htm

http://www.microsoft.com/windows/IE/community/columns/IEtopten.mspx

http://support.microsoft.com/kb/318378/en-us

Thanks

 

[thejones]

I have the zip and I will load a fresh HJT. I figured out that the virus activated my active desktop and that was the embedded object in my wallpaper. I have turned it off. I think it is manipulating setting in my explorer so I will look at those. Do I need to re-run any processes because the active desktop was on when i was running combofix...ect?

thanks


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:22, on 2008-01-23
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Trend Micro\HijackThis\tj.exe.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130851107539
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe

--
End of file - 3360 bytes

 

[pskelley]

These files are all the same size and were created on the same date, and do not idenify with Google. I want you to use one or more of these free online scanners to scan the files. If they scan bad, delete them.
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustotal.com/
I believe they are bad, but we must be sure.

C:\WINNT\system32\knjcbuek.exe
C:\WINNT\system32\mfipmhfs.exe
C:\WINNT\system32\sfjeqmjm.exe
C:\WINNT\system32\adfqnokk.exe
C:\WINNT\system32\felbadol.exe
C:\WINNT\system32\hgmjekfg.exe
C:\WINNT\system32\msnyrmyd.exe
C:\WINNT\system32\pobuaejt.exe

Make sure you empty the recycle Bin and restart the computer once that is done.

Have you been able to resolve the issue with Internet Explorer?

I need a report on how the computer is running.

Thanks

 

[thejones]

It seems like they are all clean. The computer is much better now. No more pop ups. Explorer is still the same. No text or objects just background. It says that it is downloading them but the never appear. It just says "done" at the end. I sure it is a setting but I can't figure out which one would control that.

 

[pskelley]

Explorer is still the same.

Did you try the suggestions I posted in Post#24? You can also ask for help here:
http://support.microsoft.com/

This information may or may not apply to your Operating System:
Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

 

[thejones]

thanks for all the help, I appreciate it greatly....I have an xp machine that is running very slow. Can you take a look at it or do I have to start a new thread?

 

[pskelley]

You are sure welcome:bigthumb: take a look at this information I posted already for a slow computer:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html

If that does not take care of your problem, then please start a new topic.

Thanks...Phil