Major Myspace Virus(es), PLEASE HELP

Question

Jeni 0 Newbie Poster

19 Years Ago

Hi,
Im new here, did a google search on myspace viruses and found DaniWeb :). I hope hope hope someone can help. I can get to other sites but am completely unable to access the myspace website at all, get popups like crazy, and cannot access yahoo messenger of which I was able to about an hour ago or so. The computer was cleaned out by a friend who works on computers on the side and supposedly he wasn't able to get everything out and the virus(es) infected his system as well. Any help at all would be greatly appreciated.

Thanks,
Jeni

virus-malware

1 Contributor
1 Reply
264 Views
6 Hours Discussion Span
Latest Post 19 Years Ago Latest Post by Jeni

Dani AI

Generated 9 Months Ago

— The symptoms you described plus the HijackThis output point to a persistent browser/IM hijack and a dropped system DLL that’s keeping redirects and popups alive. Immediate containment and a careful, staged cleanup will give the best chance of recovery without losing data or exposing accounts.

Immediately isolate the PC: disconnect Ethernet and disable Wi‑Fi. Do not use that machine to log into email, banking, or social sites until it’s cleaned.
From a known‑clean computer, download reputable removal tools to removable media (examples: Malwarebytes, an adware cleaner, Sysinternals Autoruns, and a rescue/bootable scanner), then boot the infected machine into Safe Mode and run full scans (do not rejoin the network until scans finish).
Check and restore these (common persistence points): browser proxy/home/search settings, the Windows hosts file, startup entries (use Autoruns rather than manually editing the registry if unsure), and scheduled tasks. Flush DNS with ipconfig /flushdns. Remove anything obviously bogus but do not delete system files unless you know what they are.
If scans remove malware but behavior persists, run a boot‑time rescue scan from a trusted rescue ISO (offered by major AV vendors) or consider an offline scan from a reliable rescue environment.
If the infection is deeply rooted (unknown DLLs in system folders or repeated re‑infections), back up personal data (documents, pictures — not executables), wipe and reinstall Windows from trusted media, then restore files after scanning them on a clean system.

After cleanup, on a separate clean device change all important passwords (email, MySpace/Yahoo, banking), enable two‑factor where available, update Windows and all software, and reinstall patched versions of IM clients. Because your friend’s machine was also affected, treat any shared media or networked systems as suspect and clean them the same way.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Jeni 0 Newbie Poster · Answer 1 · 2006-10-26T04:01:44+00:00

Here is my hjt log....

Logfile of HijackThis v1.99.1
Scan saved at 5:11:33 PM, on 10/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\admin\Desktop\hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O21 - SSODL: Objexapi - {0371B892-E144-4AB6-B630-A240F4C83D74} - C:\WINDOWS\system32\ipvitcrt.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

Hi,
Im new here, did a google search on myspace viruses and found DaniWeb :). I hope hope hope someone can help. I can get to other sites but am completely unable to access the myspace website at all, get popups like crazy, and cannot access yahoo messenger of which I was able to about an hour ago or so. The computer was cleaned out by a friend who works on computers on the side and supposedly he wasn't able to get everything out and the virus(es) infected his system as well. Any help at all would be greatly appreciated.
Thanks,
Jeni