fakealert-b removal help

[chrisrivera]

Here is what hijackthis reports, can anyone please help?

Logfile of HijackThis v1.99.1
Scan saved at 8:58:55 PM, on 6/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Common Files\AOL\1139350117\ee\AOLSoftware.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Finale 2005\FINALE.EXE
C:\WINDOWS\system32\dcomcfg.exe
C:\WINDOWS\system32\atmclk.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chris\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1139350117\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - [url]http://wwws.musicmatch.com/mmz/openWebRadio.html[/url] (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - [url]http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab[/url]
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: M-Audio Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe (file missing)

[Budfred]

Welcome to http://www.pcguide.com/ubb/pcgubb.gif

Please run this:

Please download SmitfraudFix (http://siri.urz.free.fr/Fix/SmitfraudFix.zip) (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm (http://www.beyondlogic.org/consulting/processutil/processutil.htm)

[chrisrivera]

Thanks for the quick reply!!

SmitFraudFix v2.53

Scan done at 22:10:24.64, Sun 06/04/2006
Run from C:\Documents and Settings\Chris\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\atmclk.exe FOUND !
C:\WINDOWS\system32\dcomcfg.exe FOUND !
C:\WINDOWS\system32\hp???.tmp FOUND !
C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\regperf.exe FOUND !
C:\WINDOWS\system32\simpole.tlb FOUND !
C:\WINDOWS\system32\stdole3.tlb FOUND !
C:\WINDOWS\system32\1024\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Chris\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Chris\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\PestTrap\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

[Budfred]

It would be a good idea to print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

[chrisrivera]

Everytime I restart in Safe mode, it appears that once Windows starts up my keyboard becomes disabled. It wont let me type anything. I can start smitfraudfix.cmd by double clicking on it, but then when I try to select clean (by typing 2), my keyboard does not work. Nor does it work with any other applications.

[mjc]

Are you using a USB keyboard?

If so, do you have a PS/2 one that you can beg, borrow, steal (only for a few minutes)?

[Budfred]

Do you have a USB keyboard?? If so you probably need to go into the BIOS and enable USB at boot... I am not sure what the exact item is... If that won't work, you may need to find a PS2 keyboard to work this out...

Edit to note that great minds think alike!! :D :D

[chrisrivera]

ill see if I can find one today.

[chrisrivera]

Just checked again,
I do NOT have a USB keyboard. The keyboard has a round plug, assuming that is the PS2 keyboard?

[Budfred]

Okay, I am going to seek some assistance from the people who developed the tool... I have not heard of the keyboard being disabled by the malware, so I don't know what it going on here...

[chrisrivera]

should I try this?
http://www.jsifaq.com/subE/Tip2400/rh2423.htm

[mjc]

I would open regedit and look at those keys...and then if missing/different run the fix.

[chrisrivera]

my registry settings appear to be OK for the mouse and keyboard. Any other suggestions?

[chrisrivera]

I also have a pup called dialer-269 which I can not get rid of.

[Budfred]

Is a "pup" a popup??

The main developer of the tool suggests to run it in Normal Mode... After you do that, reboot to Safe Mode and see if the keyboard will work... Post the logs when you get back to Normal Mode...

[chrisrivera]

UPDATE:

McAfee has stopped telling me that there is the "fakealert-b" virus.

However, I keep getting a fake system alert (exclamation point flashing in a yellow triange, bottom right of the computer screen).

It says: System Alert: pop ups, your computer is infected with spyware managing pop-ups (OHPE ver 4.12_23). Click the icon to see what you can do about pop-ups and other unwanted software.

Im pretty sure this isn't an actual Windows system alert.

Any suggestions?

[mjc]

Grab Process Explorer (http://www.sysinternals.com/Utilities/ProcessExplorer.html)

Under View => Select columns and uncheck every thing (under Process Image and Process Performance) except PID and Description. Then under File => Save As. It will save a txt file, open that file in notepad, then copy and paste the contents here...

[chrisrivera]

Process PID Description
System Idle Process 0
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
SMSS.EXE 848 Windows NT Session Manager
CSRSS.EXE 904 Client Server Runtime Process
WINLOGON.EXE 928 Windows NT Logon Application
SERVICES.EXE 972 Services and Controller app
SVCHOST.EXE 1140 Generic Host Process for Win32 Services
MpfAgent.exe 1256 McAfee Personal Firewall Agent Interface
mcagent.exe 1428 McAfee SecurityCenter Agent
Playlist.exe 3396 Roxio AudioCentral Media Manager Playlist
mcvsftsn.exe 2400 McAfee VirusScan Instant Messenger Scan Module
SVCHOST.EXE 1188 Generic Host Process for Win32 Services
SVCHOST.EXE 1228 Generic Host Process for Win32 Services
wuauclt.exe 580 Automatic Updates
SVCHOST.EXE 1352 Generic Host Process for Win32 Services
SVCHOST.EXE 1384 Generic Host Process for Win32 Services
LEXBCES.EXE 1628 LexBce Service
LEXPPS.EXE 1672 LEXPPS.EXE
spoolsv.exe 1664 Spooler SubSystem App
avgamsvr.exe 1808 AVG Alert Manager
avgupsvc.exe 1824 AVG Update Service
avgemc.exe 1836 AVG E-Mail Scanner
CTSVCCDA.EXE 1864 Creative Service for CDROM Access
Mcdetect.exe 1952 McAfee WSC Integration Service
McShield.exe 1984 On-Access Scanner service
McTskshd.exe 148 McAfee Task Scheduler
MpfService.exe 264 McAfee Personal Firewall Service
wdfmgr.exe 468 Windows User Mode Driver Manager
MsPMSPSv.exe 516 WMDM PMSP Service
ALG.EXE 220 Application Layer Gateway Service
iPodService.exe 3072 iPodService Module
SVCHOST.EXE 836 Generic Host Process for Win32 Services
LSASS.EXE 984 LSA Shell (Export Version)
EXPLORER.EXE 1248 Windows Explorer
dcomcfg.exe 2152
atmclk.exe 2196
DrgToDsc.exe 2304 Drag To Disc Application
RxMon.exe 2348 Roxio AudioCentral Media Manager Tray App
mcvsshld.exe 2408 McAfee VirusScan ActiveShield Resource
McVSEscn.exe 2620 McAfee VirusScan E-mail Scan Module
oasclnt.exe 2416 McAfee VirusScan OAS Client
aolsoftware.exe 2428 AOL
iTunesHelper.exe 2444 iTunesHelper Module
qttask.exe 2576 QuickTime Task
hkcmd.exe 2824 hkcmd Module
igfxpers.exe 3144 persistence Module
avgcc.exe 3408 AVG Control Center
3e8939c.exe 3896
msmsgs.exe 3904 Windows Messenger
AcroTray.exe 4060 AcroTray
hijackthis.exe 2616 HijackThis
NOTEPAD.EXE 3380 Notepad
firefox.exe 1332 Firefox
procexp.exe 2256 Sysinternals Process Explorer
PRISMSVR.exe 1312 PRISM Profiles Server Module

[mjc]

Ok, go back under the Select columns and add Image Path (Process Image)...then find the path for this one...3e8939c.exe and any other info on it you can find (right click => Properties)

Also, kill this process and see if the alert disappears... msmsgs.exe

Also dcomcfg.exe and atmclk.exe are adware/spyware and will need to be removed.

[Budfred]

Did you run the SmitfraudFix in Normal Mode?? If so, please post the log...

[vbsvictom]

My laptop just got hit w/ VBS/fakealert-ab virus. The instrustions in this thread are not working as the scan step is getting an access violation. I dont know where the error report is being written. I should have admin rights on this box.

any thoughts?

thanks Rich

[Budfred]

Welcome to http://www.pcguide.com/ubb/pcgubb.gif

Please start your own thread in this subforum...

A HijackThis log would be helpful... If you can't produce one, please provide as much detail as possible...