C:\WINDOWS\TEMP\[random].exe

Unknown
edited January 2006 in Spyware & Virus Removal
Hi,
I've had some rather annoying problems with my pc the last week or so. I'm not sure if all things I'm about to describe are related to each other or not, so I'll just mention them and let you judge by yourself.

About a week ago I noticed that my IE browser couldn't play movie files as it could in the past. It also tended to crash more often than it had done in the past. I decided to uninstall it, and thereafter install again. Didn't work. When uninstalling I got a message saying uninstallation couldn't complete properly. Installed IE again, and (if remember correctly) got message saying wasn't completely successfull. Anyway, IE had the same problems as before. Couldn't even use it for more than a couple of minutes before it crashed.

The very same day I tried to use Outlook, but got error messages saying "Error Number: 0x80040154" when trying to download mail from the servers.

Within a day or so I also tried to listen to web radio via Windows Media Player. I've had no problems in the past, but now it simply didn't work.

Shortly I also noticed that Outlook Express didn't work. I got the error message "Outlook Express could not be started because MSOE.DLL could not be loaded".

Today I also noticed 9 mysterious files in my C:\WINDOWS\TEMP\ directory. They are all randomly named (8 charachters) .exe files.

I have spent hours looking for answers and clues on my problems mentioned here, but without having found anything more helpful than that the .exe files most likely are no good and that the Outlook problem might be related to inetcomm.dll (I did follow some advice on this and replaced it with another one I've downloaded, but nothing changed. Anyway, the replacement file wasn't the same size, which seemed strange to me. I put back the old file in the end).

Sorry about the lengthy explanation... I've run Ad-Aware which removed/fixed quite a few things (it said) and I also ran Spybot, which didn't report anything unusual. If any of you might be able to point me in the right direction on the any of the following issues, then that would be great. If you have solutions, then fantastic! Since the reason for me to actually write here at all was my mysterious .exe files, I would also appreciate some advice on what should be done with them.

Many thanks in advance!


Logfile of HijackThis v1.99.1
Scan saved at 22:50:30, on 13/01/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATI2CWXX.EXE
C:\PROGRAM FILES\ACER\POWERKEY\POWERKEY.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\WINDOWS\SYSTEM\KEYMAP.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\TWAIN_32\DIGICAM\DIGISRV.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE_SV\OFFICE\OSA.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SHORT-MEDIA.COM - TOOLS\HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_14.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\short-media.com - tools\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Ati2cwxx] Ati2cwxx.exe
O4 - HKLM\..\Run: [AcerPowerkey] "C:\Program Files\Acer\Powerkey\Powerkey.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [KEYMAP] C:\WINDOWS\SYSTEM\Keymap.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [DigiSrv] C:\WINDOWS\Twain_32\DigiCam\DigiSrv.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
O4 - HKCU\..\Run: [123Monitor] C:\PROGRAM FILES\1-2-3 SPYWARE FREE\SpywareFreeMonitor.exe
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O16 - DPF: {3D8C5C3D-35A0-43F7-8813-36902A92766D} (SoftLinkUpdate Class) - https://sol.softitler.com/downloads/SoftLink.exe
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mshome
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 194.106.56.6,194.106.33.42
O21 - SSODL: NNqcnlPiB - {23411607-89EB-BCAD-54AA-1FBE5B368DD5} - C:\WINDOWS\SYSTEM\IIZU.DLL

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Can you please do the following.

    ===============

    First of all we have to remove Newdotnet, either from add/remove programs, or by going here and scrolling down to the uninstall tool.

    ===============

    Scan with HiJackThis, then check(tick) the following, if present:


    O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_14.dll

    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s

    O16 - DPF: {3D8C5C3D-35A0-43F7-8813-36902A92766D} (SoftLinkUpdate Class) - https://sol.softitler.com/downloads/SoftLink.exe

    O21 - SSODL: NNqcnlPiB - {23411607-89EB-BCAD-54AA-1FBE5B368DD5} - C:\WINDOWS\SYSTEM\IIZU.DLL


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

    folders...

    C:\Program Files\NewDotNet

    files...

    C:\WINDOWS\SYSTEM\IIZU.DLL

    Search for...

    https://sol.softitler.com/downloads/SoftLink.exe

    ...using "Start | Search...".

    -

    Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "Safe Mode".

    -

    Reboot.

    ===============

    To help protect your system from hostile ActiveX content, or special 'downloadable' files:

    Download, install and keep updated, SpywareBlaster. If you've installed it for the first time:

    1) Check for any available updates; if present, they'll be automatically downloaded and installed.
    2) Next, "Enable all protection".
    3) Exit the program.

    -

    Note: Remember to regularly check for updates.

    ===============

    After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
  • memajjk
    edited January 2006
    Crunchie wrote:
    First of all we have to remove Newdotnet, either from add/remove programs, or by going here and scrolling down to the uninstall tool.

    got rid of this this using add/remove programs
    Crunchie wrote:
    Scan with HiJackThis, then check(tick) the following, if present:

    O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_14.dll

    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s

    O16 - DPF: {3D8C5C3D-35A0-43F7-8813-36902A92766D} (SoftLinkUpdate Class) - https://sol.softitler.com/downloads/SoftLink.exe

    O21 - SSODL: NNqcnlPiB - {23411607-89EB-BCAD-54AA-1FBE5B368DD5} - C:\WINDOWS\SYSTEM\IIZU.DLL


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    New.net wasn't there any more, softitler.com is a translation agency with their own software - so I kept that, but iizu.dll was dealt with

    Crunchie wrote:
    Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

    folders...

    C:\Program Files\NewDotNet

    files...

    C:\WINDOWS\SYSTEM\IIZU.DLL

    Search for...

    https://sol.softitler.com/downloads/SoftLink.exe

    ...using "Start | Search...".

    -

    Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "Safe Mode".

    -

    Reboot.

    deleted NewDotNet, IIZU.DLL I got rid of by starting in safe mode

    Crunchie wrote:
    To help protect your system from hostile ActiveX content, or special 'downloadable' files:

    Download, install and keep updated, SpywareBlaster. If you've installed it for the first time:

    1) Check for any available updates; if present, they'll be automatically downloaded and installed.
    2) Next, "Enable all protection".
    3) Exit the program.

    done.

    this is what the log looks like now:


    Logfile of HijackThis v1.99.1
    Scan saved at 17:24:20, on 14/01/2006
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SSDPSRV.EXE
    C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
    C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\ATI2CWXX.EXE
    C:\PROGRAM FILES\ACER\POWERKEY\POWERKEY.EXE
    C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
    C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
    C:\WINDOWS\SYSTEM\KEYMAP.EXE
    C:\WINDOWS\SYSTEM\INTERNAT.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\WINDOWS\TWAIN_32\DIGICAM\DIGISRV.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\SHORT-MEDIA.COM - TOOLS\HIJACKTHIS\HIJACKTHIS.EXE

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\short-media.com - tools\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Ati2cwxx] Ati2cwxx.exe
    O4 - HKLM\..\Run: [AcerPowerkey] "C:\Program Files\Acer\Powerkey\Powerkey.exe"
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [KEYMAP] C:\WINDOWS\SYSTEM\Keymap.exe
    O4 - HKLM\..\Run: [internat.exe] internat.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [DigiSrv] C:\WINDOWS\Twain_32\DigiCam\DigiSrv.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
    O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
    O4 - HKCU\..\Run: [123Monitor] C:\PROGRAM FILES\1-2-3 SPYWARE FREE\SpywareFreeMonitor.exe
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
    O16 - DPF: {3D8C5C3D-35A0-43F7-8813-36902A92766D} (SoftLinkUpdate Class) - https://sol.softitler.com/downloads/SoftLink.exe
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mshome
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 194.106.56.6,194.106.33.42




    now regarding my issues mentioned before... what I did above didn't solve them, but I found a program that completely removed IE from windows. I did that and reinstalled IE. Now IE seemd to work, Outlook work, Outlook Express work and Windows Media Player is the only one with a few problems left. I might try to reinstall that one as well at some point. Maybe that will sort out the last few problems...

    But what about those .exe files with random names? Are they harmless, are they legitimate files, or what do you think?

    Even if my main problem didn't seem to be spyware/virus related... thanks a lot for helping me to get rid of some dodgy stuff on my pc!!
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Everything looks good now.
    But what about those .exe files with random names? Are they harmless, are they legitimate files, or what do you think?
    If you mean this one C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE it's a microsoft update.

    ==

    Congratulations! Your log looks clean - good work!

    ===============

    Now that your PC is clean you need to follow these easy steps to keeping it this way:

    Secure your Internet Explorer by going here and following the instructions there.

    Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.

    Use a firewall to help prevent your PC's control being usurped by undesireables. There is a link to a good, free firewall in my signature.

    Install and keep updated, Ewido anti-malware, Ad-Aware SE and Spybot S&D.
    Run them both on a regular basis, following the manufacturer's recommendations.

    Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.

    Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.


    Clear your Temp folders.
    Clear out your Temporary internet files and other temp files.
    Go to Start > Settings > Control Panel >Internet Options.
    Under the General tab click the Delete temporary internet files,
    delete all Offline content as well. Clear out Cookies.

    Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

    C:\Documents and Settings\username\Local Settings\Temp\

    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin.

    For XP users.
    After something like this it is a good idea to Flush the Restore Points and start fresh.
    To flush the XP system Restore Points.

    Go to Start>Run and type msconfig. Press enter.

    When msconfig opens, click the Launch System Restore Button.
    On the next page, click the System Restore Settings link on the left.

    Check the box labelled 'Turn off System restore'.

    Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.

    Note that all previous restore points will be lost.

    ===============

    If you have any more problems, post back.

    -

    Happy surfing,

    crunchie.
This discussion has been closed.