I posted again... please help me.. its not going away!

danaveldhoendanaveldhoen
edited December 2004 in Spyware & Virus Removal
i ran both adaware and spyware this time.. and i hope that we can actually do something please help me!!
Logfile of HijackThis v1.98.2
Scan saved at 7:50:59 PM, on 12/8/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\DANA\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wculb.dll/sp.html#29126
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
«13

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wculb.dll/sp.html#29126
    R3 - Default URLSearchHook is missing
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O15 - Trusted Zone: *.frame.crazywinnings.com



    Download LSPFix from http://www.cexx.org/LSPFix.exe and run it.

    Check the I know what I'm doing box.

    In the Keep box you should see one or more instances of the following files.

    aklsp.dll
    calsp.dll

    Select every instance of these two files, but no others, and move each one to the Remove box by clicking the >> button.

    When you are done click Finish>>.



    Reboot and post a new hijackthis log.
  • danaveldhoendanaveldhoen
    edited December 2004
    ok the crazywinnings.com wont go away
    but heres the latest HJT log.. \after running adaware and spybot
    Logfile of HijackThis v1.98.2
    Scan saved at 11:11:51 AM, on 12/10/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Documents and Settings\DANA\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    Have hijackthis fix this line:
    R3 - Default URLSearchHook is missing


    Now to get rid of that 015 entry:

    Download: DelDomains.inf
    http://mvps.org/winhelp2002/DelDomains.inf

    To use: Close all open browsers
    Right-click DelDomains.inf and select: Install

    Then rescan with HijackThis and see if that entry returns.


    The final issue we have to deal with in your log is a very new variant of the VX2/Look2Me parasite. Experts are working on an automated fix for removing this nasty guy, but as of now we have to remove it manually. Please post a new hijackthis log when you're ready to continue and I'll reply with some instructions.
  • danaveldhoendanaveldhoen
    edited December 2004
    here is the newest log, i couldnt download that program that you put on there... dunno what i am not doing or have to do
    i did run ad and spy
    Logfile of HijackThis v1.98.2
    Scan saved at 3:18:37 PM, on 12/11/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\DANA\Desktop\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    Right click on the link and select "Save link as".
    http://mvps.org/winhelp2002/DelDomains.inf


    To use: Close all open browsers
    Right-click DelDomains.inf and select: Install

    Then rescan with HijackThis and see if that entry returns.
  • danaveldhoendanaveldhoen
    edited December 2004
    here you go, thanks for helping me!!!!:)
    Logfile of HijackThis v1.98.2
    Scan saved at 6:11:37 PM, on 12/11/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\WinMX\WinMX.exe
    C:\Documents and Settings\DANA\Desktop\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    You have a new variation of the Look2Me parasite. An automated removal solution has not yet been established, so the current procedure for removing this parasite may take several steps. The first few steps involve collecting information from your system

    Can you please start off by downloading VX2Finder to your desktop from here:

    http://downloads.subratam.org/VX2Finder(126).exe

    Start vx2finder, then click on "Click to Find VX2.BetterInternet" and then click "Make Log" and copy and paste the entire contents of the log here.



    Please download DLL Compare to your desktop from here:

    http://www.atribune.org/downloads/DllCompare.exe

    Start Dll Compare, then click on "Run Locate.com". When it tells you that's finished, click on "Compare" at the bottom right. When that finishes, click "Make a Log of What was Found" and answer "Yes" to View Log file. Copy and paste the contents of that log here.

    Please also open the c:\Windows\System32 folder and see if there's a file there called Guard.tmp visible and report that here as well.



    Can you please download the file "Find It.zip" to your desktop from here - http://computercops.biz/zx/Zupe/Find%20It%20NT-2K-XP.zip . Unzip the contents to a folder, then open the folder and double-click on Find.bat. It will run for a minute, then produce a log. Please copy and paste that log here.



    Finally post a new hijackthis log also. And do not reboot your computer or use IE as it may cause the filenames to change and the fix to fail.
  • danaveldhoendanaveldhoen
    edited December 2004
    Log for VX2.BetterInternet File Finder (msg126)

    Files Found---

    Additional Files---

    Keys Under Notify---
    crypt32chain
    cryptnet
    cscdll
    ScCertProp
    Schedule
    sclgntfy
    SensLogn
    SharedDLLs
    termsrv
    wlballoon


    Guardian Key--- is called:

    User Agent String---
    {EF19C14C-7AAB-4D42-94DF-9528E34AC1E6}
  • danaveldhoendanaveldhoen
    edited December 2004
    it says the system file is not suitable for running MS DOS AND Microsoft windows applications
  • danaveldhoendanaveldhoen
    edited December 2004
    and the folder Guard.tmp isnt there
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    danaveldhoen wrote:
    it says the system file is not suitable for running MS DOS AND Microsoft windows applications


    When do you get this error? Does the error message mention a specific file?
  • danaveldhoendanaveldhoen
    edited December 2004
    yep lets see here C:\PROGRA~1\MOZILL~1\locate.com
    C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. The system file is not suitable for running MS DOS and Microsoft windows applications Choose close to terminate the application
    close or ignore
    i pressed ignore and it wont' do anything
    do i just need to close all my windows i have open maybe?
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    Check out this link to restore your autoexec.nt file.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;324767&Product=winxp


    We really can't proceed any further with this one until I see a DLL Compare log and Find.bat log.

    Also post a new hijackthis log.
  • danaveldhoendanaveldhoen
    edited December 2004
    hmmm i dont understand what cd i am supposed to install... thanks for helping me again!
  • danaveldhoendanaveldhoen
    edited December 2004
    Logfile of HijackThis v1.98.2
    Scan saved at 8:28:09 PM, on 12/11/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\WinMX\WinMX.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\DOCUMENTS AND SETTINGS\DANA\DESKTOP\VX2Finder(126).exe
    C:\Documents and Settings\DANA\Desktop\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    danaveldhoen wrote:
    hmmm i dont understand what cd i am supposed to install... thanks for helping me again!


    It means your Windows XP CD. Let me know if you don't have it and we can figure out another way.
  • danaveldhoendanaveldhoen
    edited December 2004
    I dont have it
  • danaveldhoendanaveldhoen
    edited December 2004
    do you want me to post another hjt log?
  • danaveldhoendanaveldhoen
    edited December 2004
    Logfile of HijackThis v1.98.2
    Scan saved at 2:51:34 PM, on 12/12/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Wiley\IHB\ihb.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\WinMX\WinMX.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\DANA\Desktop\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 ieautosearch
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab

    here it is even if you didntwant it:P
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    Do a search on your computer for autoexec.nt See if you have a copy of this file in C:\Windows\Repair

    If you do, just copy it to C:\Windows\system32
  • danaveldhoendanaveldhoen
    edited December 2004
    i do have it
  • danaveldhoendanaveldhoen
    edited December 2004
    how do i get it to that system 32?
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    Right click the file and select Cut. Then go to C:\Windows\System32\ right click a blank spot in the page, and click "paste"
  • danaveldhoendanaveldhoen
    edited December 2004
    ok done that wouldnt cut and paste so i copied and pasted
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    Good job. Now go back and follow the instructions in post #8 of this thread and see if those programs work now.

    http://www.short-media.com/forum/showpost.php?p=220541&postcount=8
  • danaveldhoendanaveldhoen
    edited December 2004
    aww thanks for the encouragement, i will go and do that... dont leave me yet ! pleases :(
  • danaveldhoendanaveldhoen
    edited December 2004
    Log for VX2.BetterInternet File Finder (msg126)

    Files Found---

    Additional Files---

    Keys Under Notify---
    crypt32chain
    cryptnet
    cscdll
    ScCertProp
    Schedule
    sclgntfy
    SensLogn
    termsrv
    WindowsUpdate
    wlballoon


    Guardian Key--- is called:


    User Agent String---
    {EF19C14C-7AAB-4D42-94DF-9528E34AC1E6}
  • danaveldhoendanaveldhoen
    edited December 2004
    the other dll isnt working still, is it important that the autoexec not be in that repair file, because it was just copied?
  • danaveldhoendanaveldhoen
    edited December 2004
    System Files in System32 Directory

    Volume in drive C has no label.
    Volume Serial Number is BC92-9E6E

    Directory of C:\WINDOWS\System32

    12/12/2004 11:26 AM 224,419 azmparse.dll
    12/12/2004 11:26 AM 225,009 q0rq0a95ed.dll
    12/12/2004 11:19 AM 225,209 s0rs0a97ed.dll
    12/11/2004 09:53 AM 224,419 en26l1fs1.dll
    12/11/2004 12:18 AM <DIR> Microsoft
    12/11/2004 12:06 AM <DIR> dllcache
    12/09/2004 02:51 PM 223,193 e4200efmeh2a0.dll
    12/09/2004 11:00 AM 224,540 enpol1731.dll
    12/07/2004 04:09 PM 226,290 f0l0la3m1d.dll
    12/06/2004 01:50 PM 224,864 lvr2099oe.dll
    12/06/2004 01:48 PM 224,565 pK8q0al5edq.dll
    12/06/2004 01:48 PM 226,116 ennql1551.dll
    12/06/2004 10:17 AM 223,188 o0660ajsedo60.dll
    12/05/2004 09:17 PM 222,548 q0860alsedq60.dll
    12/05/2004 09:10 PM 222,705 hrru0599e.dll
    12/05/2004 09:03 PM 223,093 enpsl1771.dll
    12/05/2004 07:04 PM 222,475 k4lq0e35eh.dll
    12/05/2004 06:58 PM 222,585 hrns0557e.dll
    12/05/2004 06:46 PM 222,635 hrn8055ue.dll
    12/05/2004 06:37 PM 222,650 hr8805lue.dll
    12/05/2004 03:07 PM 224,178 i0nmla511d.dll
    12/05/2004 07:57 AM 11,565 d3tg32.exe
    12/04/2004 01:48 PM 222,643 pbotowiz.dll
    12/04/2004 01:31 PM 223,052 lv0409dqe.dll
    12/03/2004 08:16 PM 224,696 onffilt.dll
    12/03/2004 08:08 PM 224,300 s0pu0a79ed.dll
    12/03/2004 07:44 PM 222,899 lv4m09h1e.dll
    12/02/2004 11:57 PM 222,878 dgmclien.dll
    12/02/2004 10:41 PM 225,272 sllwoa.dll
    12/02/2004 10:41 PM 222,878 en4ol1h31.dll
    12/02/2004 10:27 PM 222,898 en8ol1l31.dll
    12/02/2004 02:03 PM 11,573 sdkvj.exe
    12/02/2004 10:08 AM 3,347 bekxe.dat
    12/02/2004 02:30 AM 29,696 appum.exe
    12/01/2004 11:32 PM 3,347 mctiy.log
    12/01/2004 04:26 PM 10,829 ievl.exe
    12/01/2004 01:33 PM 10,775 winez32.exe
    11/30/2004 04:52 PM 10,908 netwv32.exe
    11/29/2004 06:03 AM 389,120 ??rvices.exe
    11/29/2004 01:38 AM 10,821 winjs32.exe
    11/28/2004 02:32 PM 7,305 puzbp.dat
    11/27/2004 07:13 PM 11,392 atlar.exe
    11/27/2004 06:36 PM 7,305 fefol.dat
    11/27/2004 04:55 PM 10,847 atlqy.exe
    11/25/2004 04:28 PM 7,305 rmxvl.log
    11/23/2004 02:48 PM 29,696 netjr.exe
    11/23/2004 02:04 AM 56,320 uwpok.dll
    11/21/2004 09:02 AM 11,410 crka.exe
    11/21/2004 12:03 AM 7,305 gwike.dat
    11/18/2004 11:16 PM 10,890 ipmm.exe
    11/18/2004 10:52 AM 56,320 gstkj.dll
    11/17/2004 02:19 PM 3,347 qmboa.txt
    11/17/2004 01:01 AM 11,213 d3ge32.exe
    11/15/2004 06:34 AM 11,170 appip.exe
    11/12/2004 10:58 PM 3,347 ivjpj.log
    11/12/2004 01:09 PM 29,696 ieha.exe
    11/12/2004 09:33 AM 29,696 javace.exe
    11/12/2004 08:41 AM 3,347 mjttw.txt
    11/09/2004 02:23 PM 7,305 lwtvz.dat
    11/05/2004 08:29 AM 3,347 zxsqy.dat
    10/28/2004 12:47 AM 7,305 ptlws.txt
    07/02/2002 08:29 PM 225,201 f02mlaf11d2.dll
    07/02/2002 07:59 PM 224,702 en2ol1f31.dll
    06/28/2002 01:32 PM 10,800 addqt32.exe
    06/10/2002 06:19 AM 10,958 javaaa.exe
    06/07/2002 12:20 PM 11,206 addkn.exe
    06/06/2002 11:02 PM 11,373 sdkhk32.exe
    06/05/2002 03:54 AM 10,840 crsw.exe
    05/15/2002 04:42 PM 3,347 zltnp.log
    04/29/2002 12:02 AM 225,260 df32gt.dll
    04/29/2002 12:02 AM 222,735 h4n0le5m1h.dll
    04/28/2002 11:01 PM 222,656 azaq0al5edq.dll
    04/28/2002 11:01 PM 222,710 ir00l5dm1.dll
    71 File(s) 8,485,834 bytes
    2 Dir(s) 36,630,384,640 bytes free
    Hidden Files in System32 Directory

    Volume in drive C has no label.
    Volume Serial Number is BC92-9E6E

    Directory of C:\WINDOWS\System32

    12/11/2004 12:06 AM <DIR> dllcache
    12/05/2004 07:57 AM 11,565 d3tg32.exe
    12/02/2004 02:03 PM 11,573 sdkvj.exe
    12/02/2004 10:08 AM 3,347 bekxe.dat
    12/02/2004 02:30 AM 29,696 appum.exe
    12/01/2004 11:32 PM 3,347 mctiy.log
    12/01/2004 04:26 PM 10,829 ievl.exe
    12/01/2004 01:33 PM 10,775 winez32.exe
    11/30/2004 04:52 PM 10,908 netwv32.exe
    11/29/2004 06:03 AM 389,120 ??rvices.exe
    11/29/2004 01:38 AM 10,821 winjs32.exe
    11/28/2004 02:32 PM 7,305 puzbp.dat
    11/27/2004 07:13 PM 11,392 atlar.exe
    11/27/2004 06:36 PM 7,305 fefol.dat
    11/27/2004 04:55 PM 10,847 atlqy.exe
    11/25/2004 04:28 PM 7,305 rmxvl.log
    11/23/2004 02:48 PM 29,696 netjr.exe
    11/23/2004 02:04 AM 56,320 uwpok.dll
    11/21/2004 09:02 AM 11,410 crka.exe
    11/21/2004 12:03 AM 7,305 gwike.dat
    11/18/2004 11:16 PM 10,890 ipmm.exe
    11/18/2004 10:52 AM 56,320 gstkj.dll
    11/17/2004 02:19 PM 3,347 qmboa.txt
    11/17/2004 01:01 AM 11,213 d3ge32.exe
    11/15/2004 06:34 AM 11,170 appip.exe
    11/12/2004 10:58 PM 3,347 ivjpj.log
    11/12/2004 01:09 PM 29,696 ieha.exe
    11/12/2004 09:33 AM 29,696 javace.exe
    11/12/2004 08:41 AM 3,347 mjttw.txt
    11/09/2004 02:23 PM 7,305 lwtvz.dat
    11/05/2004 08:29 AM 3,347 zxsqy.dat
    10/28/2004 12:47 AM 7,305 ptlws.txt
    09/28/2004 08:37 PM 488 logonui.exe.manifest
    09/28/2004 08:37 PM 488 WindowsLogon.manifest
    09/28/2004 08:37 PM 749 wuaucpl.cpl.manifest
    09/28/2004 08:37 PM 749 nwc.cpl.manifest
    09/28/2004 08:37 PM 749 cdplayer.exe.manifest
    09/28/2004 08:37 PM 749 sapi.cpl.manifest
    09/28/2004 08:37 PM 749 ncpa.cpl.manifest
    06/28/2002 01:32 PM 10,800 addqt32.exe
    06/10/2002 06:19 AM 10,958 javaaa.exe
    06/07/2002 12:20 PM 11,206 addkn.exe
    06/06/2002 11:02 PM 11,373 sdkhk32.exe
    06/05/2002 03:54 AM 10,840 crsw.exe
    05/15/2002 04:42 PM 3,347 zltnp.log
    44 File(s) 881,094 bytes
    1 Dir(s) 36,630,376,448 bytes free
    Files Named "Guard"

    Volume in drive C has no label.
    Volume Serial Number is BC92-9E6E

    Directory of C:\WINDOWS\System32

    Temp Files in System32 Directory

    Volume in drive C has no label.
    Volume Serial Number is BC92-9E6E

    Directory of C:\WINDOWS\System32

    08/03/2004 11:56 PM 1,236,480 ~GLH0014.TMP
    08/18/2001 04:00 AM 2,577 CONFIG.TMP
    2 File(s) 1,239,057 bytes
    0 Dir(s) 36,630,376,448 bytes free
    User Agent

    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{EF19C14C-7AAB-4D42-94DF-9528E34AC1E6}"=""

    Keys Under Notify

    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsUpdate]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\en26l1fs1.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    Xfind Results
    Locate.com Results
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    danaveldhoen wrote:
    the other dll isnt working still, is it important that the autoexec not be in that repair file, because it was just copied?


    No, it shouldn't matter. Do you get an error message when you try to run it?
This discussion has been closed.