Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

Celldorado.com

Options
shaunhale
shaunhale
in Malware talk

Hello,


I have a very annoying problem with a website called "Celldorado.com" at the moment. It started popping up regularly a few weeks ago and has consequently started all sorts of other websites popping up.


I have Spybot Search & Destroy, AVG, McAfee and Windows Defender, but none of them find any problems. I also use Firefox Web Browser and have manually blocked the various cookies that these websites keep adding to the computer.


Please God help me before I throw my PC out of the window! :wacko:


Your rated as an excellent forum, so I'm hoping you can help me out.


Thanks.

Comments

  • Unknown
    Unknown
    Options

    Please give us 2 logs of StartupList (one from safe-mode and another one from normal-mode)


    You can download it from: http://www.spywareinfo.com/~merijn/files/startuplist.zip or http://www.merijn.org/files/startuplist.zip

  • shaunhale
    shaunhale
    edited June 2008
    Options
    Please give us 2 logs of StartupList (one from safe-mode and another one from normal-mode)


    You can download it from: http://www.spywareinfo.com/~merijn/files/startuplist.zip or http://www.merijn.org/files/startuplist.zip


    I used the link and copied the data it gave me to the clipboard. I then copied it into my reply on this post, but when I pressed "add reply" it gave me an error message saying that the post was too long.


    Where have I gone wrong?


    Can anyone help with this???


    crysty2k5's EDIT: posts merged

  • Unknown
    Unknown
    Options

    Dear sir,


    please save the log into a file (log.txt) and attach it on this forum.

  • shaunhale
    shaunhale
    edited June 2008
    Options
    Dear sir,


    please save the log into a file (log.txt) and attach it on this forum.


    Here is the normal mode log saved in notepad:


    Dear sir,


    please save the log into a file (log.txt) and attach it on this forum.


    Here is the safe mode log saved in notepad:


    Have I attached these logs correctly???


    Please can somebody help me with this problem!!!???


    Nobody has replied to my post for a long time.


    Please can somebody help me?


    crysty2k5's EDIT: posts merged


    /applications/core/interface/file/attachment.php?id=1775" data-fileid="1775" rel="">log.txt

    /applications/core/interface/file/attachment.php?id=1776" data-fileid="1776" rel="">log_safemode_.txt

  • alexcrist
    alexcrist ✭
    Options

    Hello shaunhale,


    Sorry for the late reply. I don't know why someone didn't reply earlier.


    Please post a HijackThis log. I'll take a look and see what could trigger the popups.


    Cris.

  • Niels
    Niels ✭
    Options

    Hello shaunhale,


    Can you please check the following locations:


    Click on start,my computer,double click on the icon of your hard disc ,documents and settings now go to the tools menu,folder options,press on the display/view tab check the option show hidden files/folders press on apply,open now the folder of your user account,you will see now a folder called local settings open it,application data open it also and see if you can find files inside with these names:


    uielagc.dat


    uielagc.exe


    uielagc_nav.dat


    uielagc_navps.dat


    Now check these locations: go to start,my computer,double click on the icon of your hard disc, windows,system 32 folder,cache and add the content also to an archive. Look also for nvs2.inf


    entries.


    Please archive these an upload them on the forum.


    After you done that please read this and follow these instructions.Post the output of that scan together with a hijack this log.


    Best regards


    Niels

  • shaunhale
    shaunhale
    Options
    Hello shaunhale,


    Can you please check the following locations:


    Click on start,my computer,double click on the icon of your hard disc ,documents and settings now go to the tools menu,folder options,press on the display/view tab check the option show hidden files/folders press on apply,open now the folder of your user account,you will see now a folder called local settings open it,application data open it also and see if you can find files inside with these names:


    uielagc.dat


    uielagc.exe


    uielagc_nav.dat


    uielagc_navps.dat


    Now check these locations: go to start,my computer,double click on the icon of your hard disc, windows,system 32 folder,cache and add the content also to an archive. Look also for nvs2.inf


    entries.


    Please archive these an upload them on the forum.


    After you done that please read this and follow these instructions.Post the output of that scan together with a hijack this log.


    Best regards


    Niels


    Niels,


    Thanks for getting back to me. I have to apologise myself for taking so long to action the above - I haven't had much time to get on a computer.


    Please find attached the ComboFix Log and the HijackThis Log.


    I followed your instructions regarding going into the Application Data folder and Cache folder, but they didn't quite follow (maybe because I use Windows Vista?) Anyway, I did find a Application Data folder, but it says "Access Denied" even if I run Explorer as an Administrator. There was no "Cache" folder that I could see under the "System 32" folder. I did reveal all the hidden folders.


    Can you help using the two logs above?

    /applications/core/interface/file/attachment.php?id=2079" data-fileid="2079" rel="">ComboFix.txt

    /applications/core/interface/file/attachment.php?id=2080" data-fileid="2080" rel="">hijackthis.log

  • rootkit
    rootkit ✭✭✭
    edited May 2008
    Options

    Please pack this file in a zip or rar archive with the password infected and attach it here !


    C:\Users\Shaun\AppData\Local\Microsoft\sgbvea.exe


    Upload the file on http://www.virustotal.com/ and paste here the link analysis

  • shaunhale
    shaunhale
    edited June 2008
    Options
    Please pack this file in a zip or rar archive with the password infected and attach it here !


    Upload the file on http://www.virustotal.com/ and paste here the link analysis


    crysty2k5,


    I have found the folder C:\Users\Shaun\AppData\Local\Microsoft but it only contains 24 other folders and no files. I certainly cannot see a file called sgbvea.exe


    How do I find it?


    If I do find it, how do I put it into a zip or rar archive and how do I password protect it?


    Can anyone help me with my query please? :huh:


    crysty2k5's EDIT: posts merged

  • Niels
    Niels ✭
    Options

    Hello shaunhale,


    Please download vundofix from here. Double click on it and press on scan for vundo. Wait till the scan is finished. Press remove vundo. If infected files are found confirm the deletion by pressing on yes. If something found please post the the output of vundofix.txt which you will find in the root of your hard disk. (start,my computer,double click on the partition where windows is installed on). Make a new hijackthis log.


    Best regards


    Niels

  • shaunhale
    shaunhale
    Options
    Hello shaunhale,


    Please download vundofix from here. Double click on it and press on scan for vundo. Wait till the scan is finished. Press remove vundo. If infected files are found confirm the deletion by pressing on yes. If something found please post the the output of vundofix.txt which you will find in the root of your hard disk. (start,my computer,double click on the partition where windows is installed on). Make a new hijackthis log.


    Best regards


    Niels


    Vundofix didn't find anything.


    Here is my new hijackthis log.

    /applications/core/interface/file/attachment.php?id=2113" data-fileid="2113" rel="">hijackthis_02.06.08.txt

  • rootkit
    rootkit ✭✭✭
    Options

    There is another suspicious file in the log:


    C:\Users\Shaun\AppData\Local\Microsoft\dgvgfulclf.exe


    Download SUPERAntiSpyware && Malwarebytes' Anti-Malware and run a complete scan !

  • shaunhale
    shaunhale
    Options
    There is another suspicious file in the log:



    Download SUPERAntiSpyware && Malwarebytes' Anti-Malware and run a complete scan !


    SuperAntiSpyware did not find anything.


    Malwarebytes' Anti-Malware found 11 items, which I have now removed.


    Attached is the log file.


    Is there any more I need to do?

    /applications/core/interface/file/attachment.php?id=2117" data-fileid="2117" rel="">mbam_log_6_2_2008__19_40_25_.txt

  • rootkit
    rootkit ✭✭✭
    edited June 2008
    Options

    Good, clean all the ad-aware !

  • shaunhale
    shaunhale
    Options
    Good, clean all the ad-aware !


    I pressed the "Remove" button when the scan had finished, if that's what you mean?


    Attached is my latest hijackthis log.


    Does everything look okay now?

    /applications/core/interface/file/attachment.php?id=2118" data-fileid="2118" rel="">hijackthis_02.06.08__ii_.txt

  • rootkit
    rootkit ✭✭✭
    Options

    Check and press Fix checked for:



    O4 - HKCU\..\Run: [dgvgfulclf] c:\users\shaun\appdata\local\microsoft\dgvgfulclf.exe dgvgfulclf


    O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com (file missing)


    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)


    O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)


    Run a system scan cu Bitdefender !

  • shaunhale
    shaunhale
    Options
    Check and press Fix checked for:


    Run a system scan cu Bitdefender !


    Sorry, I don't understand?


    I've just had another pop-up come up.


    I went back into Malwarebytes' Anti-Malware and found the 11 items in the Quarantine section. I then pressed "Delete All"


    What are the items you have listed? How do I "fix check" them? What sort of system scan do you want me to do?


    Sorry this is taking so long! My computer skills are somewhat limited and I'm not quite following everything you're saying. Please bear with me! :blink:

  • rootkit
    rootkit ✭✭✭
    Options

    O4 - HKCU\..\Run: [dgvgfulclf] c:\users\shaun\appdata\local\microsoft\dgvgfulclf.exe dgvgfulclf


    O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com (file missing)


    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)


    O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)


    Not in Malwarebytes' Anti-Malware, in HijackThis ;)

  • shaunhale
    shaunhale
    Options
    Not in Malwarebytes' Anti-Malware, in HijackThis ;)


    Thanks!


    I've removed everything apart from:


    O4 - HKCU\..\Run: [dgvgfulclf] c:\users\shaun\appdata\local\microsoft\dgvgfulclf.exe dgvgfulclf


    (It was no longer there)


    Attached is a new hijackthis log

    /applications/core/interface/file/attachment.php?id=2137" data-fileid="2137" rel="">hijackthis_04.06.08.txt

  • rootkit
    rootkit ✭✭✭
    Options

    The log is now clean ! ;)

  • shaunhale
    shaunhale
    Options
    The log is now clean ! ;)


    Thank you, but I have just had another pop-up appear. The site is www.yesloansuk.com.


    I blocked the cookie associated with it and closed the window, but a couple of minutes later the same website popped up again.


    Help! :unsure:

  • rootkit
    rootkit ✭✭✭
    Options

    Download: http://download.bleepingcomputer.com/andymanchesta/SDFix.exe


    Instructions: http://www.bleepingcomputer.com/forums/topic131299.html


    Attach here the SDFix log ;)

  • shaunhale
    shaunhale
    Options
    Download: http://download.bleepingcomputer.com/andymanchesta/SDFix.exe


    Instructions: http://www.bleepingcomputer.com/forums/topic131299.html


    Attach here the SDFix log ;)


    Sorry I've taken so long to reply.


    I installed the software you suggested and tried to run it. A black window opened for just a brief second and then disappeared. I found the file location and it is definitely there, but every time I try to run it, I get the same black screen appear and disappear in a flash.

  • guitarist44
    guitarist44
    edited June 2008
    Options

    same problem here, the adware seems to disabe McAfee SiteAdvisor, BitDefender AntiPhishing and IE 7 phishingfilter. I have Win Vista Home Prem 32 bit


    tried (in safe mode):


    BitDefender Total Security 2008


    VundoFix (BitDefender blocks www.atribune.org, difficult to download)


    Spybot Search & Destroy


    Lavasoft Ad-Aware


    Hijack This

  • guitarist44
    guitarist44
    Options
    same problem here, the adware seems to disabe McAfee SiteAdvisor, BitDefender AntiPhishing and IE 7 phishingfilter. I have Win Vista Home Prem 32 bit


    tried (in safe mode):


    BitDefender Total Security 2008


    VundoFix (BitDefender blocks www.atribune.org, difficult to download)


    Spybot Search & Destroy


    Lavasoft Ad-Aware


    Hijack This


    just a note: the pop-ups are opened in IE7 and FireFox 2 too

  • guitarist44
    guitarist44
    Options
    just a note: the pop-ups are opened in IE7 and FireFox 2 too


    VundoFix V7.0.6


    Scan started at 11:05:23 23/06/2008


    Listing files found while scanning....


    C:\Windows\System32\rQHbyaaX.dll


    Beginning removal...


    Attempting to delete C:\Windows\System32\rQHbyaaX.dll


    C:\Windows\System32\rQHbyaaX.dll Has been deleted!


    Performing Repairs to the registry.


    Done!


    after this nothing has changed and a critical windows error appaered telling me the comp will be restarted in 1 min


    at the moment I'm trying Malwarebyte's Anti-Malware


    I think this trojan is called Virtumonde

  • shaunhale
    shaunhale
    Options
    VundoFix V7.0.6


    Scan started at 11:05:23 23/06/2008


    Listing files found while scanning....


    C:\Windows\System32\rQHbyaaX.dll


    Beginning removal...


    Attempting to delete C:\Windows\System32\rQHbyaaX.dll


    C:\Windows\System32\rQHbyaaX.dll Has been deleted!


    Performing Repairs to the registry.


    Done!


    after this nothing has changed and a critical windows error appaered telling me the comp will be restarted in 1 min


    at the moment I'm trying Malwarebyte's Anti-Malware


    I think this trojan is called Virtumonde


    Can anyone see anything dodgy in my hijack this log?

    /applications/core/interface/file/attachment.php?id=2313" data-fileid="2313" rel="">hijackthis_24.06.08.txt

  • shaunhale
    shaunhale
    Options

    I haven't heard from anyone in a while.


    Can someone help me with this problem please???

  • shaunhale
    shaunhale
    Options

    Please, please, please can someone help with this?????????? <img class=" />

  • danton
    danton
    Options
    Please, please, please can someone help with this?????????? <img class=" />


    Hello.


    Make an archive with the following file (with the password "infected") and attach it in a post.


    C:\Users\Shaun\AppData\Local\Microsoft\kmygwkkey.exe


    Have a nice day!

  • shaunhale
    shaunhale
    Options
    Hello.


    Make an archive with the following file (with the password "infected") and attach it in a post.


    C:\Users\Shaun\AppData\Local\Microsoft\kmygwkkey.exe


    Have a nice day!


    Please excuse my ignorance, but how do I do that? :blink:

  • shaunhale
    shaunhale
    Options

    Nobody has got back to me yet.


    How do I create this "archive file" mentioned above?


    I have had this problem with pop-ups for 4 and a half months now and it is getting worse!!! <img class=" />

  • shaunhale
    shaunhale
    Options

    I am getting no assistance with this problem and everyone seems to have stopped replying.


    The pop-ups now are appearing very regularly and seem to be getting worse.


    PLEASE HELP !!!!!!!!!!!!!!!!!!!!!!


    <_<:wacko::blink:<img class=" />

  • shaunhale
    shaunhale
    Options

    I'm going to keep posting until someone notices me and helps!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

All Time Leaders

Categories

Defenders of the month