hijacked log file

The entry: O4 - HKLM\..\Run: [Config33.exe] Config33.exe is a virus. More info as well as removal help can be found here: http://nts.jhu.edu/alerts/alert.detail.cfm?aid=307

I can't find any info on the entry O4 - HKLM\..\Run: [B03F8FF5] C:\WINDOWS\System32\heqkjubfza.exe. Can someone else advise? I believe it may be a virus, since there is no legit information that I can find.

Try running an anti-virus program if you have one installed. If you don't have one, consider purchasing Norton or McAfee, or try AVG Anti-virus for free from http://www.grisoft.com.  Be sure the virus definitions are up to date.

I also suggest getting Lavasoft's Ad-Aware and Spybot Search and Destroy. Once you download, get the software updates, then scan your system.

Good luck...hope this helps!

Warning! Unsafe Hijackthis folder! Please create a new folder named HJT in the first level of the C: drive. Copy or move the hijackthis executable file into the HJT folder and delete all other zip copies and extracted copies elsewhere.

See FAQ's 2,3,4 at http://russelltexas.com/malware/faqhijackthis.htm


Run Hijackthis, scan and check the box left of these numbered line items:

O4 - HKLM\..\Run: [Config33.exe] Config33.exe
O4 - HKLM\..\Run: [B03F8FF5] C:\WINDOWS\System32\heqkjubfza.exe
O4 - HKLM\..\RunServices: [Config33.exe] Config33.exe
O4 - HKLM\..\RunServices: [B898E535] C:\WINDOWS\System32\heqkjubfza.exe

With no other windows open click on fix checked button in Hijackthis.

Exit Hijackthis.

Reboot to SAFE MODE and Show HIDDEN FILES and folders  (VERY IMPORTANT!)

FAQ 8 and 9 on this page: http://www.russelltexas.com/malware/faqhijackthis.htm

Open Windows Explorer: type the word explorer at Start/Run box and click OK:

Drill on down and delete the following files:

C:\WINDOWS\System32\Config33.exe
C:\WINDOWS\System32\heqkjubfza.exe

Download and run these two programs (Spybot S&D and Adaware) at the link below. Use Spybot first.

Most of the baddies you have can be killed by a one-two punch with Spybot and Adaware assuming these three factors are achieved:

1. Latest version
2. Configured correctly for running options
3. New definitions from update feature

Chris has posted an excellent tutorial by dgosling on how to run Spybot S&D and also how to enable customized deep scanning functions for Adaware. Once you set these options they will be retained for future scans by Adaware.

Follow the directions in this detailed guide for Spybot and Adaware...print out the directions in the custom scan tutorial as a reference while you set these options for the custom setup of Adaware. These custom settings will be retained for future custom scans so don't go nuts thinking you have to do this every time you run it! It may take you five minutes to set them up, but it's worth it.

http://www.cjwd.demon.co.uk/spybot-adaware.html

Please note the free Spybot 1.3 does have a slight bug...it detects some DSO exploits falsely. Hopefully an upgrade will fix this.The problem is not serious and should not deter people from using Spybot.

I also like to run Windows Disk Cleanup after cleaning with those two tools. Make sure you reboot if any reboot cleanup functions of Spybot and Adaware are advised by these tools (this may happen at the end of their cleanup).

Run Disk Cleanup: type cleanmgr at Start/Run. Scan all hard drives and check all categories at the end and click OK.

If you have any problems with Disk Cleanup completing...XP users can fix it here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;812248


Reboot and browse a bit, exit IE, and post a new Hijackthis log.

Special comments:

All the best,

Texruss
www.russelltexas.com
Spyware Fighter Wilders Forum
Slyware Warrior Tom Coyote Forum
Expert Malware Responder Dell Forum

Please be aware only the following DellForum members were trained at
TomCoyote.com and SpywareInfo.com to help with Hijackthis logs: Texruss,
Baskar1234, Grinler, ChrisRLG, SpotCheckBilly, and pskelley. (If you are
one of our classmates and not on this list email me for an addition to this
list...we need all the help we can get *;-)

I did everything you said until I got to Reboot safe mode and I do not know where that is.

Please advise

FAQ 8 and 9 on this page:

http://www.russelltexas.com/malware/faqhijackthis.htm

HTH,

Texruss

I am new at computers, so I do not understand some things.  I got to the line where you told me to type in explorer and My Documents came up.  (is this correct)  Then I went to My computer and C drive.  I could not drill down and delete the 2 files you told me to delete, because I could not find them.  Please advise. 

I went to search and it found the file C\WINDOWS\System32\Config33.exe but it would not let me delete it.  I never did find the file that ended with "heqkkjubfza.exe"

I also did download and run Spybot and Adaware.  The problems it wants to fix that are red are DSO   3 entries.  Each time I run it this same message about DOS comes up.

>I went to search and it found the file C\WINDOWS\System32\Config33.exe but it would not let me delete it. 

Hit Control-Shift-Escape keys at same time (In Safe Mode). Stop the process config33.exe. Then delete it in Windows Explorer. If it still resists right button click on it and left button on Properties. Remove checkmark for ReadOnly and delete.

>I also did download and run Spybot and Adaware.  The problems it wants to fix that are red are DSO   3 entries.  Each time I run it this same message about DOS comes up.

False alerts in Spybot...I was hoping the new update from 6-23-04 would solve that, but it's still doing the same on mine...most folks get 5 false DSO's.

All the best,

Texruss
www.russelltexas.com
Spyware Fighter Wilders Forum
Slyware Warrior Tom Coyote Forum
Expert Malware Responder Dell Forum

Please be aware only the following DellForum members were trained at
TomCoyote.com and SpywareInfo.com to help with malware like viruses, worms, adware, scumware, foistware and crudware in general. They are also the only experts specifically trained to analyze and advise on Hijackthis logs: Texruss, Baskar1234, Grinler, ChrisRLG, SpotCheckBilly, and pskelley. (If you are one of our classmates and not on this list email me for an addition to this list...we need all the help we can get *;-)

Thanks so much, I did get it deleted,  but the message came up that some programs may not work right if I did so.  Hope this does not happen.

> did get it deleted,  but the message came up that some programs may not work right if I did so.  Hope this does not happen.

You don't want those kinds of programs loading. *;-)

Post a fresh log so I can check and see how you're doing.

Texruss