BleepingComputer.com: Firefox, yahoo, and AIM will not connect to the internet

i recently downloaded some music from a few seedy looking sites (big mistake) and caught the Tool Security 2009 virus (basically it keeps spamming fake virus scan results and virus warnings until i guess you buy thier product) it disabled my task manager and would not allow me to connect to any sites its said both functions were infected and blocked from being accessed. So i rebooted my laptop (it runs XP by the way) and got the superantispyware program and ran it. The program found the infections and got rid of them. as far as i can tell the virus is gone but everytime i start my computer i get 2 DLL error messages that read "error loading C:\windows\system32\mefuholu.dll the specified module couldnot be found" and the other says "error loading C:\windows\system32\beholeho.dll the specified module couldnot be found" and none of my instant messengers will connnect and firefox wont load any content i cant navigate to any page it is always just blank and the url for whatever website i click on my fav bar wont even show in the address bar. I have ABSOLUTLEY no idea what to do about this problem. I'm using my brothers desktop to post this so if anyone could reply ASAP i would really appreciate any and all help.

Thanks Again
Gear.

I am moving this topic to the Am I Infected forum for you.

Hello and welcome to Bleeping Computer.

Please subscribe to your topic so that you will be notified as soon as I post a reply, instead of you having to check the topic all of the time. This will allow you to get an email notification when I reply.

To subscribe, go to your topic, and at the top right hand corner by your first post, click the Options button and then click Track this topic. The bullet the immediate notification bubble. Then press submit.

Lets take a look with Malwarebytes

Please download Malwarebytes' Anti-Malware from here:
Malwarebytes
Please rename the file BEFORE downloading to zztoy.exe instead of mbam-setup.exe

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Double Click zztoy.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire MBAM report (even if it does not find anything) in your next reply

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


If Malwarebytes won't install or run

Some types of malware will disable MBAM and other security tools. If MBAM will not install, try renaming it. Right-click on the mbam-setup.exe file and change the .exe extension to .bat, .com, .pif, or .scr and then double-click on it to run.

If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files, right-click on mbam.exe and change the .exe as noted above. Then double-click on it to run.

Here is the log you requested sorry it took so long I don't usually have the time to do these kinds of things, work is pretty demanding. However, I am also sure you have things to do as well, and in knowing that I feel it proper to show my gratitude for your assistance and I thank you very much for helping. If there is anything you may need and i can supply it, you need but ask and i shall do all that i can to help.


Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 2

8/18/2009 11:39:05 AM
mbam-log-2009-08-18 (11-39-05).txt

Scan type: Full Scan (C:\|)
Objects scanned: 167275
Time elapsed: 1 hour(s), 18 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 6
Registry Data Items Infected: 9
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d7adf7c1-14fb-4110-b2df-187884cac12a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009 (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AVR (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fufezijero (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmfb15b966 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system tool (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svcho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msupdate (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\AdvancedVirusRemover (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\msupdate.exe (Worm.Emold) -> Delete on reboot.
C:\Documents and Settings\Joe\Local Settings\Temp\rdl1.tmp (Rootkit.Bezopi) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdlA.tmp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

You have a worm that spreads via USB. That means that any other computer that you have plugged your USB devices into may well be infected also.

Please download
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe
by sUBs and save it to your desktop.
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.
Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

And then please Update Malwarebytes by going to the Update tab. Your database is 2551, while the current as of this post is 2659. And then run a Quick Scan and post back the log.

This post has been edited by Computer Pro: 19 August 2009 - 04:58 PM

i cannot update the program as i STILL cannot access websited via any of my browsers

Please transfer this file from a noninfected computer to the infected one via USB drive or CD, then execute the file which should Update Malwarebytes:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe.

Then after it has updated, run a Quick Scan.

it updated but now the program wont run it says im lacking something

What is the exact message that it gives?

the message says " The database you are using is not supported by this version of malwarebytes anti-malware. Download the latest version of the program.

Ok, go to the Update Tab, and then Click on the Update button. Then after the update has completed, please run a Quick Scan.

If this doesnt work, then download the new version of Malwarebytes from here:

http://www.besttechie.net/tools/mbam-setup.exe

it worked, i ran a scan and heres the log. internet still malfunctioning BTW


Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2

11/1/2009 10:00:58 PM
mbam-log-2009-11-01 (22-00-58).txt

Scan type: Full Scan (C:\|)
Objects scanned: 187448
Time elapsed: 1 hour(s), 19 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Application Data\15005624 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joe\Start Menu\Programs\Total Security (Rogue.TotalSecurity) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Joe\Local Settings\Temp\n.exn (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\TO92Y0W9\load[1].php (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\AutoPlay Media Studio 7.0 Trial\Data\sfe.dat (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wupasegi.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WHM3SDQZ\exe[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\5LOWG4DH\SetupAdvancedVirusRemover[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\JVC59VTR\firewall[1].dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\15005624\15005624 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\15005624\pc15005624ins (Rogue.Multiple) -> Quarantined and deleted successfully.

Ok, lets run one more scan. This time make sure that you update Malwarebytes by going to the Update Tab. Then run a Quick Scan and post back the log.

i clicked update button and it gave me an error message which reads:


An error occured,. Please report the following error code to the malwarebytes' Anti-Malware support tam.

Error code: 732 (0, 0)

Ok, update the definitions through this:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe