Tech Support Forum - View Single Post

sUBs · 07-06-2005, 03:53 PM

Hi and Welcome to TSF!

Please subscribe to this thread to be notified of fixes as soon as they are posted by our Team. To do this, please click the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread".

You seem to have two software firewalls on your PC. That's a bad idea. Firewalls, alike antivirus programs do not coexist well. Please uninstall Sygate or Zone Alarm.

On the other hand, there seems to be no anti-virus application installed on this machine. Anti-virus programs protect against infections. Without one, you're vulnerable to every virus, spyware program, trojan and piece of malware that is floating around out there. I urge you to install an anti-virus program as quickly as possible. Please choose one from these 3 free programs that are available for home use:

It's better to print out the next instructions or save them in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.
It is also important you don't miss a step and perform everything in the right order!!.
If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are carrying out the procedures below.

Enable the viewing of Hidden files
* Open Windows Explorer
* Go to Tools > Folder Options > View tab.
* enable the option for `Show hidden files and folder´
* disable the option for `Hide file extensions for known types´
* disable the option for `Hide protected operating system files´
* click "Yes" to confirm & then click "OK"

Please download these additional files/programs :- (Do not run them unless instructed to do so)
Unplug your computer from the Internet when you have finished downloading

CleanUp! - Install

KillBox v2.0.0.175 - Save to Desktop.

~~~~~~~~~~~~~~~

Using KillBox

Copy to clipboard, all the items below by highlighting them & pressing [CTRL]+[C] on your keyboard.

C:\WINDOWS\system32\wsrchc3.dll
C:\WINDOWS\iisvers.exe
c:\\rraut.exe

Start KillBox.

Go to the [File] menu, and choose [Paste from Clipboard].
Verify that you've done this properly by clicking the dropdown-arrow next to the [Full Path of File to Delete] field. The filenames you pasted will be found in there.
Select/tick the following:
- "Delete on Reboot"
- "End Explorer Shell While Killing File"
- "Unregister.dll Before Deleting" if it's not grayed out.
Click the RED X button.
Click [Yes] at the 'Delete on Reboot' prompt. Click [Yes] at the Pending Operations prompt.

* If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

~~~~~~~~~~~~~~~

After it has rebooted, Run a scan with HiJackThis & select(tick) the following & click [Fix checked] :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sallins.wan/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: UB Class - {00000000-15D9-4736-AB29-131578A45F2B} - C:\WINDOWS\system32\wsrchc3.dll
O2 - BHO: blank - {3CC12C40-47EB-4705-8140-168ADC713E94} - blank (file missing)
O4 - HKLM\..\Run: [iisvers] C:\WINDOWS\iisvers.exe
O4 - HKLM\..\Run: [bluestart] c:\\rraut.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/07d784d8f6d04c...ip/RdxIE601.cab
O18 - Filter: text/html - (no CLSID) - (no file)

~~~~~~~~~~~~~~~

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:

Click [Options...]
Move the arrow down to [Custom CleanUp!]
Put a check next to the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- [X]Scan local drives for temporary files (Please uncheck this option)
- Cleanup! All Users
Click [OK]
Press the [CleanUp!] button to start the program. Reboot/logoff when prompted.

* CleanUp! will delete all the files in your temp folders

~~~~~~~~~~~~~~~

Do an online scan at one of the following sites:

Take note the names and locations of any file it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Run a new scan with HiJackThis. Save the log file and post the contents in your next reply.

In your next post, please include:

Copy of HiJackThis log
List of files that online scans failed to disinfect

Please provide details of any problems you encountered whilst performing the above steps.

Tell me how your computer behaves now

07-06-2005, 03:53 PM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,353 OS: N/A	Hi and Welcome to TSF! Please subscribe to this thread to be notified of fixes as soon as they are posted by our Team. To do this, please click the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread". You seem to have two software firewalls on your PC. That's a bad idea. Firewalls, alike antivirus programs do not coexist well. Please uninstall Sygate or Zone Alarm. On the other hand, there seems to be no anti-virus application installed on this machine. Anti-virus programs protect against infections. Without one, you're vulnerable to every virus, spyware program, trojan and piece of malware that is floating around out there. I urge you to install an anti-virus program as quickly as possible. Please choose one from these 3 free programs that are available for home use: AVG Anti-Virus Avast Home Edition BitDefender Free Edition v7 It's better to print out the next instructions or save them in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then. It is also important you don't miss a step and perform everything in the right order!!. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are carrying out the procedures below. Enable the viewing of Hidden files * Open Windows Explorer * Go to Tools > Folder Options > View tab. * enable the option for `Show hidden files and folder´ * disable the option for `Hide file extensions for known types´ * disable the option for `Hide protected operating system files´ * click "Yes" to confirm & then click "OK" Please download these additional files/programs :- (Do not run them unless instructed to do so) Unplug your computer from the Internet when you have finished downloading CleanUp! - Install KillBox v2.0.0.175 - Save to Desktop. ~~~~~~~~~~~~~~~ Using KillBox Copy to clipboard, all the items below by highlighting them & pressing [CTRL]+[C] on your keyboard. C:\WINDOWS\system32\wsrchc3.dll C:\WINDOWS\iisvers.exe c:\\rraut.exe Start KillBox. Go to the [File] menu, and choose [Paste from Clipboard]. Verify that you've done this properly by clicking the dropdown-arrow next to the [Full Path of File to Delete] field. The filenames you pasted will be found in there. Select/tick the following: "Delete on Reboot" "End Explorer Shell While Killing File" "Unregister.dll Before Deleting" if it's not grayed out. Click the RED X button. Click [Yes] at the 'Delete on Reboot' prompt. Click [Yes] at the Pending Operations prompt. * If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try Killbox again. ~~~~~~~~~~~~~~~ After it has rebooted, Run a scan with HiJackThis & select(tick) the following & click [Fix checked] : R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sallins.wan/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: UB Class - {00000000-15D9-4736-AB29-131578A45F2B} - C:\WINDOWS\system32\wsrchc3.dll O2 - BHO: blank - {3CC12C40-47EB-4705-8140-168ADC713E94} - blank (file missing) O4 - HKLM\..\Run: [iisvers] C:\WINDOWS\iisvers.exe O4 - HKLM\..\Run: [bluestart] c:\\rraut.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/07d784d8f6d04c...ip/RdxIE601.cab O18 - Filter: text/html - (no CLSID) - (no file) ~~~~~~~~~~~~~~~ Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: Click [Options...] Move the arrow down to [Custom CleanUp!] Put a check next to the following: Empty Recycle Bins Delete Cookies Delete Prefetch files [X]Scan local drives for temporary files (Please uncheck this option) Cleanup! All Users Click [OK] Press the [CleanUp!] button to start the program. Reboot/logoff when prompted. * CleanUp! will delete all the files in your temp folders ~~~~~~~~~~~~~~~ Do an online scan at one of the following sites: Panda BitDefender Trend Micro Take note the names and locations of any file it detects but fails to clean. * Turn off the real time scanner of any existing antivirus program while performing the online scan Run a new scan with HiJackThis. Save the log file and post the contents in your next reply. In your next post, please include: Copy of HiJackThis log List of files that online scans failed to disinfect Please provide details of any problems you encountered whilst performing the above steps. Tell me how your computer behaves now __________________ Question - what have you done for the community today?