Lots of the regular posting anti-malware experts on this board have moved to pastures new for various reasons. You may find it better to find another support site to assist you.
Please go to this link and choose one of the websites on the left of the page.
Alliance of Security Analysis Professionals As you can see they all work together in cleaning malware (Virus, Spyware and adware).
To help you choose from that list
Net-Intergration is the support site of Spybot S&D.
Lavasoft Support is the support site of Ad-aware.
TomCoyotes contains the anti-malware school - Classroom.
SpyWareInfo contains the anti-malware school - BootCamp.
Wilders Security has since stopped hijackthis log support due to the lack of experianced helpers.
Others that I would recommend Zerosrealm, Subratam.org, SpyWare BeWare and ComputerCops, but generally all those on that list will have experts to help you.
Texruss and myself are Teachers at The TomCoyote Forum.
There are still some knowledgable people left posting here at Dell, so you may still get help from them.
I wish you all the best at getting your computer clean.
C:\Documents and Settings\W. Derek Shakabpa\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe Please install hijackthis in its own folder such as c:\hjt to preserve its backups.
Reboot to safe mode: Delete C:\WINDOWS\System32\oornuqg.exe <=== file C:\Program Files\Web_Rebates <=== folder C:\WINDOWS\Downloaded Program Files\bridge.dll <=== file C:\documents and settings\w. derek shakabpa\local settings\temp\a.exe <== file (best course of action here is to clean the entire temp folder if you are not saving anything in it.)
Also empty your temporary internet files folder.
Reboot, post a new log.
I don't have much time for this anymore, but will try to check back tomorrow.
If you have not done so, would also suggest learning about and using spybot and cwshredder. You can find tutorials at bleepingcomputer.com
Trendmicro and pandasoft have good online virus scans. Because I'm not sure whether that random named file was adware or trojan related, I would also suggest running one of those as a precautionary measure if the steps above get you back online.
Here is my latest Hijack This log. I haven't experienced any web browser hijackings yesterday but Adaware did find 43 malware objects to remove. Any advice?
ChrisRLG
3.9K Posts
0
August 5th, 2004 18:00
Please go to this link and choose one of the websites on the left of the page.
Alliance of Security Analysis Professionals
As you can see they all work together in cleaning malware (Virus, Spyware and adware).
To help you choose from that list
Net-Intergration is the support site of Spybot S&D.
Lavasoft Support is the support site of Ad-aware.
TomCoyotes contains the anti-malware school - Classroom.
SpyWareInfo contains the anti-malware school - BootCamp.
Wilders Security has since stopped hijackthis log support due to the lack of experianced helpers.
Others that I would recommend Zerosrealm, Subratam.org, SpyWare BeWare and ComputerCops, but generally all those on that list will have experts to help you.
Texruss and myself are Teachers at The TomCoyote Forum.
There are still some knowledgable people left posting here at Dell, so you may still get help from them.
I wish you all the best at getting your computer clean.
cghost
302 Posts
0
August 5th, 2004 20:00
Suggestions for your hijackthis log.
C:\Documents and Settings\W. Derek Shakabpa\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
Please install hijackthis in its own folder such as c:\hjt to preserve its backups.
Run hijackthis with browser windows closed, tick to fix:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://bigbr.cc?u=1538 (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lfnmcjw.biz?u=1526 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://bigbr.cc?u=1538 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lfnmcjw.biz?u=1526 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://bigbr.cc?u=1538 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://bigbr.cc?u=1538 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://bigbr.cc?u=1538 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://bigbr.cc?u=1538 (obfuscated)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O4 - HKLM\..\Run: [fbbjfhes] C:\WINDOWS\System32\oornuqg.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: C:\documents and settings\w. derek shakabpa\local settings\temp\a.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O13 - Home Prefix: http://%6C%66%6E%6D%63%6A%77%2E%62%69%7A?u=1526&error=
O13 - Mosaic Prefix: http://%6C%66%6E%6D%63%6A%77%2E%62%69%7A?u=1526&error=
If you are familiar with these two and satisfied they're ok, leave them, otherwise remove them.
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak02.pictures.aol.com/ygp/aol/plugin/download/YGPPicDownload.9.0.0.2.cab
Reboot to safe mode:
Delete
C:\WINDOWS\System32\oornuqg.exe <=== file
C:\Program Files\Web_Rebates <=== folder
C:\WINDOWS\Downloaded Program Files\bridge.dll <=== file
C:\documents and settings\w. derek shakabpa\local settings\temp\a.exe <== file
(best course of action here is to clean the entire temp folder if you are not saving anything in it.)
Also empty your temporary internet files folder.
Reboot, post a new log.
I don't have much time for this anymore, but will try to check back tomorrow.
If you have not done so, would also suggest learning about and using spybot and cwshredder.
You can find tutorials at bleepingcomputer.com
Trendmicro and pandasoft have good online virus scans. Because I'm not sure whether that random named file was adware or trojan related, I would also suggest running one of those as a precautionary measure if the steps above get you back online.
Regards.
Shakabpa
8 Posts
0
August 6th, 2004 14:00
Here is my latest Hijack This log. I haven't experienced any web browser hijackings yesterday but Adaware did find 43 malware objects to remove. Any advice?
Thanks.
C:\WINDOWS\System32\oornuqg.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\W. Derek Shakabpa\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O4 - HKLM\..\Run: [fbbjfhes] C:\WINDOWS\System32\oornuqg.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Microsoft® JavaScript® Console (HKLM)
O9 - Extra 'Tools' menuitem: JavaScript Console (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Microsoft® JavaScript® Console (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console (HKCU)
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37889.9302199074
O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak02.pictures.aol.com/ygp/aol/plugin/download/YGPPicDownload.9.0.0.2.cab