- Double-click VundoFix.exe to run it.
- Click the Scan for Vundo button.
- Once the scan is complete, Right Click inside the listbox (white box) and click add more files
- Copy&Paste the 2 entries below into the top 2 boxes
- C:\WINDOWS\system32\ekgzipi.dll
- C:\WINDOWS\system32\ipizgke.*
- Click Add Files and Click Close Window
- Repeat with these entries
- C:\WINDOWS\system32\ggvsmlg.dll
- C:\WINDOWS\system32\glmsvgg.*
- C:\WINDOWS\system32\tdblxbe.dll
- C:\WINDOWS\system32\ebxlbdt.*
- C:\WINDOWS\system32\lhmzmq.dll
- C:\WINDOWS\system32\qmzmhl.*
- C:\WINDOWS\system32\ziccdrj.dll
- C:\WINDOWS\system32\jrdcciz.*
- C:\WINDOWS\system32\wgbyiwn.dll
- C:\WINDOWS\system32\nwiybgw.*
- C:\WINDOWS\system32\zohvrse.dll
- C:\WINDOWS\system32\esrvhoz.*
- C:\WINDOWS\system32\ztkmged.dll
- C:\WINDOWS\system32\degmktz.*
- C:\WINDOWS\system32\hvjtihd.dll
- C:\WINDOWS\system32\dhitjvh.*
- C:\WINDOWS\system32\qebuxwnx.dll
- C:\WINDOWS\system32\xnwxubeq.*
- C:\WINDOWS\system32\xnpgxm.dll
- C:\WINDOWS\system32\mxgpnx.*
- C:\WINDOWS\system32\qjwgdrd.dll
- C:\WINDOWS\system32\drdgwjq.*
- C:\WINDOWS\system32\ccc3.dll
- C:\WINDOWS\system32\3ccc.*
- C:\WINDOWS\system32\vopnzag.dll
- C:\WINDOWS\system32\gaznpov.*
- C:\WINDOWS\system32\neizojg.dll
- C:\WINDOWS\system32\gjozien.*
- Click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will reboot your computer, click OK.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from
Click the Scan for Vundo button when VundoFix appears at reboot.
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
- Install AVG Anti-Spyware by double clicking the installer.
- Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
- On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
- Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. Don't run AVG yet. Will do it a bit later.
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Don't run ATF yet. Will do it a bit later.
Remove thru add/remove programs (if found):
My Web Search (or something similar)
Error Nuker
Start hjt, click do a system scan only, check:
O2 - BHO: (no name) - {05AA754E-35FA-FDCF-F0C6-02CBD2EF7953} - C:\WINDOWS\system32\ekgzipi.dll
O2 - BHO: (no name) - {075CA83D-FDEC-D1F0-8CC4-06B3BD7DF97C} - C:\WINDOWS\system32\ggvsmlg.dll
O2 - BHO: (no name) - {0902BEBD-A638-D767-9C24-03D7FE29622D} - C:\WINDOWS\system32\tdblxbe.dll
O2 - BHO: (no name) - {14A714F9-F11A-9622-85CD-06DF6A39C544} - C:\WINDOWS\system32\lhmzmq.dll
O2 - BHO: (no name) - {248D8ED0-2897-63D2-D555-0A35EE90CFA6} - C:\WINDOWS\system32\ziccdrj.dll
O2 - BHO: (no name) - {2E12C9DF-39EE-353F-CF7A-0B0DD5174E44} - C:\WINDOWS\system32\wgbyiwn.dll
O2 - BHO: (no name) - {2E887CAB-8390-4BBF-B4B9-E5796266346D} - C:\WINDOWS\system32\gebcy.dll (file missing)
O2 - BHO: (no name) - {35D3810F-5636-A7C1-51F1-07E019A89F67} - C:\WINDOWS\system32\zohvrse.dll
O2 - BHO: (no name) - {3E508C18-4B6C-AA38-7C37-015C60582AF2} - C:\WINDOWS\system32\ztkmged.dll
O2 - BHO: (no name) - {59B956DE-8B06-A767-A9F8-09C7EE3966EC} - C:\WINDOWS\system32\hvjtihd.dll
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\qebuxwnx.dll
O2 - BHO: (no name) - {5EAAAD19-AFC2-45B3-B15C-44BD9A0BB424} - C:\WINDOWS\system32\jkhfd.dll (file missing)
O2 - BHO: (no name) - {6CDBBA58-25ED-D768-1E27-0B45FA88BF39} - C:\WINDOWS\system32\xnpgxm.dll
O2 - BHO: (no name) - {71D93778-31D9-F7A2-321C-04BD4EEE6E4A} - C:\WINDOWS\system32\qjwgdrd.dll
O2 - BHO: RdTasker - {73E0DDC2-A93A-4D64-97B5-646627F61DD2} - C:\WINDOWS\system32\ccc3.dll
O2 - BHO: (no name) - {745B4715-CFAE-9023-C49A-08061C46B4A5} - C:\WINDOWS\system32\vopnzag.dll
O2 - BHO: (no name) - {76253FF7-A828-08C3-4792-0B03AEDE12F8} - C:\WINDOWS\system32\neizojg.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E57AE6A3-C900-4C48-AAF1-7BA94730E98F} - C:\WINDOWS\system32\geedb.dll (file missing)
O2 - BHO: (no name) - {ECC0A5E9-68BD-4223-BCD4-6061BF347ED8} - C:\WINDOWS\system32\awvvs.dll (file missing)
O2 - BHO: (no name) - {F1D0758E-4218-42A7-B369-2FBEFAE618BA} - C:\WINDOWS\system32\ddcyw.dll (file missing)
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [hozihatk.exe] C:\Documents and Settings\All Users\Application Data\hozihatk.exe
O4 - HKLM\..\Run: [gtcfaxaz.exe] C:\Documents and Settings\All Users\Application Data\gtcfaxaz.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZS
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/shockwave/polarbowler/install.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/popinsaniquarium/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{14C70953-49E0-4DF2-867E-53AF08976851}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\..\{8947A532-9C99-4F92-94A9-0B21B3B1B87B}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AF3BDCC-F46C-4958-8D2A-A82C8E35C903}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15
O17 - HKLM\System\CS1\Services\Tcpip\..\{14C70953-49E0-4DF2-867E-53AF08976851}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15
O17 - HKLM\System\CS2\Services\Tcpip\..\{14C70953-49E0-4DF2-867E-53AF08976851}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15
O20 - Winlogon Notify: awvvs - C:\WINDOWS\system32\awvvs.dll (file missing)
O20 - Winlogon Notify: ddcyw - C:\WINDOWS\system32\ddcyw.dll (file missing)
O20 - Winlogon Notify: gebcy - C:\WINDOWS\system32\gebcy.dll (file missing)
O20 - Winlogon Notify: geedb - C:\WINDOWS\system32\geedb.dll (file missing)
O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll (file missing)
O20 - Winlogon Notify: opnkkhf - opnkkhf.dll (file missing)
O23 - Service: vwservice - Unknown owner - C:\WINDOWS\system32\vwsrv.exe (file missing)
Close browsers and other windows. Click fix checked.
Creating & executing batch file
-------------------------------
Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop. (If you are still unsure on how to do this there is a little tutorial with pictures here)
@echo off
sc stop vwservice
sc delete vwservice
Double-click on fixes.bat file to execute it.
Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Delete if found (in safe mode if needed):
C:\Documents and Settings\All Users\Application Data\hozihatk.exe
C:\Documents and Settings\All Users\Application Data\gtcfaxaz.exe
C:\Program Files\Error Nuker <-- folder
C:\Program Files\MYWEBS~1 <--folder (~ means that folder name begins with MYWEBS)
C:\WINDOWS\system32\vwsrv.exe
Running temp cleaner & AVG Anti-Spyware
---------------------------------------
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
- Click on Scanner on the toolbar.
- Click on the Settings tab.
- Under How to act?
- Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
- All checkboxes should be ticked.
- Under Possibly unwanted software:
- All checkboxes should be ticked.
- Under Reports:
- Unselect Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
- Select Scan every file.
- Under How to act?
- Click on the Scan tab.
- Click on Complete System Scan to start the scan process.
- Let the program scan the machine.
- When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the
Save Scan Report
button before you did hit the
Apply all Actions
button.- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
- When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Post
-contents of c:\vundofix.txt
-AVG Anti-Spyware log
-a fresh HJT log.
:
).