Persistant Page Popups

Persistant Page Popups
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Persistant Page Popups Scorchar 02-14-2007
Posted by Scorchar on February 14, 2007, 2:55 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I use WinXP SP2 with all updates inc IE7

This is an example of what's been happening for weeks:
- Startup
- call Google with IE7 (Firefox 2 responds the same way)
- search for "convert flac to mp3" (I don't need help with that search)
- select www.mymusictools.com & the expected page opens
- 2 other pages also open: www.amaena.com & www.smartaudioconverter.com
- I closed those 2 pages & backed up to Google & www.myshopping.com.au
opened as well as Google.

This is one of many such incidents.

- I was using AVG free anti virus at the time when it first started
along with Zone Alarm.
- I'm now using the trial version of Pc_cillin Internet Security 2007
- I've run Ad-Aware & SpyBot with their latest updates.

I know that I can suppress the page content using the Hosts files, but
that doesn't stop the page itself from trying to open.

How can I stop the unwanted pages from opening, preferably for IE7 & FF2?

Posted by Gerry \(The MOTH\) on February 14, 2007, 7:17 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I use Firefox 2.0 and have 'allow pop-ups' turned off, also added extensions
ad-blocker and NoScript.

I was also advised to only have 1 anti-virus application running at the one
time.

--
Gerry (The MOTH)

>I use WinXP SP2 with all updates inc IE7
>
> This is an example of what's been happening for weeks:
> - Startup
> - call Google with IE7 (Firefox 2 responds the same way)
> - search for "convert flac to mp3" (I don't need help with that search)
> - select www.mymusictools.com & the expected page opens
> - 2 other pages also open: www.amaena.com & www.smartaudioconverter.com
> - I closed those 2 pages & backed up to Google & www.myshopping.com.au
> opened as well as Google.
>
> This is one of many such incidents.
>
> - I was using AVG free anti virus at the time when it first started along
> with Zone Alarm.
> - I'm now using the trial version of Pc_cillin Internet Security 2007
> - I've run Ad-Aware & SpyBot with their latest updates.
>
> I know that I can suppress the page content using the Hosts files, but
> that doesn't stop the page itself from trying to open.
>
> How can I stop the unwanted pages from opening, preferably for IE7 & FF2?



Posted by David H. Lipman on February 14, 2007, 7:24 am
If you were  Registered and logged in, you could reply and use other advanced thread options

| I use WinXP SP2 with all updates inc IE7

| This is an example of what's been happening for weeks:
| - Startup
| - call Google with IE7 (Firefox 2 responds the same way)
| - search for "convert flac to mp3" (I don't need help with that search)
| - select www.mymusictools.com & the expected page opens
| - 2 other pages also open: www.amaena.com & www.smartaudioconverter.com
| - I closed those 2 pages & backed up to Google & www.myshopping.com.au
| opened as well as Google.

| This is one of many such incidents.

| - I was using AVG free anti virus at the time when it first started
| along with Zone Alarm.
| - I'm now using the trial version of Pc_cillin Internet Security 2007
| - I've run Ad-Aware & SpyBot with their latest updates.

| I know that I can suppress the page content using the Hosts files, but
| that doesn't stop the page itself from trying to open.

| How can I stop the unwanted pages from opening, preferably for IE7 & FF2?



Two phase answer...

Perform Part 1 then perform Part 2

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 6.0,
then you are strongly urged to remove any/all versions.
There are vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java
JRE/JSE
Version 6.0

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.6.0

http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1




Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it
will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if
you are
using WinXP, Win2K or Win2003 your system will be left in a state where you will
have to
manually shutdown/reboot the PC. On Win9x/ME platforms the report will not be
shown in
your bowser but your PC will automatically be shutdown. It is suggested that
you move the
report out of c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of
the HTML
report for each session.


ALTERNATE:
--------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Scorchar on February 14, 2007, 7:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
David H. Lipman wrote:
>
> | I use WinXP SP2 with all updates inc IE7
>
> | This is an example of what's been happening for weeks:
> | - Startup
> | - call Google with IE7 (Firefox 2 responds the same way)
> | - search for "convert flac to mp3" (I don't need help with that search)
> | - select www.mymusictools.com & the expected page opens
> | - 2 other pages also open: www.amaena.com & www.smartaudioconverter.com
> | - I closed those 2 pages & backed up to Google & www.myshopping.com.au
> | opened as well as Google.
>
> | This is one of many such incidents.
>
> | - I was using AVG free anti virus at the time when it first started
> | along with Zone Alarm.
> | - I'm now using the trial version of Pc_cillin Internet Security 2007
> | - I've run Ad-Aware & SpyBot with their latest updates.
>
> | I know that I can suppress the page content using the Hosts files, but
> | that doesn't stop the page itself from trying to open.
>
> | How can I stop the unwanted pages from opening, preferably for IE7 & FF2?
>
>
>
> Two phase answer...
>
> Perform Part 1 then perform Part 2
>
> If the first two parts don't work, perform the alternate utility.
>
> It is suggested that you execute each tool in Normal Mode then in Safe Mode.
>
>
> If you are using any version of Sun Java that is prior to JRE Version 6.0,
> then you are strongly urged to remove any/all versions.
> There are vulnerabilities in them and they are actively being exploited.
>
> It is highly suggested that you update to the latest version which is Sun Java
JRE/JSE
> Version 6.0
>
> Simple check, look under...
> C:\Program Files\Java
>
> The only folder under that folder should be the latest version.
>
> Such as...
> C:\Program Files\Java\jre1.6.0
>
> http://java.sun.com/javase/downloads/index.jsp
> http://www.java.com/en/download/manual.jsp
>
> FYI:
> http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
> http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
> http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
> http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
> http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1
>
>
>
>
> Part 1
> ------------
> Download Adware-Virtumundo Removal Tool --
> http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
>
> Information on the Adware-Virtumundo Removal Tool:
> http://forums.mcafeehelp.com/viewtopic.php?t=57049
>
> Part 2
> ------------
> Download WinFixerFix.exe from the URL --
> http://www.ik-cs.com/programs/virtools/WinFixerFix.exe
>
> Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
> Choose; Unzip
> Choose; Close
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
> FireWall to enable WGET.EXE to download the needed McAfee related files.
>
> Execute; c:\mcafee\clean.bat
> { or Double-click on 'Clean Link' in c:\mcafee }
>
> A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
> C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it
will be
> displayed in your browser (Opera, FireFox or Internet Explorer). However, if
you are
> using WinXP, Win2K or Win2003 your system will be left in a state where you
will have to
> manually shutdown/reboot the PC. On Win9x/ME platforms the report will not be
shown in
> your bowser but your PC will automatically be shutdown. It is suggested that
you move the
> report out of c:\mcafee before performing another scan.
>
> It would be best to scan in both Safe Mode and in Normal Mode and save a copy
of the HTML
> report for each session.
>
>
> ALTERNATE:
> --------------
>
> Download Atribune's VUNDOFIX.EXE
> http://www.atribune.org/ccount/click.php?id=4
>
> Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.
>
>
> Please Copy and Paste the contents of the HTML Log files;
> C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your
reply.
>
> * * * Please report back your results * * *
>
>
Thanks for responding David.

I've re-installed Java 6.0; I was using v5.0

VirtumundoBeGone.exe worked as expected.

WinFixerFix.exe wouldn't run.

vundofix.exe worked except it couldn't remove
c:\windows\system32\wprsalei.dll.
I can't find any reference to that file on the net & it didn't show up
on a search, so I deleted the 2 references to it from my registry. That
was risky as I didn't know what the file was for, however given the
nuisance value of what was happening, it was an acceptable risk.

Everything is working within normal parameters again. Thank you.

My VundoFix report:

VundoFix V6.3.6

Checking Java version...

Scan started at 9:06:06 AM 15 Feb 07

Listing files found while scanning....

C:\WINDOWS\system32\awtqnml.dll
C:\WINDOWS\system32\awtqool.dll
C:\WINDOWS\system32\awtuurs.dll
C:\WINDOWS\system32\awtuuvs.dll
C:\WINDOWS\system32\byxvvuv.dll
C:\WINDOWS\system32\byxwwxv.dll
C:\WINDOWS\system32\byxxxut.dll
C:\WINDOWS\system32\cbxursr.dll
C:\WINDOWS\system32\cbxwvvs.dll
C:\WINDOWS\system32\cbxywwx.dll
C:\WINDOWS\system32\cbxyyvv.dll
C:\WINDOWS\system32\ddccdcb.dll
C:\WINDOWS\system32\ddcddda.dll
C:\WINDOWS\system32\ddcdeff.dll
C:\WINDOWS\system32\ddcywtt.dll
C:\WINDOWS\system32\efcbaba.dll
C:\WINDOWS\system32\efcbxvu.dll
C:\WINDOWS\system32\efcccdb.dll
C:\WINDOWS\system32\efcyaww.dll
C:\WINDOWS\system32\fccbaww.dll
C:\WINDOWS\system32\fccbbbc.dll
C:\WINDOWS\system32\fccccdc.dll
C:\WINDOWS\system32\fccdbya.dll
C:\WINDOWS\system32\gcagtijt.ini
C:\WINDOWS\system32\gebcbcb.dll
C:\WINDOWS\system32\gebcbcd.dll
C:\WINDOWS\system32\gebyxuv.dll
C:\WINDOWS\system32\hggdbax.dll
C:\WINDOWS\system32\hggdccd.dll
C:\WINDOWS\system32\hggebxv.dll
C:\WINDOWS\system32\hgggddc.dll
C:\WINDOWS\system32\hgghfcy.dll
C:\WINDOWS\system32\hgghgfc.dll
C:\WINDOWS\system32\hgghhec.dll
C:\WINDOWS\system32\iifeecc.dll
C:\WINDOWS\system32\iiffday.dll
C:\WINDOWS\system32\iifffee.dll
C:\WINDOWS\system32\jcybyoqt.ini
C:\WINDOWS\system32\ljjggdc.dll
C:\WINDOWS\system32\ljjihfc.dll
C:\WINDOWS\system32\ljjiifg.dll
C:\WINDOWS\system32\mljgdax.dll
C:\WINDOWS\system32\mljgebb.dll
C:\WINDOWS\system32\mljggdb.dll
C:\WINDOWS\system32\mljghed.dll
C:\WINDOWS\system32\mljhigh.dll
C:\WINDOWS\system32\mljkigf.dll
C:\WINDOWS\system32\mljkiij.dll
C:\WINDOWS\system32\nnnkjjj.dll
C:\WINDOWS\system32\nnnolji.dll
C:\WINDOWS\system32\nnnonop.dll
C:\WINDOWS\system32\opnmmkk.dll
C:\WINDOWS\system32\pmnmlmj.dll
C:\WINDOWS\system32\pmnmmmn.dll
C:\WINDOWS\system32\pmnmnkk.dll
C:\WINDOWS\system32\qomjhge.dll
C:\WINDOWS\system32\rqrpooo.dll
C:\WINDOWS\system32\rqrrpml.dll
C:\WINDOWS\system32\rqrrsst.dll
C:\WINDOWS\system32\ssqoljk.dll
C:\WINDOWS\system32\ssqomnn.dll
C:\WINDOWS\system32\ssqqoon.dll
C:\WINDOWS\system32\tjitgacg.dll
C:\WINDOWS\system32\tqoybycj.dll
C:\WINDOWS\system32\tuvsrss.dll
C:\WINDOWS\system32\tuvttro.dll
C:\WINDOWS\system32\ufdhrrnv.ini
C:\WINDOWS\system32\urqqrsr.dll
C:\WINDOWS\system32\vnrrhdfu.dll
C:\WINDOWS\system32\wprsalei.dll
C:\WINDOWS\system32\wvusrom.dll
C:\WINDOWS\system32\wvutqqn.dll
C:\WINDOWS\system32\xxyayxw.dll
C:\WINDOWS\system32\xxywxxx.dll
C:\WINDOWS\system32\xxyxxyx.dll
C:\WINDOWS\system32\xxyyyxx.dll
C:\WINDOWS\system32\yayyxvv.dll
C:\WINDOWS\system32\yayyxwt.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\awtqnml.dll
C:\WINDOWS\system32\awtqnml.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtqool.dll
C:\WINDOWS\system32\awtqool.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtuurs.dll
C:\WINDOWS\system32\awtuurs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtuuvs.dll
C:\WINDOWS\system32\awtuuvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxvvuv.dll
C:\WINDOWS\system32\byxvvuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxwwxv.dll
C:\WINDOWS\system32\byxwwxv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxxxut.dll
C:\WINDOWS\system32\byxxxut.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxursr.dll
C:\WINDOWS\system32\cbxursr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxwvvs.dll
C:\WINDOWS\system32\cbxwvvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxywwx.dll
C:\WINDOWS\system32\cbxywwx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxyyvv.dll
C:\WINDOWS\system32\cbxyyvv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddccdcb.dll
C:\WINDOWS\system32\ddccdcb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcddda.dll
C:\WINDOWS\system32\ddcddda.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcdeff.dll
C:\WINDOWS\system32\ddcdeff.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcywtt.dll
C:\WINDOWS\system32\ddcywtt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcbaba.dll
C:\WINDOWS\system32\efcbaba.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcbxvu.dll
C:\WINDOWS\system32\efcbxvu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcccdb.dll
C:\WINDOWS\system32\efcccdb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcyaww.dll
C:\WINDOWS\system32\efcyaww.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccbaww.dll
C:\WINDOWS\system32\fccbaww.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccbbbc.dll
C:\WINDOWS\system32\fccbbbc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccccdc.dll
C:\WINDOWS\system32\fccccdc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccdbya.dll
C:\WINDOWS\system32\fccdbya.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gcagtijt.ini
C:\WINDOWS\system32\gcagtijt.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcbcb.dll
C:\WINDOWS\system32\gebcbcb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcbcd.dll
C:\WINDOWS\system32\gebcbcd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebyxuv.dll
C:\WINDOWS\system32\gebyxuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggdbax.dll
C:\WINDOWS\system32\hggdbax.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggdccd.dll
C:\WINDOWS\system32\hggdccd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggebxv.dll
C:\WINDOWS\system32\hggebxv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgggddc.dll
C:\WINDOWS\system32\hgggddc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghfcy.dll
C:\WINDOWS\system32\hgghfcy.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghgfc.dll
C:\WINDOWS\system32\hgghgfc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghhec.dll
C:\WINDOWS\system32\hgghhec.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iifeecc.dll
C:\WINDOWS\system32\iifeecc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iiffday.dll
C:\WINDOWS\system32\iiffday.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iifffee.dll
C:\WINDOWS\system32\iifffee.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jcybyoqt.ini
C:\WINDOWS\system32\jcybyoqt.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjggdc.dll
C:\WINDOWS\system32\ljjggdc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjihfc.dll
C:\WINDOWS\system32\ljjihfc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjiifg.dll
C:\WINDOWS\system32\ljjiifg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgdax.dll
C:\WINDOWS\system32\mljgdax.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgebb.dll
C:\WINDOWS\system32\mljgebb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljggdb.dll
C:\WINDOWS\system32\mljggdb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljghed.dll
C:\WINDOWS\system32\mljghed.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljhigh.dll
C:\WINDOWS\system32\mljhigh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljkigf.dll
C:\WINDOWS\system32\mljkigf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljkiij.dll
C:\WINDOWS\system32\mljkiij.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnkjjj.dll
C:\WINDOWS\system32\nnnkjjj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnolji.dll
C:\WINDOWS\system32\nnnolji.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnonop.dll
C:\WINDOWS\system32\nnnonop.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\opnmmkk.dll
C:\WINDOWS\system32\opnmmkk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnmlmj.dll
C:\WINDOWS\system32\pmnmlmj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnmmmn.dll
C:\WINDOWS\system32\pmnmmmn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnmnkk.dll
C:\WINDOWS\system32\pmnmnkk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qomjhge.dll
C:\WINDOWS\system32\qomjhge.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrpooo.dll
C:\WINDOWS\system32\rqrpooo.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrrpml.dll
C:\WINDOWS\system32\rqrrpml.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrrsst.dll
C:\WINDOWS\system32\rqrrsst.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqoljk.dll
C:\WINDOWS\system32\ssqoljk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqomnn.dll
C:\WINDOWS\system32\ssqomnn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqqoon.dll
C:\WINDOWS\system32\ssqqoon.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tjitgacg.dll
C:\WINDOWS\system32\tjitgacg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tqoybycj.dll
C:\WINDOWS\system32\tqoybycj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvsrss.dll
C:\WINDOWS\system32\tuvsrss.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvttro.dll
C:\WINDOWS\system32\tuvttro.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ufdhrrnv.ini
C:\WINDOWS\system32\ufdhrrnv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\urqqrsr.dll
C:\WINDOWS\system32\urqqrsr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vnrrhdfu.dll
C:\WINDOWS\system32\vnrrhdfu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wprsalei.dll
C:\WINDOWS\system32\wprsalei.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvusrom.dll
C:\WINDOWS\system32\wvusrom.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvutqqn.dll
C:\WINDOWS\system32\wvutqqn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyayxw.dll
C:\WINDOWS\system32\xxyayxw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxywxxx.dll
C:\WINDOWS\system32\xxywxxx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyxxyx.dll
C:\WINDOWS\system32\xxyxxyx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyyyxx.dll
C:\WINDOWS\system32\xxyyyxx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yayyxvv.dll
C:\WINDOWS\system32\yayyxvv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yayyxwt.dll
C:\WINDOWS\system32\yayyxwt.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.6

Checking Java version...

Scan started at 9:13:41 AM 15 Feb 07

Listing files found while scanning....


VundoFix V6.3.6

Checking Java version...

Scan started at 9:18:35 AM 15 Feb 07

Listing files found while scanning....

C:\WINDOWS\system32\wprsalei.dll

Beginning removal...

Performing Repairs to the registry.
Done!

VundoFix V6.3.6

Checking Java version...

Scan started at 9:25:52 AM 15 Feb 07

Listing files found while scanning....


VundoFix V6.3.6

Checking Java version...

Scan started at 9:47:04 AM 15 Feb 07

Listing files found while scanning....

No infected files were found.


Posted by David H. Lipman on February 14, 2007, 7:41 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


| Thanks for responding David.
|
| I've re-installed Java 6.0; I was using v5.0
|
| VirtumundoBeGone.exe worked as expected.
|
| WinFixerFix.exe wouldn't run.
|
| vundofix.exe worked except it couldn't remove
| c:\windows\system32\wprsalei.dll.
| I can't find any reference to that file on the net & it didn't show up
| on a search, so I deleted the 2 references to it from my registry. That
| was risky as I didn't know what the file was for, however given the
| nuisance value of what was happening, it was an acceptable risk.
|
| Everything is working within normal parameters again. Thank you.
|
| My VundoFix report:
|
| VundoFix V6.3.6
|

< snip >

That was quite an interesting Vundo infection !

Please follow-up with the following...


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Similar ThreadsPosted
Messenger Service Popups July 19, 2005, 5:33 am
anyone has this same problem? : popups of help window July 30, 2005, 10:23 am
how do i stop theese popups September 9, 2005, 2:59 am
Winfixer & WinAntiVirusPro popups but not in registry March 27, 2006, 5:09 pm
Winsoftware popups / Virtumundo new version? July 5, 2006, 7:19 pm
HELP sex.com default page January 26, 2007, 4:39 am
start Page virus December 30, 2005, 9:11 pm
CHANGE OF HOME PAGE April 3, 2007, 1:46 am
CHANGE OF HOME PAGE April 3, 2007, 1:47 am
The default page was set to www.msn.com occasionally. Is it possible be virus? September 6, 2005, 7:39 am

The site map in XML format XML site map

Contact Us | Privacy Policy