Amaena/Winfixer Problems

Question

I've been trying to remove this pop-up virus for a few days now, using various methods I've read about on the net but pop-ups for Amaena, Winfixer, and other various things(casinos/other spyware ads) still keep coming up.   I've tried Vundofix and it found something the first time, but hasn't found anything since. Here's the log for Vundo: VundoFix V4.2.72 Checking Java version... Sun Java not detected Scan started at 4:00:29 PM 4/26/2006 Listing files found while scanning.... C:\WINNT\system32\byxvv.dll  Attempting to delete C:\WINNT\system32\byxvv.dll C:\WINNT\system32\byxvv.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V4.2.72 Checking Java version... Sun Java not detected Scan started at 4:08:16 PM 4/26/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.72 Checking Java version... Java version is 1.5.0.6 Scan started at 2:36:10 AM 4/27/2006 Listing files found while scanning.... No infected files were found.   I've tried Ewido and it's found viruses and fixed them, but not this one. Spyware doctor did the same.   I just can't find the file that's causing the problem! I did a search for byxvv.dll that Vundo found and couldn't remove and found nothing. I've got my eye on a file called gebay.dll that seems very supisous to me, but I'm not sure. Here's my HijackThis log: Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINNT\system32egsvc.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\Tablet.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Wacom\TabUserW.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\julie\My Documents\hijackthis\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareUpdater.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoomail.com/ O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2	ools\iesdsg.dll O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2	ools\iesdpb.dll O2 - BHO: (no name) - {DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60} - C:\WINNT\system32\gebay.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [projselector] 'C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe' -r O4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe' O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe' O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe' O4 - HKLM\..\Run: [NAVtask] NAVtask.exe O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Spyware Doctor (HKLM) O9 - Extra button: Share in Hello (HKLM) O9 - Extra 'Tools' menuitem: Share in H&ello (HKLM) O9 - Extra button: Real.com (HKLM) O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: DigiChat Applet - http://albany.digi-net.com/DigiChat/DigiClasses/Client_IE_5_0_1_7.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146082374938 O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/1452/ftp.coupons.com/r3302/cpbrkpie.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38295.1723958333 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 O17 - HKLM\System\CCS\Services\Tcpip\..\{C0669406-1371-40CB-9A08-0BF54A36E06E}: NameServer = 205.152.37.23 205.152.132.23       Anyone know what's causing the problem and what I should do?

ky331 · Answer

1) you 'chopped-off' the top line of your HJT log, which indicates what version of HJT you were running...   was it the current version (1.99.1)??  because it 'appears' older to me.   if you were running any version other than 1.99.1, you need to upgrade to this version.   2) the  gebay.dll  is indeed vundo... so i have to wonder why vundofix didn't catch it.... unless this file 'entered' your system after you ran vundofix?   please run vundofix again.   then immediately generate a brand-new HiJackThis log (version 1.99.1).  please start a new thread, and post both logs in the HiJackThis forum, here:   http://forums.us.dell.com/supportforums/board?board.id=si_hijack Message Edited by ky331 on 05-01-200603:18 PM

formated · Answer

The easiest way to remove it? Download the Trial Software (You may get the licensed if you want) of Panda Antivirus + Anti Spyware. Install it and do a thorough scan on your computer. Complete and detailed instructions here.

Virus & Spyware

Was this post helpful?