|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
02-12-2005, 02:34 PM
|
#1 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
what a mess
Ran adaware, spybot and cw shredder.
Windows 98, please let me know. Thanks, W// Logfile of HijackThis v1.99.0 Scan saved at 4:37:53 PM, on 2/12/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\APPYC.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SOFT.EXE C:\WINDOWS\SYSTEM\NTGQ32.EXE C:\WINDOWS\TEMP\12B5.TMP.EXE C:\WINDOWS\SYSTEM\TIBS5.EXE C:\WINDOWS\SYSTEM\DDDD.EXE C:\RFKEBX.EXE C:\WINDOWS\ISRVS\DESKTOP.EXE C:\WINDOWS\SYSTEM\JAPHWM.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\PROGRAM FILES\WEB_REBATES\WEBREBATES0.EXE C:\WINDOWS\SYSTEM\LBOSXI.EXE C:\WINDOWS\SYSTEM\ELITEJLR32.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\WINDOWS\PACKAGER.EXE C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE C:\PROGRAM FILES\FINEPIXVIEWER\FINEPIXVIEWER.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.msn.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R3 - Default URLSearchHook is missing O2 - BHO: Class - {588BE118-7AD1-CA3F-D1EC-8EEC7376238F} - C:\WINDOWS\SYSTEM\NTJY.DLL O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITEJLR32.EXE O4 - HKLM\..\Run: [5jBhC] C:\RFKEBX.EXE O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O4 - HKLM\..\Run: [NTGQ32.EXE] C:\WINDOWS\SYSTEM\NTGQ32.EXE O4 - HKLM\..\Run: [12B5.TMP.EXE] C:\WINDOWS\TEMP\12B5.TMP.EXE 2 10001 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O15 - Trusted Zone: *.xxxtoolbar.com O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-12-2005, 08:27 PM
|
#2 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Hi and Welcome
It may help you if you print out or copy this page for easy reference.. Make sure to work through the fixes in the exact order its listed.If you don't understand please ask before proceeding with the fixes. Please Keep your browser and all open programs closed (except firewalls and antivirus) when you are carrying out the fixes. Please do not run HJT on the desktop or a temp folder.Its best run in a dedicated folder of its own. Turn off System Restore instructions (WinXP) Rightclick My Computer | Properties | System Restore | check “Turn off System Restore”, <Apply>, <OK>. Reboot. When we have confirmed that your log file is clean, you may renable System Restore and create a new restore point. SHOW HIDDEN FILES AND FOLDERS. To show hidden files instructions (WinXP) Doubleclick My Computer | Tools | Folder Options | View tab Select Show Hidden Files and Folders Uncheck Hide extensions for known file types Uncheck Hide protected operating system files (Recommended) Select Apply to All Folders | Yes | Apply | OK ------------------------------------------------------------------ Download and run CWShredder (check for updates) for a preliminary cleanup first.Some files below may not be present after running the above programs.Full instructions below. How to setup and run CWShredder Download from CWShredder v2.13 Choose the stand alone version. This is free. Save cwshredder.exe into its own directory, NOT in a TEMPorary folder or on the DESKTOP. I recommend, c:/program files/CWShredder/ Close all browsers Unzip into same directory Doubleclick CWSInstall.exe Click <Check for updates> and let it install all updates Click <Fix> If it asks you to delete a file, write down the whole path and file name and choose <No>. Post it to the forums. Click <Next> Close CWShredder. ------------------------------------------------------------------ Files highlighted in BLACK will need to be removed from your hard drive. Folders that have been highlighted RED will need to be uninstalled. ---------------------------------------------------------------- To help remove the Trusted Zones ownload and run DELDOMAINS then double click to open the DelDomains.inf .To execute the file: right-click and Select 'Install' from the Menu. ------------------------------------------------------------------ Please start by putting HJT in SAFE MODE. During reboot, tap the F8 key. Select Safe Mode ------------------------------------------------------------------ Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed. ELITEJLR32.EXE RFKEBX.EXE vtythzkf.exe NTGQ32.EXE 12B5.TMP.EXE 2 10001 VTYTHZKF.EXE JAPHWM.EXE DESKTOP.EXE SOFT.EXE TIBS5.EXE DDDD.EXE APPYC.EXE LBOSXI.EXE ISTSVC.EXE --------------------------------------------------- Uninstall these programs (if they still exist) from Start | Settings | Control Panel | Add/Remove Programs WEB_REBATES ISRVS ISTSVC ------------------------------------------------------------------- Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rlmzv.dll/sp.html#93256 R3 - Default URLSearchHook is missing O2 - BHO: Class - {588BE118-7AD1-CA3F-D1EC-8EEC7376238F} - C:\WINDOWS\SYSTEM\NTJY.DLL O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITEJLR32.EXE O4 - HKLM\..\Run: [5jBhC] C:\RFKEBX.EXE O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O4 - HKLM\..\Run: [NTGQ32.EXE] C:\WINDOWS\SYSTEM\NTGQ32.EXE O4 - HKLM\..\Run: [12B5.TMP.EXE] C:\WINDOWS\TEMP\12B5.TMP.EXE 2 10001 O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O15 - Trusted Zone: *.xxxtoolbar.com O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares...ysb_regular.cab O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab ------------------------------------------------------------------ Open Windows Explorer and delete the following highlighted file/s (or delete the whole (RED) folder if listed). C:\WINDOWS\SYSTEM\NTJY.DLL C:\WINDOWS\SYSTEM\ELITEJLR32.EXE C:\RFKEBX.EXE c:\windows\system\vtythzkf.exe C:\WINDOWS\SYSTEM\NTGQ32.EXE C:\WINDOWS\TEMP\12B5.TMP.EXE 2 10001 C:\WINDOWS\SYSTEM\LBOSXI.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\SYSTEM\JAPHWM.EXE C:\WINDOWS\ISRVS\DESKTOP.EXE C:\WINDOWS\SYSTEM\SOFT.EXE C:\WINDOWS\SYSTEM\TIBS5.EXE C:\WINDOWS\SYSTEM\DDDD.EXE C:\WINDOWS\SYSTEM\APPYC.EXE C:\PROGRAM FILES\WEB_REBATES\ C:\WINDOWS\ISRVS\ C:\PROGRAM FILES\ISTSVC\ ------------------------------------------------------------------- Check that you have carried out all the above steps/fixes and then reboot into Normal Mode and download Cleanup This will clean out your tempory files. When finished please check you are running the latest version of HJT v1.99 before posting a new, fresh log...... Last edited by Pancake; 02-12-2005 at 08:37 PM. |
|
|
|
|
02-13-2005, 02:49 PM
|
#3 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
Well, so far some has been cleaned up. It seems though that evertime I log onto the internet it comes back again. Figures...
Anyway, Here is my new log after completing the steps above. I ran Adware once more on startup. Here is my HJT log Logfile of HijackThis v1.99.0 Scan saved at 4:51:58 PM, on 2/13/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SDKBE32.EXE C:\WINDOWS\TEMP\3131.TMP C:\WINDOWS\SYSTEM\WINOA386.MOD C:\WINDOWS\SYSTEM\TIBS5.EXE C:\WINDOWS\SYSTEM\WINOA386.MOD C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R3 - Default URLSearchHook is missing O2 - BHO: Class - {ABB18A13-15E9-A503-5DB0-3009F960CC5E} - C:\WINDOWS\SYSTEM\SDKFU32.DLL O4 - HKLM\..\Run: [3131.TMP] C:\WINDOWS\TEMP\3131.TMP.exe 0 10001 O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\SYSTEM\tibs5.exe O4 - HKLM\..\RunServices: [SDKBE32.EXE] C:\WINDOWS\SYSTEM\SDKBE32.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {B1B7606A-D7B9-42A8-AFA2-476308413211} (VacPro.canada_ver4) - http://www.globalphon.com/dialer/canada_ver4.CAB |
|
|
|
|
02-13-2005, 05:26 PM
|
#4 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Hi
Turn off System Restore instructions (WinXP) Rightclick My Computer | Properties | System Restore | check “Turn off System Restore”, <Apply>, <OK>. Reboot. When we have confirmed that your log file is clean, you may renable System Restore and create a new restore point. SHOW HIDDEN FILES AND FOLDERS. To show hidden files instructions (WinXP) Doubleclick My Computer | Tools | Folder Options | View tab Select Show Hidden Files and Folders Uncheck Hide extensions for known file types Uncheck Hide protected operating system files (Recommended) Select Apply to All Folders | Yes | Apply | OK ------------------------------------------------------------------ Close your browser and run CWShredder (check for updates) for a preliminary cleanup first.Some files below may not be present after running the above programs.Full instructions below. ------------------------------------------------------------------------ How to setup and run CWShredder Download from CWShredder v2.13 Choose the stand alone version. This is free. Save cwshredder.exe into its own directory, NOT in a TEMPorary folder or on the DESKTOP. I recommend, c:/program files/CWShredder/ Close all browsers Unzip into same directory Doubleclick CWSInstall.exe Click <Check for updates> and let it install all updates Click <Fix> If it asks you to delete a file, write down the whole path and file name and choose <No>. Post it to the forums. Click <Next> Close CWShredder. ------------------------------------------------------------------ Files highlighted in BLACK will need to be removed from your hard drive. ------------------------------------------------------------------ Please start by putting HJT in SAFE MODE. During reboot, tap the F8 key. Select Safe Mode ------------------------------------------------------------------ Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed. tibs5.exe SDKBE32.EXE ------------------------------------------------------------------ Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\cmofg.dll/sp.html#93256 R3 - Default URLSearchHook is missing O2 - BHO: Class - {ABB18A13-15E9-A503-5DB0-3009F960CC5E} - C:\WINDOWS\SYSTEM\SDKFU32.DLL O4 - HKLM\..\Run: [3131.TMP] C:\WINDOWS\TEMP\3131.TMP.exe 0 10001 O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\SYSTEM\tibs5.exe O4 - HKLM\..\RunServices: [SDKBE32.EXE] C:\WINDOWS\SYSTEM\SDKBE32.EXE ------------------------------------------------------------------ Open Windows Explorer and delete the following highlighted file/s (or delete the whole (RED) folder if listed). C:\WINDOWS\SYSTEM\SDKFU32.DLL C:\WINDOWS\SYSTEM\SDKBE32.EXE C:\WINDOWS\TEMP\3131.TMP C:\WINDOWS\SYSTEM\tibs5.exe ------------------------------------------------------------------- When finished please post a new, fresh log...... Last edited by Pancake; 02-13-2005 at 05:29 PM. |
|
|
|
|
02-19-2005, 10:36 AM
|
#5 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
Seems to just relicate again and again.
Unfortunately I have to connect using this machine in order to post etc. Should I end all startup proceses in msconfig Then Boot in Safemode Then follow instruction... I am not so good at this so I want to help you help me. My logfile is below. Logfile of HijackThis v1.99.0 Scan saved at 12:38:06 PM, on 2/19/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SOFT.EXE C:\WINDOWS\ISRVS\DESKTOP.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE C:\CLUHCGNQ.EXE C:\WINDOWS\SYSTEM\ELITESOF32.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\WEB_REBATES\WEBREBATES0.EXE C:\WINDOWS\SYSTEM\APIVG.EXE C:\WINDOWS\PACKAGER.EXE C:\PROGRAM FILES\WEB_REBATES\WEBREBATES1.EXE C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R3 - Default URLSearchHook is missing F1 - win.ini: run=C:\WINDOWS\SYSTEM\soft.exe O2 - BHO: Class - {94059374-9687-2B88-4C00-22E2FF8039AE} - C:\WINDOWS\WINRM.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\SYSTEM\MSXMIDI.EXE O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [aNGbbDe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITESOF32.EXE O4 - HKLM\..\Run: [WebRebates0] "C:\PROGRAM FILES\WEB_REBATES\WebRebates0.exe" O4 - HKLM\..\Run: [3131.TMP.EXE] C:\WINDOWS\TEMP\3131.TMP.EXE 2 10001 O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [APIVG.EXE] C:\WINDOWS\SYSTEM\APIVG.EXE O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\SYSTEM\MSXMIDI.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {B1B7606A-D7B9-42A8-AFA2-476308413211} (VacPro.canada_ver4) - http://www.globalphon.com/dialer/canada_ver4.CAB O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab |
|
|
|
|
02-19-2005, 10:42 AM
|
#6 (permalink) |
|
Knower of all that is MS
Join Date: Aug 2004
Posts: 10,755
OS: (multiple machines) 95, 98, 2K & XP Home & Pro
|
You're doing fine, this can be difficult to get thru. Just have to whittle away and be patient.
------------ Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below. Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep). Right click on this link http://www.greyknight17.com/spy/DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. You may delete it afterwards. Run CWShredder again. The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link don't work) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\WINDOWS\SYSTEM\SOFT.EXE C:\WINDOWS\ISRVS\DESKTOP.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE C:\CLUHCGNQ.EXE C:\WINDOWS\SYSTEM\ELITESOF32.EXE C:\PROGRAM FILES\WEB_REBATES\WEBREBATES0.EXE C:\WINDOWS\SYSTEM\APIVG.EXE C:\PROGRAM FILES\WEB_REBATES\WEBREBATES1.EXE Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: Internet Optimizer 180solutions WEB_REBATES ISTSVC Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R3 - Default URLSearchHook is missing F1 - win.ini: run=C:\WINDOWS\SYSTEM\soft.exe O2 - BHO: Class - {94059374-9687-2B88-4C00-22E2FF8039AE} - C:\WINDOWS\WINRM.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\SYSTEM\MSXMIDI.EXE O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [aNGbbDe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITESOF32.EXE O4 - HKLM\..\Run: [WebRebates0] "C:\PROGRAM FILES\WEB_REBATES\WebRebates0.exe" O4 - HKLM\..\Run: [3131.TMP.EXE] C:\WINDOWS\TEMP\3131.TMP.EXE 2 10001 O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [APIVG.EXE] C:\WINDOWS\SYSTEM\APIVG.EXE O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\SYSTEM\MSXMIDI.EXE O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: {B1B7606A-D7B9-42A8-AFA2-476308413211} (VacPro.canada_ver4) - http://www.globalphon.com/dialer/canada_ver4.CAB O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\PROGRAM FILES\WEB_REBATES\ C:\PROGRAM FILES\ISTSVC\ C:\Program Files\Internet Optimizer\ c:\program files\180solutions\ C:\CLUHCGNQ.EXE C:\WINDOWS\WINRM.DLL C:\WINDOWS\SYSTEM\boln.dll C:\WINDOWS\SYSTEM\MSXMIDI.EXE C:\WINDOWS\SYSTEM\ELITESOF32.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\SYSTEM\APIVG.EXE C:\WINDOWS\SYSTEM\SOFT.EXE C:\WINDOWS\ISRVS\ Run CleanUp! again. Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.
__________________
 GO BIG BLUE!! |
|
|
|
|
02-19-2005, 11:33 AM
|
#7 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
Thanks for the quick reply,
result file below. ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05 Get updates at http://www.greyknight17.com/download.htm#programs ***Security Programs Detected*** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.0 Scan saved at 1:37:57 PM, on 2/19/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\IPXN.EXE C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s O2 - BHO: Class - {94B0ADA2-7054-3996-E7C3-6D7DE0D9CDF7} - C:\WINDOWS\SYSTEM\MSWZ32.DLL O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\RunServices: [IPXN.EXE] C:\WINDOWS\IPXN.EXE O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab End of KRC HijackThis Analyzer Log. ==================================================================== |
|
|
|
|
02-19-2005, 11:37 AM
|
#8 (permalink) |
|
Knower of all that is MS
Join Date: Aug 2004
Posts: 10,755
OS: (multiple machines) 95, 98, 2K & XP Home & Pro
|
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.
You don't seem to have an antivirus program installed. Please download a free one at Grisoft. Install it and make sure to check for updates. Run a FULL system scan. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\WINDOWS\IPXN.EXE Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): O2 - BHO: Class - {94B0ADA2-7054-3996-E7C3-6D7DE0D9CDF7} - C:\WINDOWS\SYSTEM\MSWZ32.DLL O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\RunServices: [IPXN.EXE] C:\WINDOWS\IPXN.EXE Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\WINDOWS\SYSTEM\MSWZ32.DLL C:\CLUHCGNQ.EXE C:\WINDOWS\IPXN.EXE Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.
__________________
GO BIG BLUE!! |
|
|
|
|
02-19-2005, 12:05 PM
|
#9 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
Now I'm Raging mad at everything
I followed step by step and installed AVG
No when i boot up the WIN98 box i get an error---EXPLORER>EXE cannot be found. you must reinstall windows--- And then the CPU shuts down. I am hopping up and down!!!! I can however boot in safe mode.....Should I continue with the instructions in the last post????? This could by why my XP machine (my other infected box) won't load the desktop and only lets me operate from the windows task manager (CTRL, ALT, DEL)....I have this machine as another thread. It happened the same way. i installed AVG and ran it. And from that point on both machines have not functioned correctly. I am here all day until I (with help) can fix this. have other AVG users experienced this same problem??? Last edited by william13; 02-19-2005 at 12:10 PM. |
|
|
|
|
02-19-2005, 12:17 PM
|
#11 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
uninstalled on the 98 machine and no more error about EXPLORER.EXE.
error in boln.dll Missing entry... but this i have seen again and again. Should I boot in safe mode and continue with the instuctions? as well... Is there a way to acces Add/Rmeove Programs on winXP from the task manager. i would like to uninstall AVG on this box too and see if that fixes my missing desktop. thanks for being here. |
|
|
|
|
02-19-2005, 01:00 PM
|
#13 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
ok here you go.
==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05 Get updates at http://www.greyknight17.com/download.htm#programs ***Security Programs Detected*** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.0 Scan saved at 3:04:58 PM, on 2/19/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\CRSV.EXE C:\WINDOWS\ISRVS\DESKTOP.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\APPUQ.EXE C:\WINDOWS\APPUQ.EXE C:\WINDOWS\CALC.EXE C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R3 - Default URLSearchHook is missing O2 - BHO: Class - {77430B6B-3DD3-1300-68AF-6783BD6FA677} - C:\WINDOWS\SYSTEM\SYSFK32.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGRAB.DLL O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [CRSV.EXE] C:\WINDOWS\SYSTEM\CRSV.EXE O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O4 - HKLM\..\RunServices: [APPUQ.EXE] C:\WINDOWS\APPUQ.EXE O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll End of KRC HijackThis Analyzer Log. ==================================================================== |
|
|
|
|
02-19-2005, 03:02 PM
|
#14 (permalink) |
|
Analyst, Security Team
|
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.
Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked. For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep). Download AboutBuster and unzip it to a folder on your the Desktop. Do not run it yet. The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link don't work) and install it. Don't run it yet. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\WINDOWS\SYSTEM\CRSV.EXE C:\WINDOWS\ISRVS\DESKTOP.EXE C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\APPUQ.EXE C:\WINDOWS\APPUQ.EXE Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\ngxxl.dll/sp.html#93256 R3 - Default URLSearchHook is missing O2 - BHO: Class - {77430B6B-3DD3-1300-68AF-6783BD6FA677} - C:\WINDOWS\SYSTEM\SYSFK32.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGRAB.DLL O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [CRSV.EXE] C:\WINDOWS\SYSTEM\CRSV.EXE O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O4 - HKLM\..\RunServices: [APPUQ.EXE] C:\WINDOWS\APPUQ.EXE O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll Run AboutBuster and follow the prompts to scan (choose Yes/OK for all). It will ask you if you want a second scan, choose Yes. Save the log file and post it here. Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\WINDOWS\SYSTEM\CRSV.EXE C:\WINDOWS\ISRVS\ C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\APPUQ.EXE C:\WINDOWS\system\ngxxl.dll C:\WINDOWS\SYSTEM\SYSFK32.DLL C:\WINDOWS\SYSTEM\boln.dll C:\WINDOWS\BTGRAB.DLL C:\Program Files\ISTsvc\ Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes. Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
02-20-2005, 07:57 PM
|
#15 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
Seems to be gone with the exception of a few entries that concern me.
Almost there. ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05 Get updates at http://www.greyknight17.com/download.htm#programs ***Security Programs Detected*** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.0 Scan saved at 9:22:32 PM, on 2/20/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\ELITEDBW32.EXE C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - (no file) O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - (no file) O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITEDBW32.EXE O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O16 - DPF: v3cab - http://searchmiracle.com/cab/10.cab End of KRC HijackThis Analyzer Log. ==================================================================== It all came back. Did another HJT scan and what do you know everything i just finished getting rid of has returned. I have done a new scan and analizer and here is my result....so fed up... ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05 Get updates at http://www.greyknight17.com/download.htm#programs ***Security Programs Detected*** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.0 Scan saved at 9:44:14 PM, on 2/20/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\CALC.EXE C:\METRO.EXE C:\WINDOWS\SYSTEM\1103958.EXE C:\WINDOWS\SYSTEM\1104649.EXE C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\blank.htm O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGRAB.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITEDBW32.EXE O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O16 - DPF: v3cab - http://searchmiracle.com/cab/10.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll End of KRC HijackThis Analyzer Log. ==================================================================== Scanned at: 9:04:31 PM on: 2/20/05 -- Scan 1 --------------------------- About:Buster Version 3.0 Reference List : 15 ADS not scanned System(FAT) Removed! : C:\WINDOWS\SYSTEM\cfjeq.dat Attempted Clean Of Temp folder. Removed Uninstall Key (HSA) Removed Uninstall Key (SE) Removed Uninstall Key (SW) Pages Reset... Done! -- Scan 2 --------------------------- About:Buster Version 3.0 Reference List : 15 ADS not scanned System(FAT) Attempted Clean Of Temp folder. Pages Reset... Done! |
|
|
|
|
02-21-2005, 11:40 AM
|
#16 (permalink) |
|
Analyst, Security Team
|
OK, we'll try again.
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below. Download KillBox (http://www.greyknight17.com/spy/KillBox.exe). Don't run it yet. Right click on this link http://www.greyknight17.com/spy/DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. You may delete it afterwards. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\SYSTEM\1103958.EXE C:\WINDOWS\SYSTEM\1104649.EXE Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\blank.htm O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGRAB.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O4 - HKLM\..\Run: [¢‰¸ï0 4Ã4}¤Á œ 5]C:\Program Files\ISTsvc\istsvc.exe] C:\CLUHCGNQ.EXE O4 - HKLM\..\Run: [antiware] C:\WINDOWS\SYSTEM\ELITEDBW32.EXE O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [vtythzkf] c:\windows\system\vtythzkf.exe O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: v3cab - http://searchmiracle.com/cab/10.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy and paste each of the following into KillBox (hitting the X button for each file - choose NO when it asks if you want to reboot): C:\WINDOWS\SYSTEM\VTYTHZKF.EXE C:\WINDOWS\SYSTEM\1103958.EXE C:\WINDOWS\SYSTEM\1104649.EXE C:\WINDOWS\BTGRAB.DLL C:\WINDOWS\SYSTEM\boln.dll C:\Program Files\ISTsvc\ C:\CLUHCGNQ.EXE C:\WINDOWS\SYSTEM\ELITEDBW32.EXE C:\WINDOWS\isrvs\ Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
03-05-2005, 08:34 AM
|
#17 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
my results log.
Killbox has performed an illegal operation and...
Happen when trying to delete WINDOWS\BTGRAB.dll I tried to go back in and continue however any file gave me the same error. Restarted and continued. ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 3/2/05 Get updates at http://www.greyknight17.com/download.htm#programs ***Security Programs Detected*** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.0 Scan saved at 10:30:56 AM, on 3/5/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O4 - HKLM\..\Run: [Shellspl] spools.exe O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab End of KRC HijackThis Analyzer Log. ==================================================================== |
|
|
|
|
03-05-2005, 11:51 AM
|
#18 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
so all seemed fine unntil 30-60 min later
then it acted up again.
out of nowwhere. so I guess it never really left. I have a new log below. Logfile of HijackThis v1.99.0 Scan saved at 1:55:23 PM, on 3/5/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\WINOA386.MOD C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O4 - HKLM\..\Run: [Shellspl] spools.exe O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll |
|
|
|
|
03-05-2005, 10:46 PM
|
#19 (permalink) |
|
Analyst, Security Team
|
Were you able to delete the BTGRAB file and the remaining others?
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below. If you have a fast internet connection (broadband), run an online virus scan at TrendMicro. Just follow the instructions on the site to run the online scan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\SYSTEM\boln.dll O4 - HKLM\..\Run: [Shellspl] spools.exe O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe O15 - Trusted Zone: *.iframe.biz O15 - Trusted Zone: *.newiframe.biz O15 - Trusted Zone: *.pizdato.biz O15 - Trusted Zone: *.vse-moe.biz O15 - Trusted Zone: *.sp2******.biz O15 - Trusted Zone: *.sp2admin.biz O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O15 - Trusted Zone: *.admin2cash.biz O15 - Trusted Zone: *.private-iframe.biz O15 - Trusted Zone: *.private-dialer.biz O15 - Trusted Zone: *.bettersearch.biz O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.crazywinnings.com O15 - Trusted Zone: *.topconverting.com O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares...ysb_regular.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\WINDOWS\isrvs\ C:\WINDOWS\CERES.DLL C:\WINDOWS\SYSTEM\boln.dll spools.exe C:\WINDOWS\FARMMEXT.exe C:\WINDOWS\FARMMEXT.ini Run CleanUp program. Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
03-06-2005, 04:40 PM
|
#20 (permalink) |
|
Member
Join Date: Feb 2005
Posts: 27
OS: winxp
|
thanks. the online java scan ran and found lots of files but i didnt' know what any of them were so i left it and continued.
The 15 trusted zone: keeps returning my analyzer file below. Thanks, W.. ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 3/2/05 Get updates at http://www.greyknight17.com/download.htm#programs ***Security Programs Detected*** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.0 Scan saved at 6:43:21 PM, on 3/6/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\MY DOCUMENTS\PROTECT\HJT\HIJACKTHIS.EXE O15 - Trusted Zone: *.finefind.nettraffic2cash.biz O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt3_x.cab End of KRC HijackThis Analyzer Log. ==================================================================== |
|
|
|
| Thread Tools | |
|
|
