Unable to run AppplicationsSolved/Closed

Question

I think I have been infected by a virus! 
1. On start up I get a script error 80070002 saying C:\WINDOWS\run.vbs.
2. I am unable to access many web pages- I get messages saying DNS look up failed
3. I am unable to run the malware applications that I downloaded via my other network PC and transferred onto the infected one. It just doesn't allow me to go through the set up!
I have Windows 8.1.
Can you please help with step by step instructions?
Many thanks! 
Bill

Ambucias · Answer

To help you and prescribe the remedy, I must make a diagnostic and to do so, I require a report. 

1. Open this link and download ZHPDiag : 
https://nicolascoolman.eu
(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message, ignore it.)  Click on the download button

2. Save the file on your Desktop. 

3. Double click on ZHPDiag.exe and follow the installation instructions. 

(For Vista, Win 7 and 8 users, click right to ensure you execute with admin right) 

4. Double click on the short cut ZHPDiag on your Destktop. 

5 Click on scan
Wait for the tool to finished (maybe a long time) 

6. Close ZHPDiag. 

7. To transmit the report, click on this link : 

https://authentification.site 

8. Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt).
9. Copy the url link obtained from Speedyshare and paste it here in your reply.
Ambucias
Moderator and Virus/Security Contributor

Ambucias · Answer

Hello, 

Should I call you Bill?  No wonder you are having problems!  Thank you for this interesting case.

You are correct, you DNS Host has been hijacked ! In conjunction with the hijacking is a Heuristic Trojan Horse (graftor), a proxy hijacker and to top it all off heuristic install core, not to mention the adware and spyware.

I can see any active antivirus programme !!!

Since your computer is on a network with another computer, I will ask that you run the following tool on both computers as malware can sometimes cross over.

The following tool (ZHPCleaner) will do most of the rough job and should remove the hijackers.  The tool is safe for all of your data.

1. Download it and run it on both computers

https://nicolascoolman.eu

2. Post the Cleaner"s report on this thread and then upload a new ZHP Diag report on Speedyshare.

3. Once I have analyzed your reports and shall be able to instruct you to clean the rest of dirt and make make your computer safer.

As they used to say in the army, ruts a ruck!

Ambucias · Answer

Hi Bill I suggest that you wait for my instructions before you attempt any repair. Is AVG on the ill computer ? I can't see it! Here is what to do next: 1. Download ZHPFix here (don't if you already have it) https://nicolascoolman.eu 2. Select and copy all of the following bold lines. Script ZHPFix FirewallRaz EmptyPrefetch EmptyTemp EmptyFlash [MD5.175A7595301DBF137164E78BC52696B4] - 04/06/2016 - (.Microsoft Corporation - DNS Client API DLL.) -- C:\WINDOWS\System32\dnsapi.dll [657920] [MD5.B821C83022E932DBE2C0BA7AE7562A7F] - 04/06/2016 - (.Microsoft Corporation - DNS Client API DLL.) -- C:\WINDOWS\Syswow64\dnsapi.dll [498688] O23 - Service: Object Mobile (pejykurozbt) . (...) - C:\Program Files (x86)\4C4C4544-1465092403-4210-804B-CAC04F305831\knsv164B.tmpfs (.not file.) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/ R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback> R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877 R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback> R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877 O4 - HKLM\..\Run: [WINCOMSG6] C:\Program Files (x86)\browseextension\wincom_SG6.exe (.not file.) O4 - HKLM\..\Run: [cpuminer] C:\Users\AviandNowshir\AppData\Roaming\cpuminer\cpm.exe (.not file.) O20 - AppInit_DLLs: . (.Client Connect LTD - Search Protect.) - C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll O42 - Logiciel: Search Protect - (.Client Connect LTD.) [HKLM][64Bits] -- SearchProtect HKLM\SOFTWARE\Wow6432Node\SearchProtect 3 - CFD: 07/06/2016 - [] D -- C:\Program Files (x86)\SearchProtect 3 - CFD: 07/06/2016 - [] D -- C:\Users\AviandNowshir\AppData\Local\app 3 - CFD: 06/06/2016 - [] D -- C:\Users\AviandNowshir\AppData\Local\SearchProtect HKLM\SYSTEM\CurrentControlSet\Services\pejykurozbt C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll C:\Users\AviandNowshir\AppData\Local\app C:\Users\AviandNowshir\AppData\Local\SearchProtect 3 Close all applications and open ZHP Fix 4. Click on the Import button and the lines will automatically paste themselves. 5. Click on the Go button to clean 6. Confirm by clicking OK 7. ZHP Fix will ask if you wish to empty the bin, click on your choice...it may take time 8. A report will appear on your desktop and on C:\ZHP\ZHPFix[R1].txt which you can copy and paste in your reply.

Ambucias · Answer

Bill,

You have not followed the ZHP Fix instructions properly, have clicked on "GO" to confirm the cleaning?

Run ZHP Fix again and insure you follow the procedure.

Have you, as I indicated before, ran ZHP Cleaner on the other computer? As I mentioned, since the DNS and Proxies were hacked, the other computer may also have been infected and contaminated the present computer or vice versa.

The reason you had problems with Chrome is because it was also attacked.

I also suggest that you urgently change your Wifi password.

You should have no more than one antivirus software.  Antivirus software all have their own scanning engines and .dat files, they may come in conflict and create false positive reports and sometimes let malware through.

To answer your question, no, there is no antivirus software free or otherwise that will clean all of this malware.  The best thing is to have one good antivirus, a good firewall and best of all, avoid taking risks on the net such as downloading torrents such as you have done.  The best antivirus suites that I have used are not free, but they are worth it, they may warn you against reaching a site or downloading a file. Some malware can actually ruin an operating system or hack your data for a ransom.

Can you please upload a last ZHP Diag, I will tell you if AVG is correct.

Regards

Ambucias · Answer

The good computer is clean.

The next step should be the final one.

Please run ZHPFix again with the following bold lines:

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877
3 - CFD: 0 - [0] D -- C:\WINDOWS\System32\Config\systemprofile\AppData\Local\BugFixxer
C:\WINDOWS\System32\Config\systemprofile\AppData\Local\BugFixxer
O23 - Service: Befhu (Befhu) . (...) - C:\Users\AviandNowshir\AppData\Roaming\InarCodmo\Usomideb.exe (.not file.)
O23 - Service: Windows CpuHeatMapping (CpuHeatMapping) . (...) - C:\WINDOWS\system32\CpuHeatMapping2200\CpuHeatMapping.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [TaskName] (...) -- Task To Run (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [16811073] (...) -- C:\Program Files (x86)\quietude\observatories.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [26811073] (...) -- C:\Program Files (x86)\quietude\observatories.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [a16932095] (...) -- C:\Program Files (x86)\somoza\grooved.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [a21Afg0MBVlgmyCdfZzMC-ni-2016-06-04-ni-17657-ni-1] (...) -- C:\Program Files (x86)\somoza\grooved.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [b16932095] (...) -- C:\Program Files (x86)\quietude\observatories.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [d21Afg0MBVlgmyCdfZzMC-ni-2016-06-04-ni-17657-ni-1] (...) -- C:\Program Files (x86)\somoza\grooved.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
[MD5.00000000000000000000000000000000] [APT] [Pa5422917354229173] (...) -- C:\Program Files (x86)\engrained\cyberspace.exe (.not file.)   [0] (.Activate.)  =>.Superfluous.Empty
O39 - APT: 16811073 - (...) -- C:\WINDOWS\System32\Tasks\16811073  [3670]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: 26811073 - (...) -- C:\WINDOWS\System32\Tasks\26811073  [3810]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: a16932095 - (...) -- C:\WINDOWS\System32\Tasks\a16932095  [4346]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: a21Afg0MBVlgmyCdfZzMC-ni-2016-06-04-ni-17657-ni-1 - (...) -- C:\WINDOWS\System32\Tasks\a21Afg0MBVlgmyCdfZzMC-ni-2016-06-04-ni-17657-ni-1  [3874]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: b16932095 - (...) -- C:\WINDOWS\System32\Tasks\b16932095  [4362]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: d21Afg0MBVlgmyCdfZzMC-ni-2016-06-04-ni-17657-ni-1 - (...) -- C:\WINDOWS\System32\Tasks\d21Afg0MBVlgmyCdfZzMC-ni-2016-06-04-ni-17657-ni-1  [3734]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: Pa5422917354229173 - (...) -- C:\WINDOWS\System32\Tasks\Pa5422917354229173  [3682]  (.Orphan.)  =>.Superfluous.Orphan
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = http://ww1.protectedio.com  =>.Superfluous.ProtectedIO
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = http://ww1.protectedio.com  =>.Superfluous.ProtectedIO
O2 - BHO: Fevkajvirtysd Helper [64Bits] - {59247F99-02BA-4BE3-a0FD-6644871846C7} . (...) -- C:\Program Files\Fevkajvirtysd\Thgislhd.dll (.not file.)
O4 - HKLM\..\Run: [WINCOMQVV] C:\Program Files (x86)\mpck\wincom_QVV.exe (.not file.)
O4 - HKCU\..\Run: [notting] C:\Program Files (x86)\engrained\cyberspace.exe (.not file.)
O4 - HKUS\S-1-5-21-4094268032-3782436370-3926604989-1001\..\Run: [notting] C:\Program Files (x86)\engrained\cyberspace.exe (.not file.)
HKLM\SOFTWARE\Wow6432Node\MPC
HKLM\SOFTWARE\Wow6432Node\SlimWare Utilities, Inc.  =>.Superfluous.SlimWareUtilities
O43 - CFD: 04/06/2016 - [] D -- C:\ProgramData\boost_interprocess
O43 - CFD: 27/05/2015 - [0] D -- C:\Users\AviandNowshir\AppData\Local\dadi
O43 - CFD: 04/06/2016 - [0] D -- C:\Users\AviandNowshir\AppData\Local\Tempfolder
O43 - CFD: 0 - [0] D -- C:\WINDOWS\System32\Config\systemprofile\AppData\Local\AutoUpdate
HKLM\SOFTWARE\Wow6432Node\SlimWare Utilities, Inc.  =>.Superfluous.SlimWareUtilities

If you wish a popular and fairly good free antivirus for your lappy, I suggest:

https://ccm.net/downloads/security-and-maintenance/4611-avast-free-antivirus-for-pc/

If you have not paid for Malwarebyte, I suggest you remove it because the free version does not offer real time protection.

Catch you later

Paste the log here when finished

Ambucias · Answer

Hi Bill,

The registry lines I was mostly concerned about are these:

R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877 

They were part of the hyjacking.

I haven't used IE for years and I don't use Windows Edge either.  Firefox does the trick and I find it safer.

No, don't try to activate Windows Defender, it would be useless.

As I mentioned before, you should have only one antivirus programme or you get conflicts.  Avast is always free but if you are ever looking for a paid antivirus suite, I usually recommend F-Secure, Kaspersky or McAfee and to stay away from Norton Symantec.

Yes you can delete all of the ZHP stuff including ZHP Cleaner because updates and upgrades are frequent.

CCM: I am a long time member who went up the ladder.

Helping you was all my pleasure and I won't share it anyone else !  Thank you for your patience and trust as well as your prompt responses.

Unable to run Appplications

6 responses

Similar discussions

Subscribe To Our Newsletter!