Help needed, HJT log here, need rid of CELLDORADO malware

Hello weegieq,

Please re-run Navilog1 Option 1
---------------------------------------
Navilog1 for Vista

Option #1:

Make sure the UAC-User Account Control is turned off.

• Right-click Navilog1 shortcut on Desktop and choose "Run as Administrator".
• On main menu, choose 1
• Follow the instructions and wait.
• Wait for the *** Search completed *** message (It may take a reasonable amount of time)
• Press any key as requested.
• A new notepad document will be produced: fixnavi.txt.
• Please copy/paste the contents of this report in your next reply.

The report fixnavi.txt is also saved in %systemdrive%. (usually C:\)
---------------------------------------
Note: Remember to run the tool as Administrator if you have problems with it.

BLACKLIGHT

• Please download F-Secure Blacklight (fsbl.exe) from here
• Save into C:\ with a name of fsbl.exe
• Go to Start > Run
• Copy and paste the contents of the below codebox into the run box
  

  C:\fsbl.exe /expert

• Click OK
• This will launch BlackLight
• Select I accept the agreement
• Click Next
• Click Scan
• Wait for the scan to finish
• Click on Next>
• Click Exit
• A logfile will have been created in the C:\ drive
• It will be named fsbl-xxxxxxxxxxxxxx.log where xxxxxxxxxxxxxx is the date and time of the scan
• Use notepad to open that log
• Post the contents of that log as a reply to this topic.

---------------------------------------
Post back both reports.

hi
I still seem to have problems with navilog1 as its been running for 90mins without completing. Although whilt i was looking thru some files i found a new fixnavi document created just 13 minutes after I had lanched option 1 of Navilog1. Here are the contents of that document

Search Navipromo version 3.5.1 began on 04/04/2008 at 16:23:22.16

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Actual User Account : "ANDREW"

Updated on 23.03.2008 at 22h00 by IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Version Internet Explorer : 7.0.6001.18000
Filesystem type : NTFS

Done in normal mode

*** Searching for installed Software ***




*** Search folders in C:\Windows ***



*** Search folders in C:\Program Files ***


*** Search folders in C:\ProgramData ***


*** Search folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***


*** Search folders in c:\users\andrew\appdata\roaming\microsoft\windows\start menu\programs ***


*** Search folders in C:\Users\ANDREW\AppData\Local\virtualstore\Program Files ***

...\InternetGameBox found !


*** Search folders in C:\Users\ANDREW\AppData\Roaming ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

Hidden file(s) :

C:\Program Files\Navilog1\Backupnavi\qjocawhseg.dat
C:\Program Files\Navilog1\Backupnavi\qjocawhseg.exe
C:\Program Files\Navilog1\Backupnavi\qjocawhseg_nav.dat
C:\Program Files\Navilog1\Backupnavi\qjocawhseg_navps.dat
C:\Users\ANDREW\AppData\Local\qjocawhseg.dat
C:\Users\ANDREW\AppData\Local\qjocawhseg.exe
C:\Users\ANDREW\AppData\Local\qjocawhseg_nav.dat
C:\Users\ANDREW\AppData\Local\qjocawhseg_navps.dat
C:\Program Files\Navilog1\Backupnavi\qjocawhseg.dat
C:\Program Files\Navilog1\Backupnavi\qjocawhseg.exe
C:\Program Files\Navilog1\Backupnavi\qjocawhseg_nav.dat
C:\Program Files\Navilog1\Backupnavi\qjocawhseg_navps.dat
C:\Users\ANDREW\AppData\Local\qjocawhseg.dat
C:\Users\ANDREW\AppData\Local\qjocawhseg.exe
C:\Users\ANDREW\AppData\Local\qjocawhseg_nav.dat
C:\Users\ANDREW\AppData\Local\qjocawhseg_navps.dat



*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in C:\Windows\system32 *

I am now currently running F-secure backlight and will post report when available

Hi

FSBL has now completed without finding any infections. here is the log

04/04/08 17:17:37 [Info]: BlackLight Engine 1.0.70 initialized
04/04/08 17:17:37 [Info]: OS: 6.0 build 6001 (Service Pack 1)
04/04/08 17:17:37 [Note]: 7019 4
04/04/08 17:17:37 [Note]: 7005 0
04/04/08 17:17:59 [Note]: 7006 0
04/04/08 17:17:59 [Note]: 7022 0
04/04/08 17:17:59 [Note]: 7027 0
04/04/08 17:17:59 [Note]: 7035 0
04/04/08 17:17:59 [Note]: 7026 0
04/04/08 17:18:00 [Note]: 7026 0
04/04/08 17:18:08 [Note]: FSRAW library version 1.7.1024
04/04/08 17:26:18 [Note]: 7007 0

Hello weegieq,

This is really stubborn.

Please try to run Navilog1 Option #2 one more time.

Disable UAC-User Account Control (Please remember to re-enable it afterwards when disinfection is complete):

Remember to run the tool as Administrator.

See my instructions here:
http://www.malwareremoval.com/forum/viewtopic.php?p=282646#p282646
Please note that if the report doesn't open you can find it here:
%SystemDrive%\cleannavi.txt.. (usually C:\cleannavi.txt)

Because you should have many saved files from the tool, please see the date and time you run it, and post back the proper one.
It will be in the heading of the report. - See example from previous run of the tool.

Search Navipromo version 3.5.1 began on 04/04/2008 at 16:23:22.16

If this fails we'll run another tool to remove it.

Hi

I just tried running option2 under administrator right with UAC off and it failed as it said i had to complete option1 first. Because of this I can't post any log.

Its driving me up the wall, but i want u toknow im really greatful fr all ur help. theres no need for u to help me but ur being patient and doin all can.

thanks

Hi,

It seems that last time Option #1 was stuck, didn't run.
We'll try another tool.
----------------------------------------------
Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.

• Download this file from one of the three below listed places and place it at your DESKTOP :
  For information regarding this download, please visit this webpage:
  http://www.bleepingcomputer.com/combofix/how-to-use-combofix
  
  http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  http://www.forospyware.com/sUBs/ComboFix.exe
  http://subs.geekstogo.com/ComboFix.exe
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Then double click combofix.exe & follow the prompts. << If you are using Windows Vista you must right click on the desktop icon and choose Run as Administrator.
• When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

hi

jut before i do the next steps, i htought id make u aware ive just restarted the laptop and windows defender has shown a change. its called guxhpiy.exe, its asking whether i should permit this and my 1st instinct is not to as have no idea what it is, but if its from one of the programmes i feel i should alow it

any idea wat i should do

"weegieq" wrote:hi

jut before i do the next steps, i htought id make u aware ive just restarted the laptop and windows defender has shown a change. its called guxhpiy.exe, its asking whether i should permit this and my 1st instinct is not to as have no idea what it is, but if its from one of the programmes i feel i should alow it

any idea wat i should do

Do not permit it. Your infection is re-creating new files. You see this infection each time creates new files each time a pc starts.

It's not from the program. Please proceed with Combofix, and post the report back, together with a new HijackThis log, which i forgot to ask in my previous post.

thanks

one last thing im not entirely sure how to stop AVG (freeversion) whilst I do combo fix do u know how
im currently looking on the AVG website for help. im only asking in case u know

sorry got it know - next post will be combo fix log

Hi

I cant seem to get combofix to run. ive turned off all antispyware, firewall, antvirus software. I read thru the instructns to use it right click run as administrator, when i do this a small box opens and a bar fills up from left to right with green, then the desktop icons go blank then reset back to there original colours/icons but nohing happens.

Weegieq

Hi,

sorry i couldn't answer before it looks we have different times.
I signed out, it was late night here.
Before i explain to you to re-try Combofix try this first:
----------------------------------------------
REMOVE PROGRAMS-VISTA

• Go to start > control panel > programs and features.
• Right click on each instance of:
  
  InternetGameBox
  
• Click Uninstall & then follow the prompts to remove it.

----------------------------------------------
Show All Files And Folders in Vista
Now you need to show all files and folders

• Click Start.
• Open My Computer.
• Select the Organise menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Show hidden files and folders.
• Uncheck Hide file extensions for known file types
• Uncheck the Hide protected operating system files (recommended) option.
• Click Yes to confirm.
• Click OK.

Remember to re-hide them when you are done!
----------------------------------------------
Now we need to do a search.
Start > Search > For Files and Folders.
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this into the Search for files and folders named box:

InternetGameBox

If any of these files are found please delete them.
----------------------------------------------
Download and Run OTMoveIt2

Download OTMoveIt2 by Old Timer and save it to your Desktop.

• Double-click OTMoveIt2.exe to run it.
• Copy the lines in the codebox below.

C:\Users\ANDREW\AppData\Local\qjocawhseg.exe

C:Program Files\InternetGameBox

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt2

If OTMoveIt2 says it will remove the file on reboot, please reboot your pc.
----------------------------------------------
Post back any problems you had doing so, and OTMoveIt2 results.
I need also a new HijackThis log.
Still Pop-ups/redirections?

Lack of Response