Greetings. I'm in urgent need of help with spyware attacks I have ad-aware 6 spybot s and d hijack this Thats it Well i get a pop up every minute or so... just 1 every minute for some random thing ... i know i dont have the big stuff like 18...
Topic Options
#161450 - 04/20/0512:51 PMI need help, Quick!
wo653
stranger
Registered: 04/20/05
Posts: 10
Greetings. I'm in urgent need of help with spyware attacks
I have ad-aware 6 spybot s and d hijack this Thats it
Well i get a pop up every minute or so... just 1 every minute for some random thing ... i know i dont have the big stuff like 180searchware or coolwwwsearch
Its not big thats why its wierd but ok i scan on all 3 and get rid of all 3
i think its called elitejky32.exe and vimml.exe or something and i get rid of them... but they come back... Spyware gets rid of it then it just comes back.
What do i do, I really cant just reformat.
EDIT : Ok I figured out some things
Its called Ebates Moneymaker , i got rid of the registry thing so ebates is gone
my new one is in the processes its called
Vimmll.exe I cant find it in spybot or ad-aware and it only shows up on hijack but it comes back too... is there somthing i do for that?
Registered: 12/21/04
Posts: 1025
Loc: Finland / Suomi
Can we see your hijack this log?
What OS you got? XP?
If you got XP then: Disable Simple File Sharing 1. Open My Computer from the Start Menu or Windows XP Desktop. A new My Computer window will appear. 2. Open the Tools menu and choose the "Folder Options..." option from this menu. A new Folder Options window will appear. 3. Click on the View tab and locate the "Use Simple File Sharing (Recommended)" checkbox in the list of Advanced Settings. 4. To enable Simple File Sharing, ensure this checkbox is checked. To disable Simple File Sharing, ensure this checkbox is not checked. Click inside the checkbox to alternately enable and disable the option. 5. Click OK to close the Folder Options window. The settings for Simple File Sharing are now updated; no computer reboot is required.
jerry atrik's tip
Quote:
right click the nasty file (In your case: "vimmll.exe") properties/security tab/advanced uncheck the "inherit from parent permissions" box yes to the annoyance popup apply remove all users (including system) from the groups/users box yes to the annoyance popup reboot the file is now unable to do anything u can either leave it or re-take ownership and delete it (because the system didnt have permission to load it it wont load at boot)
Logfile of HijackThis v1.99.1 Scan saved at 11:36:52 AM, on 4/20/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000)
but the thing is i cant find the file and if i delete it it will come back so i have to use that tip but i cant find the file it says its in the sys32 folder, Apparnetly not after my searching
It is probably a hidden file. Bring up my computer, select Tools, Folder options, view tab, click the radial button on "Show hidden files and folders". Also, uncheck "Hide protected operating system files". Select yes, on the warning, hit okay. Search for that file again.
Alright, All good tips guys. Thanks a bunch, I'm still finding it because Theefools tip helped and jarry your help worked but im still findint out some stuff but thanks so much already
Ahhhh, It wont stop... I use all the spyware i can use to get rid o f it... It wont go away... i look for it , its not there i used all your tips... it just keeps coming with the popups... NOOOOO evil popups what do i do... nothings working
# Unzip the contents of FindIt NT-2K-XP.zip to a convenient location. # Navigate to the FindIt NT-2K-XP directory. # Double-click on FindVX2.bat and wait for it to run. # It should open a Notepad window with the FindVX2 log. # Post the contents of FindVX2.txt into your next post.
This is a nice batch file. I've used it a couple times. In fact I already have an improved version of this, that I did on my own.
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
This might be a pain, but go into safe mode. bring up a command prompt. Also, I prefer going into the Recovery Console.
go to the c:\windows directory by typing in: cd\windows then type in attrib -r -h -s -a jmhhv.dll attrib -r -h -s -a unadbeh.exe erase jmhhv.dll erase unadbeh.exe cd system32 attrib -r -h -s -a adppq.dll attrib -r -h -s -a tshhbbr.dll attrib -r -h -s -a winup2~1.dll attrib -r -h -s -a bdrrqqm.exe attrib -r -h -s -a vimmll.exe attrib -r -h -s -a wmconfig.cpl erase adppq.dll erase tshhbbr.dll erase winup2~1.dll erase bdrrqqm.exe erase vimmll.exe erase wmconfig.cpl cd\docume~1\alluse~1\starm~1\programs\startup attrib -r -h -s -a nrpp.exe erase nrpp.exe exit then click start, run, regedit now migrate to HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fmttkkxk
delete the key "6cb1abe1-2bcc-47a0-8a90-2ac368f47d8b\(Default)
reboot back into normal mode, and give me your logs again.
If you have any questions before doing any of this, feel free to ask them.
Your problem is from the qoologic trojan downloader. Avast can find it, but not get rid of it. Norton can't find it, mcafee can't find it, adaware doesn't do anything, spybot nothing, MS antispyware doesn't fix it.
This roundabout way is the only way I know how to fix this. Though, I'm presently (unless someone beats me to it) making a program that is a bit more optimized.
The hard part is that not everything in those logs are considered bad.
I already have at home a batch file that does exactly the same as findit, except it is a bit more friendly. Also, it autocreates a batch file that needs to be run to fix these issues. But, it still needs some work. Like some error level checks.
I've been writing batch files for about 10 years. My favourite ones were when ansi.sys was popular......
Internet Gateway problem
Index