Fp Pc On Internet.com Pop Ups Spyware Problems

Hello jianjili,

Please put the following file in a ZIP archive, with the password infected:

c:\users\kenny\appdata\local\qoqykac.exe

Attach the archive to your next post.

Cris.

Thank you, Cris. But I can't find c:\users\kenny\appdata\local\qoqykac.exe on my laptop, even I selected the show hidden files and folders option. Could you please tell me detail for how to find it? Thanks again, I appreciate.

Hello,

The file has to exist, because it's listed as a running process, which means it exists.

Please read this: How To Find Hidden Malware (and make sure you follow all the steps writen there). Also, be sure that the options stay un-checked (some malware prevent users from changing those settings, in which case we have to take an alternative approach).

Cris.

Hi Cris.

Because my operation system is vista sp1, so some setps are different with the instruction. But I thought I did it as you required. Unfortunately, still can't find that file. Attachment is the picture which show you what files is inside. Thanks again.

That's very weird... but what if you look in TaskManager? Can you see that process as running? If you look in your first post here, HijackThis detected it as running, and also as a startup item.

It's not in my task manager. See attachment. Thank you so much.

Hi, Cris. I found c:\users\kenny\appdata\local\owmugue.exe from MSCONFIG, it's a stratup item. Look is similar with c:\users\kenny\appdata\local\qoqykac.exe. But also can't find fom the folder and task manager. :wacko: Does it help?

Hello jianjili,

I see some traces off the Thunder Network Toolbar. Please open Internet Explorer go to the tools menu,manage add-ons,select Add-ons that have been used by Internet Explorer see if you can find references to Thunder Network select disable restart IE. The entries you should disable are :

xunleiBHO_Now.dll

TDAtOnce_Now.dll

Can you please download combofix you will find it here. Print the following instructions and read them carefully. Please post the output of the scan into your next post. So I or someone else can see if there is still some infections.

Kind regards,

Niels

Hi, Cris. I found c:\users\kenny\appdata\local\owmugue.exe from MSCONFIG, it's a stratup item. Look is similar with c:\users\kenny\appdata\local\qoqykac.exe. But also can't find fom the folder and task manager. Does it help?

Ok...this looks like the file is somehow changing it's name (??).

If somehow, you can find a file with a weird name in that folder, please attach it here (in a ZIP file).

Also, follow Niles' advice and post the Combofix log and a new HijackThis log.

Cris.

/applications/core/interface/file/attachment.php?id=19802" data-fileExt='zip' data-fileid='19802'>owmuge.rar.zip

Hi Cris. I found owmugue.exe in safe mode. Please see attachment. And my vista was upgraded from XP, so I still try to know how to access recovery enrionment. I have a cd but only for upgrade, can't boot from it. Thanks Cris and Nile.

owmuge.rar.zip

Thank you for the sample. I'll send it for analysis as soon as possible and tell you the result.

About the recovery environment... I assume you ask this because you saw it in the Combofix instructions? If this is the case, then don't worry about it. Just skip those steps, and read the actual instructions of Combofix itself. Also keep the instructions offline, in case the internet connection doesn't work anymore after you run Combofix (see the last part of those instructions).

Cris.

Hi, Cris and Nile. Don't know why, I can't run Combofix. Even I closed my antivirus and firewall and run it as administrator. It's nothing show up on my screen. Hope to have the result from you soon. Thanks again.

Hello jianjili,

Please download Deckard's System Scanner. You need to save it on your desktop. Close all other applications and windows. First right click on dss(.exe) and choose for run as administrator. Now double click on dss(.exe) Confirm the warnings. It can take a while. Please copy the content of main and extra textfiles. Extra will be minimized and paste it at your next post. Because it will be large spread them about a few posts.

Kind regards,

Niels

The previously attached file was checked by BD labs and it's, indeed, infected. Detection will be available in BD in one of the future updates.

Also, I'd like to know if you could post an installation kit of Thunder network (or a link to download it). It might be infected also. If you post a link, please don't post it directly into your post (instead write it in a TXT file and attach that file).

Cris.

P.S.: I asked one of the guys at the labs about ComboFix and Vista (because you said that you couldn't run it) and I was told that Combofix just refuses to work on Vista (it detects this OS and just refuses to start). I guess it's tools are not fully compatible with Vista, so the authors prevented it from running in Vista...

/applications/core/interface/file/attachment.php?id=2388" data-fileid="2388" rel="">thunder_download.txt

Hi Cris. Attachment is Thunder Network download address. Thanks.

thunder_download.txt

Hello jianjili,

Can you please also the output off the Deckard's scan? That also includes a similar program as combofix that should work in vista.

Kind regards,

Niels

PS Cris:

The strange thing on some vista pc's combofix does run. But it could be that in newer version it doesn't work. But I found logfiles off vista based computer posted not so long ago more specificly 15 th June 2008.

/applications/core/interface/file/attachment.php?id=2396" data-fileid="2396" rel="">main.txt

Hi Niels. Attachment are DDS's scan. Hope they help for tis problem. Thank you so much.

/applications/core/interface/file/attachment.php?id=2397" data-fileid="2397" rel="">extra.txt

main.txt

extra.txt

Hello jianjili,

I see some entries off Spyware-Secure which infact is a rogue security product which reports false positivs and displays pop-up's. Can you please click on start,my computer,program files,spyware-secure,see if you still can find Spyware-Secure_trial.exe. If so please upload it here also. If iit's too big. Upload it to an online file host and attach the download link into a text file.

Please press the windows button together with r now type regedit press enter. Expand hkey_local_machine by pressing on the +-sign,open the following folders and subfolders: software,microsoft,windows,currentversion,run take a look at the right side look for and entry that is called Spyware-Secure select it and press on delete.

Kind regards,

Niels

Hi Niels. There are not Spyware-Secure_trial.exe. And I had deleted Spyware-Secure from my registry. Thank you.

/applications/core/interface/file/attachment.php?id=2413" data-fileid="2413" rel="">w4sgeen9.rar

Hello jianjili,

After looking again. I found something suspecious. Please click on start,my computer,windows,downloaded program files,look for an entry called w4sgeen9.exe delete it. This could be the cause off your pop-up's. Because this is loaded everytime that you start Internet Explorer.

Kind regards,

Niels

PS: To virus researchers I've attached the sample. Password is infected.

w4sgeen9.rar

/applications/core/interface/file/attachment.php?id=2418" data-fileid="2418" rel="">w4sgeen9.exe.txt

Hi Niels. I found some information about this file from other website. Please check the website address in the attachment. If you think I still need to delete it, please let me know. Thank you so much.

w4sgeen9.exe.txt