Grrr How Do I Remove This Damn Virus


clarky2o2o posted on Sep 23 2006 at 12:10 PM said:
this is driving me nuts it wont go away and avast! wont pick it up.
This is a Worm virus, and to remove worms, follow the instructions here.
 
Last edited by a moderator:
Getting rid of Windows is the easiest way. :rolleyes:


But on a more serious note, here's the manual removal method:

Clean registry entries:

HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_msdirectx
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_msdirectx\0000
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\msdirectx


Remove files:

33b5639845c459eb37100da24f9c972c-image0088.com
4d39ac80f6fbdbb13a0ab7b94b121f00-picture043.com
lockx.exe
lockx10.exe
lockx11.exe
lockx12.exe
lockx2.exe
lockx3.exe
lockx4.exe
lockx5.exe
lockx7.exe
lockx8.exe
c:\xz.bat
[user profile dir]\.gtk-bookmarks
[Windows dir]\system32\lockx.exe

http://www.spyware-removal-guideline.com/b...mbot-aj-removal
 
none of them worked :( now my laptops slowed to a crawl has trouble with playing mpegs at 50% (and these are 352x240)/ I know celerons (2.8ghz) are slower than pentiums but my 450mhz amd k6 runs faster :angry:
 
get yourself killbox and hijackthis. These are programs you will need. Hijackthis will show you all the programs that are run on bootup and during your session. Also processes like dlls will be shown. Then you will need to look what processes are well known, what processes could be infected and which one are clearly the worm in disguise.

With Killbox, you can then try to stop those processes from running and reproducing. Then you can delete them. if that doesn`t work, there are more ways to do it manually. Post the log that Hijackthis gives you here and I will guide you through the disinfection process.
 
i have hijack this ill try it it later as for spybot thats like 1 of the 1st programs i install lol.

i didnt like avg so i stuck with avast!
 
most of the latest worms for winXP are pretty hard to remove and I haven`t found a program or antivirus program that can actually find them or even remove them successfully. It is easier to do semi-manually.
 
Spybot Search and Destroy is a nice program, especially since it is freeware. It didn`t solve alot of problems though. I tested several programs parallel and it seems like each program only finds certain worms and virii. Also lots of programs that were said to be able to remove a worm didn`t have any effect. They did find the worm, and seemingly they also removed it but then after reboot, the virus was back in place. Actually lots of people recommend to wipe the complete windows installation and install again because a lot of worms will infect system files that cannot be disinfected easily..
 
unofrtunatly i lot both my xp cd's (duh!!!) so i dont want to format it just yet. my hijack this log is below.

Logfile of HijackThis v1.99.1
Scan saved at 04:40:27, on 9/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\WifiService.exe
C:\WINDOWS\system32\MrobeService.exe
c:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
c:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\AdventNet\ME\WiFiManager\mysql\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\WLAN\802.11b+g USB WLAN\ZDWlan.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\hijack this\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi...arch.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.compuserve.co.uk/search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.compuserve.co.uk/search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKLM\..\RunServices: [mouse] mouse.exe
O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe
O4 - Global Startup: 802.11b+g USB Wireless LAN Utility.lnk = C:\Program Files\WLAN\802.11b+g USB WLAN\ZDWlan.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: GetitAll - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} - C:\WINDOWS\System32\GetitAll (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155984560964
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155984538654
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: ManageEngine WiFiManager 4 (ManageEngine WiFiManager Service) - Unknown owner - C:\WINDOWS\WifiService.exe
O23 - Service: MrobeService - OLYMPUS IMAGING CORP. - C:\WINDOWS\system32\MrobeService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - c:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - c:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - c:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: IrBridge User-Level Interface (USRBRIDG) - Extended Systems, Inc. - C:\WINDOWS\system32\usrbridg.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
 
Okay, here is a list with all the entries in the registry and files that you need to get rid of. They are fake and hosts to the virus. You can get rid of them by starting into the safe mode and using killbox to terminate the processes and then delete the files. Also make sure you get rid of the registry keys that they made. If the files cannot be deleted, make a batch file that deletes all the files, and use a windows XP cd to boot into repair mode with a console. Then you can execute the batch file and wipe those files off your disk.

Also, have a look at those files:

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

They are drivers for your touchpad. These drivers are apparently known to cause severe slowdowns. You can safely deinstall them, your touchpad will still run with default drivers. Make sure that you have a backup of those drivers somewhere, and then try if that makes your computer any less sluggish.

Also I couldn`t find any traces of that so called "Aimbot"... I think that maybe a misinterpretation of your virus scanner.


-----------------------------------------------------------------------------------------------


O4 - HKLM\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe <---- this is a worm (W32/Sdbot-ADC). You should get rid of that registry key...


------------------------------------------------------------------------------------------------

this is where the keys of that worm are located:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Compaq32 Service Drivers
msconfig32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Compaq32 Service Drivers
msconfig32.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Compaq32 Service Drivers
msconfig32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Compaq32 Service Drivers
msconfig32.exe

-----------------------------------------------------------------------------------------

O4 - HKLM\..\RunServices: [mouse] mouse.exe
Also part of the worm... Sdbot-AAF this time. delete those registry keys and locate the files and kill them.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mouse
mouse.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
mouse
mouse.exe

Folgende Registrierungseinträge werden erstellt:

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1





O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm

this is a spyware infected program. Delete the DAP folder.

---------------------------------------------------------------------------------------

O23 - Service: ManageEngine WiFiManager 4 (ManageEngine WiFiManager Service) - Unknown owner - C:\WINDOWS\WifiService.exe

this is weird. If you know that process and can verify that it is a WiFi manager, it`s probably legit.

---------------------------------------------------------------------------------------

EDIT: Oh, yeah, just to clarify... if there is a filename in the suspicous registry keys, you will need to delete the key and the files aswell...

hack away!
 
:D yay near full speed video.

I got another problem i never known how exactly to put it in words so imade a small video (1.3mb MPG) of the error. I apologise for the bluring i used the camera in my phone.


DirectX problem

Eats up all my memory.
 
What is that? Anyway, did you succeed to remove the virus?
 
ahh did i not say that is the spinning direct X logo (dxdiag) at its slowest spin.


as for the worms and slowdown seems to of gone and its back to running fast thanks.
 
cool. that`s good to hear, so my "analasys" actually helped... yeah that direct X thing seems to be quite screwed up. Maybe try reinstalling your graphics driver? The latest version would be a good idea.
 
xnopasaranx posted on Oct 1 2006 at 05:17 PM said:
cool. that`s good to hear at so my "analasys" actually helped... yeah that direct X thing seems to be quite screwed up. Maybe try reinstalling your graphics driver? The latest version would be a good idea.


yup tried that.

tried using old drivers & new drivers
uninstalling it then reinstalling.
tried fresh install of direct x9c.

with the install of DX9c the error somtimes disapear for like a day or too then it comes back making games like gta3 run at around 2 frames a second.
 
Last edited by a moderator:
damn. that is pretty nasty. Might be that your gpu is just plainly broken. Maybe you can borrow a graphicscard of a friend and check if that will work better. Then you at least know it`s not some directx problem. Probably would be good to test your graphics card on somebody elses computer to see if it f`s up there, too
 
Back
Top