Tech Support Forum - View Single Post

greyknight17 · 04-13-2006, 07:35 PM

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Make sure the word CURRENTVERSION below does not contain any spaces...
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\CONC]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\TTUNIM]
[-HKEY_CLASSES_ROOT\CCACCESS.CHECKCONTROL]

Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

Click on Start->Settings->Control Panel->Java Plug-in and click on the Cache tab. Then click on the Clear button and hit OK.
If you have Java 1.5, do this instead. Start->Control Panel->Java->Settings->Delete Files and click OK and OK.

Delete your Firefox temp files (Tools->Clear Private Data).

Download KillBox http://www.greyknight17.com/spy/KillBox.exe. Don't run it yet.

Please download Ewido Security Suite at http://www.ewido.net/en/download/.

1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'.
8. Exit Ewido. DO NOT scan yet.

If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually.

Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingcomputer.com/foru...howtutorial=61 ).

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

O2 - BHO: (no name) - {0B5F7FDF-0717-45BF-B49D-695F3168C7FE} - C:\WINDOWS\admparsel.dll
O2 - BHO: (no name) - {11111111-2222-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\netdde.dll
O2 - BHO: (no name) - {621D36CC-09F4-44F6-BA4C-C8FBEAA00207} - C:\WINDOWS\adsldpbk.dll (file missing)
O2 - BHO: C:\WINDOWS\adsldpbd.dll - {826B2228-BC09-49F2-B5F8-42CE26B1B711} - C:\WINDOWS\adsldpbd.dll (file missing)
O2 - BHO: (no name) - {8D82BB89-B58C-4F21-9C5D-377F65947806} - C:\WINDOWS\slassac.dll
O2 - BHO: C:\WINDOWS\q36171125_disk.dll - {B212D577-05B7-4963-911E-4A8588160DFA} - C:\WINDOWS\q36171125_disk.dll
O2 - BHO: (no name) - {C7CF1142-0785-4B12-A280-B64681E4D45E} - C:\WINDOWS\prflbmsgp32.dll (file missing)
O2 - BHO: (no name) - {DA223E41-3F7F-4B2B-8CC8-22C6A1197EEB} - C:\WINDOWS\mpatrol.dll
O2 - BHO: (no name) - {DF00FFA0-AEA9-4EA8-A10F-8BB9A7F8508C} - C:\WINDOWS\system32\adsldpbm.dll
O2 - BHO: (no name) - {EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6} - C:\WINDOWS\adsldpbj.dll (file missing)
O4 - HKLM\..\Run: [Olympic] C:\Documents and Settings\Owner\Application Data\sgrunt\IE4321.exe
O4 - HKLM\..\Run: [Parallel Tasking] C:\Program Files\Parallel Tasking\ptask.exe
O4 - HKCU\..\Run: [AlexaToolbar] C:\WINDOWS\alt.exe
O4 - HKCU\..\Run: [alexa] c:\windows\alexa.exe
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.contentcooler.biz
O15 - Trusted Zone: www.new-access.biz
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\system32\hk.dll
O20 - Winlogon Notify: st3 - C:\WINDOWS\system32\st3.dll
O20 - Winlogon Notify: style2 - C:\WINDOWS\q10840062_disk.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\q36171125_disk.dll

Locate and delete the following:

Now open Ewido and do a scan on your system.

* Click on scanner.
* Click on 'Complete System Scan' and the scan will begin.
* While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.
Exit Ewido when it's done.
* Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'.
* Click 'Save report'.
* Save the report to your desktop.

Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Right click and copy the below lines. Go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say Yes:

C:\windows\alexa.exe
C:\Program Files\Parallel Tasking\ptask.exe
C:\WINDOWS\SYSTEM32\clbcatix.dll
C:\Documents and Settings\Owner\Favorites\exsplorer.lnk
C:\Program Files\Parallel Tasking\
C:\WINDOWS\1.d
C:\WINDOWS\cpblpbc1.log
C:\WINDOWS\cpblpbc3.log
C:\WINDOWS\cpblpbc5.log
C:\WINDOWS\cpblpbc7.log
C:\WINDOWS\cpblpbc8.log
C:\WINDOWS\system32\abcd.exe
C:\WINDOWS\system32\checkIn.dll
C:\WINDOWS\admparsel.dll
C:\WINDOWS\netdde.dll
C:\WINDOWS\slassac.dll
C:\WINDOWS\q36171125_disk.dll
C:\WINDOWS\prflbmsgp32.dll (file missing)
C:\WINDOWS\mpatrol.dll
C:\WINDOWS\system32\adsldpbm.dll
C:\Documents and Settings\Owner\Application Data\sgrunt\IE4321.exe
C:\WINDOWS\alt.exe
C:\Documents and Settings\Owner\Application Data\sgrunt\
C:\WINDOWS\system32\hk.dll
C:\WINDOWS\system32\st3.dll
C:\WINDOWS\q10840062_disk.dll
C:\WINDOWS\q36171125_disk.dll

If you get a PendingOperations message, just close it and restart your computer manually.

Restart your computer to get back to Normal Mode. Post the Ewido report and a new HijackThis log here.

04-13-2006, 07:35 PM	#4 (permalink)
greyknight17 Analyst, Security Team Join Date: Jul 2004 Location: New York Posts: 14,331 OS: Windows 98 & Windows XP Home/Pro My System	Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. Make sure the word CURRENTVERSION below does not contain any spaces... Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad: REGEDIT4 [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\CONC] [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\TTUNIM] [-HKEY_CLASSES_ROOT\CCACCESS.CHECKCONTROL] Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff. Click on Start->Settings->Control Panel->Java Plug-in and click on the Cache tab. Then click on the Clear button and hit OK. If you have Java 1.5, do this instead. Start->Control Panel->Java->Settings->Delete Files and click OK and OK. Delete your Firefox temp files (Tools->Clear Private Data). Download KillBox http://www.greyknight17.com/spy/KillBox.exe. Don't run it yet. Please download Ewido Security Suite at http://www.ewido.net/en/download/. 1. Install Ewido Security Suite. 2. When installing, under 'Additional Options' uncheck: * Install background guard * Install scan via context menu 3. Launch Ewido, there should be an icon on your desktop, double click it. 4. The program will now open to the main screen. 5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment. 6. You will need to update Ewido to the latest definition files. * On the left hand side of the main screen click update. * Then click on Start Update. 7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'. 8. Exit Ewido. DO NOT scan yet. If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually. Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingcomputer.com/foru...howtutorial=61 ). Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one: O2 - BHO: (no name) - {0B5F7FDF-0717-45BF-B49D-695F3168C7FE} - C:\WINDOWS\admparsel.dll O2 - BHO: (no name) - {11111111-2222-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\netdde.dll O2 - BHO: (no name) - {621D36CC-09F4-44F6-BA4C-C8FBEAA00207} - C:\WINDOWS\adsldpbk.dll (file missing) O2 - BHO: C:\WINDOWS\adsldpbd.dll - {826B2228-BC09-49F2-B5F8-42CE26B1B711} - C:\WINDOWS\adsldpbd.dll (file missing) O2 - BHO: (no name) - {8D82BB89-B58C-4F21-9C5D-377F65947806} - C:\WINDOWS\slassac.dll O2 - BHO: C:\WINDOWS\q36171125_disk.dll - {B212D577-05B7-4963-911E-4A8588160DFA} - C:\WINDOWS\q36171125_disk.dll O2 - BHO: (no name) - {C7CF1142-0785-4B12-A280-B64681E4D45E} - C:\WINDOWS\prflbmsgp32.dll (file missing) O2 - BHO: (no name) - {DA223E41-3F7F-4B2B-8CC8-22C6A1197EEB} - C:\WINDOWS\mpatrol.dll O2 - BHO: (no name) - {DF00FFA0-AEA9-4EA8-A10F-8BB9A7F8508C} - C:\WINDOWS\system32\adsldpbm.dll O2 - BHO: (no name) - {EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6} - C:\WINDOWS\adsldpbj.dll (file missing) O4 - HKLM\..\Run: [Olympic] C:\Documents and Settings\Owner\Application Data\sgrunt\IE4321.exe O4 - HKLM\..\Run: [Parallel Tasking] C:\Program Files\Parallel Tasking\ptask.exe O4 - HKCU\..\Run: [AlexaToolbar] C:\WINDOWS\alt.exe O4 - HKCU\..\Run: [alexa] c:\windows\alexa.exe O15 - Trusted Zone: www.archiviosex.net O15 - Trusted Zone: www.contentcooler.biz O15 - Trusted Zone: www.new-access.biz O15 - Trusted Zone: www.redfunny.com O15 - Trusted Zone: www.skymasters.biz O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\system32\hk.dll O20 - Winlogon Notify: st3 - C:\WINDOWS\system32\st3.dll O20 - Winlogon Notify: style2 - C:\WINDOWS\q10840062_disk.dll O20 - Winlogon Notify: style32 - C:\WINDOWS\q36171125_disk.dll Locate and delete the following: Now open Ewido and do a scan on your system. * Click on scanner. * Click on 'Complete System Scan' and the scan will begin. * While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK. Exit Ewido when it's done. * Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'. * Click 'Save report'. * Save the report to your desktop. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Right click and copy the below lines. Go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say Yes: C:\windows\alexa.exe C:\Program Files\Parallel Tasking\ptask.exe C:\WINDOWS\SYSTEM32\clbcatix.dll C:\Documents and Settings\Owner\Favorites\exsplorer.lnk C:\Program Files\Parallel Tasking\ C:\WINDOWS\1.d C:\WINDOWS\cpblpbc1.log C:\WINDOWS\cpblpbc3.log C:\WINDOWS\cpblpbc5.log C:\WINDOWS\cpblpbc7.log C:\WINDOWS\cpblpbc8.log C:\WINDOWS\system32\abcd.exe C:\WINDOWS\system32\checkIn.dll C:\WINDOWS\admparsel.dll C:\WINDOWS\netdde.dll C:\WINDOWS\slassac.dll C:\WINDOWS\q36171125_disk.dll C:\WINDOWS\prflbmsgp32.dll (file missing) C:\WINDOWS\mpatrol.dll C:\WINDOWS\system32\adsldpbm.dll C:\Documents and Settings\Owner\Application Data\sgrunt\IE4321.exe C:\WINDOWS\alt.exe C:\Documents and Settings\Owner\Application Data\sgrunt\ C:\WINDOWS\system32\hk.dll C:\WINDOWS\system32\st3.dll C:\WINDOWS\q10840062_disk.dll C:\WINDOWS\q36171125_disk.dll If you get a PendingOperations message, just close it and restart your computer manually. Restart your computer to get back to Normal Mode. Post the Ewido report and a new HijackThis log here. __________________ Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D Anti-Spyware Tutorial :: Spyware Prevention Tools Last edited by greyknight17; 04-13-2006 at 07:36 PM.