Please check my hijack this log [Archive] - The PC Guide Discussion Forums

Doenut

12-09-2004, 02:16 PM

I think I posted this in the wrong group earlier, so hopefully this is the right group...

Please check my log below. I have problems with popups, layered hidden window at shutdown, and items that can't be removed with Ad Aware. ANY help would be greatly appreciated!

Thanks!

Logfile of HijackThis v1.97.7
Scan saved at 12:02:44 PM, on 12/9/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\SED\SED.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\WINNT\system32\installer.exe
C:\WINNT\system32\wiwcrr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Byron Lipper\Media\HijackThis.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\HP\hpcoretech\soln\HPOSM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications (HKLM)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shop.intuit.com/commerce...bles/ie/IDA.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/...ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://themeetingson.webex.com/cli...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: Domain = mycompany.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: NameServer = 192.53.101.22,192.53.101.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany.com,mycompany.com,mycompany.com,mycompan y.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany.com,mycompany.com,mycompany.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany.com,mycompany.com,mycompany.com,mycompan y.com

Budfred

12-09-2004, 11:49 PM

You have what is probably the newest and nastiest version of Vx2 as well as some other garbage... Download Ad-Aware SE, update it and get the Vx2 plugin... Install it and run it... It probably won't do it, but it is worth a try and it may clean out some of the other garbage after you run a Full scan...

Then download and install the latest version of HJT (1.98.2) and post a fresh log after first rebooting...

Doenut

12-10-2004, 01:01 PM

Thanks for the reply.

I've updated AdAware and have tried to run it three times. It stops at:
C:\WINNT\system32\wins - then it won't continue. So far, it has itentified 55 New Critical Objects, but I can't delete them until AdAware finishes. Any suggestions??

Thanks!

FastLearner

12-10-2004, 08:40 PM

Looks like I'm not the only one in this club, and I've asked the best of the best Adaware people in their forums (my scan was/still is hanging somewhere else, though) and they couldn't help me. Maybe you'll have better luck. Go to www.lavasoft.com and follow the links to their support forum. I've pretty much learned to accept the fact that I can't run the full scan, but I can run a smart scan. Have you tried that? It may help you find some of the trash and get rid of it. Also make sure you have all of the correct settings as shown at http://www.lavasoftsupport.com/index.php?showtopic=48134
. I just looked on this site, but all I could find were the correct settings for Adaware 6. I'm assuming you're running AdawareSE.

Budfred

12-10-2004, 11:27 PM

Don't even try running the Ad-Aware SE Full scan until you have run the Vx2 plugin... Even then it may not work... Again, this looks like the really, REALLY nasty version of Vx2 that is going around right now... There is a probable fix, but I would like to see if you get anywhere with the plugin first...

Doenut

12-12-2004, 09:07 PM

I ran the Vx2 plug-in several times and it said that I have a "clean" system. I have also run AdAware several times. Each time, I get several items to clean up. Sometimes, it locks up on the WINNT files. I have run a custom scan; un-checking the WINNT files, and am able to do a full scan. The problem's definitely in the WINNT files, and I can't get AdAware to run through them. I still get plenty pop-ups and I wonder what is being done to my system as I continue to let it be infected. PLEASE HELP if you can. The LavaSoft board may provide what I need, but since there are so many differing opinions, I don't know where to turn.

Thanks for looking into this.

jlreich

12-12-2004, 09:36 PM

but since there are so many differing opinions, I don't know where to turn.
You are in good hands. Without any doubt, Budfred is one of the best. ;)

Doenut

12-12-2004, 09:47 PM

I can fortunately (or unfortunately) vouch for that personally. He helped me clean my system up a while back, and I'm glad he is back for another challenge. This time, I'm open for suggestions as to how I can avoid another infection. Thanks for your interest.

Budfred

12-12-2004, 10:50 PM

I'd really like to see a 1.98.2 HJT log... Please download and post it right after a reboot... Here are a couple of other things to do as well...

Download and run Zupe's new tool:

http://forums.spywareinfo.com/index.php?act=Attach&type=post&id=484

Post the log, but do not do anything with the info in the log... most things will be legit...

Go to the HJT link in my sig and download the Vx2Finder version msg126 and run it.... Post that log here too...

Download Killbox from the same site, we will be using it later...

I am afraid this is a long and difficult fix, so please follow the directions carefully....

Doenut

12-12-2004, 11:16 PM

HJT log follows. I'm going to follow your other suggestions in the meantime:

Logfile of HijackThis v1.98.2
Scan saved at 9:11:54 PM, on 12/12/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wiwcrr.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\SED\SED.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\rundll32.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\myname\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany.com
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

Doenut

12-12-2004, 11:25 PM

Couldn't access Zupe's tool from the link you provided. Please advise.

thanks

Doenut

12-12-2004, 11:28 PM

Vx2 Finder Log:

Log for VX2.BetterInternet File Finder (msg126)

Files Found---

Additional Files---

Keys Under Notify---
AtiExtEvent
ckpNotify
crypt32chain
cryptnet
cscdll
Dynamic Directory
NavLogon
sclgntfy
Sebring
SensLogn
wzcnotif

Guardian Key--- is called:

User Agent String---
{FD07CE0E-4F37-41CB-9354-AAE396746A0C}

Budfred

12-13-2004, 01:00 AM

We'll try it as an attachment... See if you can download and run this... I have to get some sleep, so I will check back tomorrow after work...

Doenut

12-13-2004, 11:49 PM

Here's my log. Let me know if you need anything else.

Thanks!

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/12/2004 10:51p 224,093 u4ru0e99eh.dll
12/12/2004 10:14p <DIR> dllcache
12/12/2004 10:12p 224,093 RZSAPI32.DLL
12/12/2004 09:53p 224,093 k0440ahqed4e0.dll
12/10/2004 05:49p 223,232 m6460ghse6460.dll
12/10/2004 12:43p 224,093 RYSDLG.DLL
12/10/2004 12:22p 223,232 mDpbase.dll
12/08/2004 08:36a 223,232 fMxevent.dll
12/07/2004 11:39a 223,232 dccompos.dll
12/06/2004 05:24p 224,403 h60q0gd5e60.dll
9 File(s) 2,013,703 bytes
1 Dir(s) 6,475,763,712 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/12/2004 10:14p <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,475,759,616 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/13/2004 09:37p 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,475,759,616 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/13/2004 09:37p 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,475,759,616 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Dynamic Directory]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\k0440ahqed4e0.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

C:\
arcldr.exe Thu Jun 19 2003 1:05:04p A.SHR 150,528 147.00 K
arcsetup.exe Thu Jun 19 2003 1:05:04p A.SHR 163,840 160.00 K
autoexec.bat Tue Sep 30 2003 12:12:34p ...H. 0 0.00 K
boot.ini Tue Sep 30 2003 12:07:28p ..SH. 192 0.19 K
BYRONL~1 Tue Feb 3 2004 4:47:18p .D... <Dir>
CERTS Wed Feb 4 2004 9:58:12a .D... <Dir>
CLIENT Fri Oct 3 2003 7:31:20a AD... <Dir>
CONFIG.MSI Fri Oct 3 2003 10:06:44a .DSH. <Dir>
config.sys Tue Sep 30 2003 12:12:34p ...H. 0 0.00 K
DELL Tue Feb 3 2004 3:53:10p AD... <Dir>
dellstag.txt Thu Oct 14 2004 9:48:06a A.... 8 0.01 K
DOCUME~1 Mon Feb 16 2004 2:30:52p AD... <Dir>
DOWNLOAD Fri Oct 3 2003 9:57:38a AD... <Dir>
dv_trace.log Mon Aug 16 2004 3:24:54p A.... 21 0.02 K
EVEREST Sun Jan 18 2004 1:25:02p AD... <Dir>
GLOVIA~1 Tue Dec 9 2003 11:55:12a AD... <Dir>
hpcmerr.log Thu Feb 5 2004 2:04:28p A.... 372 0.36 K
io.sys Tue Sep 30 2003 12:12:34p A.SHR 0 0.00 K
msdos.sys Tue Sep 30 2003 12:12:34p A.SHR 0 0.00 K
NALCACHE Mon Dec 13 2004 9:37:02p .D.H. <Dir>
NOVELL Tue Oct 14 2003 12:02:44p AD... <Dir>
<Space> scroll page, <Enter> scroll line, <Esc> abort, <C> continuous :

Budfred

12-15-2004, 12:30 AM

Good news/bad news kind of story... There may be a much easier fix available now, so let's give it a try... If it doesn't work, we will do it the hard way.... This one is a real PITA, so hopefully this will work....

Download the trial version of TDS3 and update it... There are instructions linked to this page to update if you are not sure how to do it... Run it and hope that it takes this nasty out...

http://tds.diamondcs.com.au/

When done, reboot and post a fresh HJT log...

BTW, the bad news part is that you may have done all that other stuff for no reason (we can only hope).... :D

Doenut

12-15-2004, 02:31 AM

Followed your instructions as recommended. Still getting pop-ups even as I type. "Layered Hidden Window" still shows up at shutdown... maybe you'll see something here:

Logfile of HijackThis v1.98.2
Scan saved at 12:24:52 AM, on 12/15/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\wiwcrr.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\SED\SED.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me~1.me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

Budfred

12-16-2004, 12:01 AM

Well it was worth a shot... Now we are going to have to do it the hard way....

Unzip the contents of KillBox.zip to a convenient location.
Double-click on KillBox.exe.
Click "Replace on Reboot" and check the "Use Dummy" box.
Paste this file into the top "Full Path of File to Delete" box.

C:\WINDOWS\System32\u4ru0e99eh.dll

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Replace on Reboot prompt.
Click "No" at the Pending Operations prompt.
Repeat steps 4-8 above for these files:
C:\WINDOWS\System32\RZSAPI32.DLL
C:\WINDOWS\System32\k0440ahqed4e0.dll
C:\WINDOWS\System32\m6460ghse6460.dll
C:\WINDOWS\System32\RYSDLG.DLL
C:\WINDOWS\System32\mDpbase.dll
C:\WINDOWS\System32\fMxevent.dll
C:\WINDOWS\System32\dccompos.dll
C:\WINDOWS\System32\h60q0gd5e60.dll

Click "Replace on Reboot" and check the "Use Dummy" box.
Paste this file into the top "Full Path of File to Delete" box.

C:\WINDOWS\System32\Guard.tmp

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Replace on Reboot prompt.
Click "Yes" at the Pending Operations prompt to restart your computer.
Double-click on find.bat and post the new output.txt.

Once you complete these steps, we have more to do... :eek:

Doenut

12-16-2004, 01:31 AM

Done. Results follow, Obi Wan.

thanks!

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/15/2004 10:25p 224,093 gpj8l31u1.dll
12/15/2004 09:40p <DIR> dllcache
12/15/2004 06:10p 224,093 lvn2095oe.dll
12/13/2004 11:37p 224,093 dnrs0197e.dll
12/12/2004 10:12p 224,093 RZSAPI32.DLL
12/10/2004 05:49p 223,232 m6460ghse6460.dll
12/10/2004 12:43p 224,093 RYSDLG.DLL
12/10/2004 12:22p 223,232 mDpbase.dll
12/08/2004 08:36a 223,232 fMxevent.dll
12/07/2004 11:39a 223,232 dccompos.dll
12/06/2004 05:24p 224,403 h60q0gd5e60.dll
10 File(s) 2,237,796 bytes
1 Dir(s) 6,464,782,336 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/15/2004 09:40p <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,464,782,336 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/15/2004 10:29p 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,464,782,336 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/15/2004 10:29p 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,464,782,336 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\lvn2095oe.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Budfred

12-17-2004, 12:24 AM

It looks like I needed to have you post a fresh FindIt log before proposing the fix... Download FindIt again from this attachment and run it again... (it has been updated)... After running it, do not reboot until you are set up to do the next step in the fix which means that I will have to look at your log and post the fix again... Hopefully you have access over the weekend and we can get it fixed....

Doenut

12-17-2004, 01:18 AM

Hope this is what you were looking for...

thanks!

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/16/2004 08:30p 224,093 i6240gfqe62e0.dll
12/16/2004 12:08a 224,093 j80slid7180.dll
12/15/2004 10:25p 224,093 gpj8l31u1.dll
12/15/2004 09:40p <DIR> dllcache
12/13/2004 11:37p 224,093 dnrs0197e.dll
12/12/2004 10:12p 224,093 RZSAPI32.DLL
12/10/2004 05:49p 223,232 m6460ghse6460.dll
12/10/2004 12:43p 224,093 RYSDLG.DLL
12/10/2004 12:22p 223,232 mDpbase.dll
12/08/2004 08:36a 223,232 fMxevent.dll
12/07/2004 11:39a 223,232 dccompos.dll
12/06/2004 05:24p 224,403 h60q0gd5e60.dll
11 File(s) 2,461,889 bytes
1 Dir(s) 6,458,650,624 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/15/2004 09:40p <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,458,650,624 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/16/2004 08:43p 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,458,650,624 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/16/2004 08:43p 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,458,650,624 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Extensions]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\gpj8l31u1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

12-17-2004, 01:22 AM

BTW... it's late and I will have to shut down now. I won't turn my computer back on until Saturday morning. I hope this action won't hinder your efforts. Many thanks for your attention to this problem. I look forward to fixing my system and proceeding without further need to occupy your "down time."

Thanks again!

Budfred

12-18-2004, 12:14 AM

Well, we can try to remove some and we will have to go back and do the rest later... It is crucial to leave the computer on, if your internet is always-on, just disconnect the cable and then go to bed with the computer still running... Meanwhile, try this again:

Double-click on KillBox.exe.
Click "Replace on Reboot" and check the "Use Dummy" box.
Paste this file into the top "Full Path of File to Delete" box.

C:\WINDOWS\System32\i6240gfqe62e0.dll

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Replace on Reboot prompt.
Click "No" at the Pending Operations prompt.
Repeat steps 4-8 above for these files:
C:\WINDOWS\System32\j80slid7180.dll
C:\WINDOWS\System32\gpj8l31u1.dll
C:\WINDOWS\System32\dnrs0197e.dll
C:\WINDOWS\System32\RZSAPI32.DLL
C:\WINDOWS\System32\m6460ghse6460.dll
C:\WINDOWS\System32\RYSDLG.DLL
C:\WINDOWS\System32\mDpbase.dll
C:\WINDOWS\System32\fMxevent.dll
C:\WINDOWS\System32\dccompos.dll
C:\WINDOWS\System32\h60q0gd5e60.dll

Click "Replace on Reboot" and check the "Use Dummy" box.
Paste this file into the top "Full Path of File to Delete" box.

C:\WINDOWS\System32\Guard.tmp

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Replace on Reboot prompt.
Click "Yes" at the Pending Operations prompt to restart your computer.
Double-click on find.bat and post the new output.txt.

Once you complete the fix and return to post the log, please note if you had any trouble at all with the directions....

Doenut

12-20-2004, 01:59 PM

Here you go...

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/20/2004 11:49a 225,946 o266lcjs1fo6.dll
12/19/2004 11:40p 224,093 o2nslc571f.dll
12/19/2004 10:16p 224,093 kfdne.dll
12/19/2004 10:01p 224,093 ktlql7351.dll
12/18/2004 10:29a <DIR> dllcache
12/18/2004 12:14a 224,093 lv4q09h5e.dll
12/17/2004 11:52p 224,093 moc70.dll
12/16/2004 12:08a 224,093 j80slid7180.dll
12/13/2004 11:37p 224,093 dnrs0197e.dll
12/12/2004 10:12p 224,093 RZSAPI32.DLL
12/10/2004 05:49p 223,232 m6460ghse6460.dll
12/10/2004 12:43p 224,093 RYSDLG.DLL
12/10/2004 12:22p 223,232 mDpbase.dll
12/08/2004 08:36a 223,232 fMxevent.dll
12/07/2004 11:39a 223,232 dccompos.dll
12/06/2004 05:24p 224,403 h60q0gd5e60.dll
15 File(s) 3,360,114 bytes
1 Dir(s) 6,439,546,880 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,439,546,880 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/20/2004 11:54a 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,439,546,880 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/20/2004 11:54a 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,439,546,880 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Telephony]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\o2nslc571f.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

12-20-2004, 02:01 PM

Quick question:

This computer is the laptop I travel with. It's difficult to keep it on while traveling, and I won't be in one place to leave it on over night until after the New Year. Should we wait until then to continue? Is shutting my computer down causing the problem? Please advise.

Thanks!

Budfred

12-20-2004, 10:17 PM

I think we need to keep plugging away at it since this thing just keeps growing until it is killed... There are some people working on an automated fix, so hopefully that will do it... Keep it on as long as you can after you post in case I get a chance to get back to you before you have to reboot... Also, the files that you need to put in that fix I have posted are from that first section and are all created in December at this point... They run from 222,000 to 227,000 bytes. If you want to identify and kill them yourself next time, that might do it, but be careful not to take any that don't fit those guidelines... The guard.tmp file is the most important one to kill.... Download the latest update of the FindIt program too...

Here are the files to plug into the fix I have posted from this log:

* C:\WINDOWS\System32\o266lcjs1fo6.dll
* C:\WINDOWS\System32\o2nslc571f.dll
* C:\WINDOWS\System32\kfdne.dll
* C:\WINDOWS\System32\ktlql7351.dll
* C:\WINDOWS\System32\lv4q09h5e.dll
* C:\WINDOWS\System32\moc70.dll
* C:\WINDOWS\System32\j80slid7180.dll
* C:\WINDOWS\System32\dnrs0197e.dll
# C:\WINDOWS\System32\RZSAPI32.DLL
# C:\WINDOWS\System32\m6460ghse6460.dll
# C:\WINDOWS\System32\RYSDLG.DLL
# C:\WINDOWS\System32\mDpbase.dll
# C:\WINDOWS\System32\fMxevent.dll
# C:\WINDOWS\System32\dccompos.dll
# C:\WINDOWS\System32\h60q0gd5e60.dll

If you aren't sure, hold off on doing anything... If you get a clean log, we can go on to the next step... Be sure to follow the fix step by step...

Linzy217

12-28-2004, 08:23 PM

i think i have this "nasty" VX2 thing too....adaware keeps picking it up each time i restart and the adaware add on says my system is clean. please help!

Budfred

12-28-2004, 08:27 PM

Linzy217,

Welcome to PCGuide... You need to start your own topic to address this issue... Also, you will need to post a HijackThis log in that topic...

Doenut

01-03-2005, 06:16 PM

I'm back in the saddle now. I'm going to leave my computer on until you tell me to shut down. Here's the latest output.txt after killing the files you told me to:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
0 File(s) 0 bytes
1 Dir(s) 6,417,592,320 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,417,592,320 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/03/2005 10:39a 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,417,592,320 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/03/2005 10:39a 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,417,592,320 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\r06u0aj9edo.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

01-03-2005, 06:18 PM

I think I sent this to another thread. Here goes again. My computer is going to stay on until you tell me to turn it off. Thanks!

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
0 File(s) 0 bytes
1 Dir(s) 6,417,592,320 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,417,592,320 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/03/2005 10:39a 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,417,592,320 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/03/2005 10:39a 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,417,592,320 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\r06u0aj9edo.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Budfred

01-03-2005, 11:04 PM

Are you doing this part of the fix??

# Paste this file into the top "Full Path of File to Delete" box.

* C:\WINDOWS\System32\Guard.tmp

# Click the "Delete File" button which looks like a stop sign.
# Click "Yes" at the Replace on Reboot prompt.
# Click "Yes" at the Pending Operations prompt to restart your computer.
# Double-click on find.bat and post the new output.txt.You seem to have killed all the other DLLs, but this is the one that will regenerate them if it isn't killed... Try this again and post back with a fresh HJT and FindIt log...

classicsoftware

01-03-2005, 11:21 PM

Budfred:

Isn't:
C:\\WINNT\\system32\\r06u0aj9edo.dll

a baddie???

Budfred

01-04-2005, 12:14 AM

It looks likely to be bad, but it is not where I expect it to be in the log, so I am not sure if it is part of Vx2... It might be worthwhile to run it through Killbox anyway...

Doenut

01-04-2005, 01:07 PM

Done as instructed.

Also, when I try START, RUN, "msconfig", I get the message, "Cannot find the file 'msconfig' (or one of its components). Make sure the path and filename are correct and that all required libraries are available." I'm hoping that this is related to our current issue, but if not any advice would be appreciated. Here are my logs:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
0 File(s) 0 bytes
1 Dir(s) 6,418,878,464 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

12/18/2004 10:29a <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,418,878,464 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/03/2005 10:39a 224,093 guard.tmp
1 File(s) 224,093 bytes
0 Dir(s) 6,418,878,464 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/03/2005 10:39a 224,093 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,787,694 bytes
0 Dir(s) 6,418,878,464 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\r06u0aj9edo.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

01-04-2005, 01:08 PM

----------------------------------------------------------------------------------------------------------------------------------------------------

Logfile of HijackThis v1.98.2
Scan saved at 11:02:42 AM, on 1/4/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\WINNT\system32\wiwcrr.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me~1.me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [C:\WINNT\siyqdkdn.exe] C:\WINNT\siyqdkdn.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany.com
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

Budfred

01-04-2005, 10:22 PM

Unless you installed msconfig as a separate program, it is not a normal part of Win2K, so it shouldn't be there anyway...

Be sure to read this all the way through before starting the fix... It might be a good idea to print it out so that you can make sure you cover it all...

This is still there, so we still need to kill it... Try hitting it with everything you have... Use the Killbox option I already posted, see if you can find it and delete it in Safe Mode and use the file killer in HJT... One way or the other, it has got to go...

C:\WINNT\System32\guard.tmp

If you find it in Safe Mode, right click on it and choose Properties... Make sure it is set to Archive and change it to that if it isn't... Do not let it be Read Only... Then try to delete it...

For the HJT fix... I just noticed you are still using 1.98.2... You need to download the new version 1.99 and put it in a permanent folder... Run the new version 1.99... Then open it and go to Misc Tools... "Open Delete a file on reboot" and either find the file by a browse or just copy/paste it in... Follow through to delete it on the reboot... Then use the "Host file manager" to delete these lines:

O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

Then still in HJT, use it to run a scan and check these items to fix if they are still there (the O1s should be gone):

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [C:\WINNT\siyqdkdn.exe] C:\WINNT\siyqdkdn.exe

Then close all open windows except HJT and click Fix Checked...

I think I asked you to download LSPfix earlier, but if I didn't, please do that when you get the updated version of HJT... Run it and agree "I know what I'm doing", select all instances of aklsp.dll and calsp.dll and move them to the Remove window... Let LSPfix kill them...

Reboot to Safe Mode, find and delete this file:

C:\WINNT\system32\wiwcrr.exe

Now reboot and post a fresh log from HJT 1.99 and FindIt....

Doenut

01-05-2005, 06:05 PM

HJT Log:

Logfile of HijackThis v1.99.0
Scan saved at 4:02:20 PM, on 1/5/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\wiwcrr.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]

O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: ZESOFT - Unknown - C:\WINNT\zeta.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

01-05-2005, 06:06 PM

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/05/2005 03:58p 225,396 nzppzlib.dll
01/05/2005 03:54p 224,093 dn0u01d9e.dll
01/05/2005 03:48p 225,396 gp0ol3d31.dll
01/05/2005 03:38p <DIR> dllcache
01/05/2005 03:10p 224,093 ani2dvag.dll
4 File(s) 898,978 bytes
1 Dir(s) 6,412,374,016 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/05/2005 03:38p <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,412,374,016 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 6,412,374,016 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\gp0ol3d31.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

01-05-2005, 06:30 PM

By the way...

Since I did the most recent series of fixes, my computer has shut down unexpectedly three times in the past hour or so. Not sure if this is related, or if we may have deleted something that should have been kept. Please advise.

Thanks!

Budfred

01-05-2005, 08:01 PM

You have some new DLLs that you will need to kill using the same technique that you used before:

C:\WINNT\System32\nzppzlib.dll
C:\WINNT\System32\dn0u01d9e.dll
C:\WINNT\System32\gp0ol3d31.dll
C:\WINNT\System32\ani2dvag.dll

The good news is that the main file is finally gone and hopefully these are just leftovers... You also need to use the Hosts Manager again to fix these:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

Then open HJT and check these to fix:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O23 - Service: ZESOFT - Unknown - C:\WINNT\zeta.exe

Close all open windows except HJT and click on Fix Checked...

This file is still there, try killing it with the HJT option to delete on reboot:

C:\WINNT\system32\wiwcrr.exe

Do the reboot and post fresh logs again... I suspect the rebooting problem is due to the malware that is still there since the programs you removed shouldn't have been there in the first place...

Doenut

01-06-2005, 01:06 PM

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/06/2005 10:58a <DIR> dllcache
01/06/2005 10:57a 222,759 mvr2c.dll
01/06/2005 10:48a 225,396 gp66l3js1.dll
01/06/2005 09:59a 222,759 d20mlcd11f0.dll
01/06/2005 09:48a 223,016 ktj6l71s1.dll
01/05/2005 04:25p 223,214 d2j02c1mgf.dll
01/05/2005 04:16p 225,485 lv8009lme.dll
6 File(s) 1,342,629 bytes
1 Dir(s) 6,411,042,816 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/06/2005 10:58a <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,411,042,816 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 6,411,042,816 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\d20mlcd11f0.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

01-06-2005, 01:07 PM

Logfile of HijackThis v1.99.0
Scan saved at 11:00:32 AM, on 1/6/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\WINNT\system32\wiwcrr.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

01-06-2005, 01:13 PM

Couldn't find:
C:\WINNT\system32\wiwcrr.exe
when I browsed for it.

I tried to delete it in safe mode yesterday, and the fix said that it couldn't be deleted although the file has disappeared from the address above??? Could it be somehow hidden inside the folder, and if so, how do I get to it?

classicsoftware

01-06-2005, 02:55 PM

Boot into safe mode:

Go to a command prompt. Ignore the warning about corrupted display.

Navigate to the folder in question.

Type attrib -s -r -h wiwcrr.exe

delete wiwcrr.exe

type exit

Wait to do this until Budfred says it's ok as I don't think he wants you to re-boot yet.

Budfred

01-06-2005, 10:28 PM

I am not sure why, but you have some more DLLs even though you killed the file that is supposed to regenerate them... Go ahead and use the same process to kill them and then run the new version of FindIt to see how things look now... Maybe the old one was missing the problem... These are the files to fix:

C:\WINNT\System32\mvr2c.dll
C:\WINNT\System32\gp66l3js1.dll
C:\WINNT\System32\d20mlcd11f0.dll
C:\WINNT\System32\ktj6l71s1.dll
C:\WINNT\System32\d2j02c1mgf.dll
C:\WINNT\System32\lv8009lme.dll

The latest FindIt is too big to include as an attachment, so here is a link that will hopefully work, take the one from this date: 06-Jan-2005 08:22 29k

http://www.thatcomputerguy.us/downloads/

Did you try using KillBox and/or the HJT version of KillBox on:

C:\WINNT\system32\wiwcrr.exe

It should be okay to reboot now, so you can follow through with classicsoftwares approach if those are not working... Hopefully we are coming into the home stretch on this thing...

:)

Doenut

01-07-2005, 12:59 PM

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/07/2005 09:17a 225,396 i6240gfqe62e0.dll
01/06/2005 05:23p 226,236 hr4q05h5e.dll
01/06/2005 03:56p 225,396 enj2l11o1.dll
01/06/2005 10:58a <DIR> dllcache
3 File(s) 677,028 bytes
1 Dir(s) 6,401,757,184 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/06/2005 10:58a <DIR> dllcache
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
2 Dir(s) 6,401,757,184 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/07/2005 09:34a 225,396 guard.tmp
1 File(s) 225,396 bytes
0 Dir(s) 6,401,757,184 bytes free

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/07/2005 09:34a 225,396 guard.tmp
08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
6 File(s) 2,788,997 bytes
0 Dir(s) 6,401,757,184 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Shell Extensions]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\enj2l11o1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

01-07-2005, 01:01 PM

Logfile of HijackThis v1.99.0
Scan saved at 10:53:55 AM, on 1/7/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\wiwcrr.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: Domain = gardnerbender.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: NameServer = 192.53.101.22,192.53.101.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

01-07-2005, 03:49 PM

I couldn't get the new Find It to work, so I posted my log from the latest download I have.

I also was unable to find wiwcrr.exe as classicsoftware suggested...

The saga continues!

Budfred

01-07-2005, 10:49 PM

I am not sure what is going on now... The main bad file is back and there are still some new DLLs... I am going to post in another forum and ask if the people who are developing the fix can figure out what is going on...

Meanwhile, did you try KillBox and the file killer in HJT??

Budfred

01-08-2005, 01:57 AM

What problems are you having getting FindIt to run... It is not giving a complete report which is probably part of the problem...

Also try this, boot to Safe Mode, run FindIt it again and kill the new DLLs that show up in either at the top or bottom of the file that meet the criteria that I already indicated... If FindIt works properly, there will be some at the top and the bottom... Also kill that guard.tmp file in Safe Mode with KillBox... See if you can also kill the C:\WINNT\system32\wiwcrr.exe in Safe Mode as well, but I suspect we need to get FindIt working properly to kill that one too...

Please post back as much detail as you can about what did and didn't work and what happened if it didn't work... Then, once again, post a fresh HJT and FindIt log...

Doenut

01-11-2005, 02:50 PM

The version of FindIt you linked me to did not work when I opened it - it would scan, but wouldn't create a log. I'm getting to your instructions, but have been real busy. In the meantime, I think I messed up something when I followed Classicsoftware's instructions. Here's what I get when I boot my system up:

Window title:
16 Bit MS-DOS Subsystem

Window text:
"C:\WINNT\System32\wiwcrr.exe
The NTVDM CPU has encountered an illegal instruction. CS:0e27 IP:0ed7 OP: ff ff ff ff Choose 'Close' to terminate the application."

I think I did something wrong when trying to navigate to the folder in safe mode...

Thoughts?

classicsoftware

01-11-2005, 03:55 PM

You need to get to the folder were the file is.

you need to type attrib -s -h -r wiwcrr.exe

you could try it from anywhere, but I don;t know if it would work

attrib -s -h -r C:\WINNT\System32\wiwcrr.exe

Budfred

01-11-2005, 09:27 PM

That file that is so hard to kill is probably part of another infection that isn't showing up because FindIt isn't working properly... Try downloading this version and running it to see if it will do it... Be sure to run it in Safe Mode and then post the log here... Most of these fixes are going to work best in Safe Mode, but that means you will need to use FindIt to figure out which DLLs need to be killed after you boot to Safe Mode....

http://lineofire.geekstogo.com/FindIt%20NT-2K-XP.zip

Doenut

01-13-2005, 03:31 PM

Classicsoftware:

Pardon my ignorance, but I'm not quite sure how to navigate to the file per your instructions. In my previous post, I mentioned that I get an error message upon startup relating to this file. My questions are:

1.) How specifically do I navigate to the file?
2.) How do I get rid of the error message upon startup?

Thanks!

Doenut

01-13-2005, 03:36 PM

---------------- FindVX2 NT-2K-XP ----------------

*********** Path ***********

FindVX2.bat is running from: C:\me\Media

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/13/2005 12:57p 222,809 HFL.DLL
01/13/2005 12:57p 222,820 dnj0011me.dll
01/13/2005 10:24a <DIR> dllcache
01/11/2005 04:53p 225,396 j82qlif5182.dll
01/11/2005 08:39a 225,396 i0lo0a33ed.dll
01/10/2005 04:00p 225,396 hr8o05l3e.dll
01/07/2005 04:49p 225,396 l66olgj316o.dll
01/06/2005 05:23p 226,236 hr4q05h5e.dll
7 File(s) 1,573,449 bytes
1 Dir(s) 7,125,364,736 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/13/2005 10:24a <DIR> dllcache
01/07/2005 11:43a <DIR> vmss
01/07/2005 11:43a <DIR> wsxsvc
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
4 Dir(s) 7,125,364,736 bytes free

--------------- Files Named "Guard" --------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

-------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 7,125,364,736 bytes free

------------------- User Agent -------------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

--------------- Keys Under Notify ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Group Policy]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\e202lcdo1f0c.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

Doenut

01-13-2005, 03:38 PM

------------ Shell Extensions Approved -----------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network and Dial-up Connections"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder"
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer"
"{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder"
"{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut"
"{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume"
"{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension"
"{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page"
"{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook"
"{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
"{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
"{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
"{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
"{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu"
"{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
"{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
"{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler"
"{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions"
"{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
"{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension"
"{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
"{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper"
"{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Add encryption item to context menus in explorer"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
"{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
"{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{AF8DE18D-9065-4102-BC40-EB294A95BB07}"="Novell Connections"
"{04c23aa0-3d34-11d2-b788-008029605ac7}"="NDPS Shell Extension"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"

Doenut

01-13-2005, 03:38 PM

"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{8BE13461-936F-11D1-A87D-444553540000}"="Eraser Shell Extension"
"{5B985B0A-D5FC-4349-AFE2-00708F68460E}"=""
"{CBB01AFE-8118-45C4-81A8-8039992E8EB8}"=""
"{B294A3CA-9711-4F52-97D5-560CB57F4C70}"=""
"{E78E125E-52A7-4752-93E2-FCA4DD8A8436}"=""
"{53A6B9C2-435C-43CD-BC91-6E8AF5B1A661}"=""
"{2D372E05-357D-45E6-AB35-92C8DA7D7EFF}"=""
"{310EF404-6959-456E-ACF9-6E8722B82DD0}"=""
"{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}"=""
"{5C64FBB6-62AB-4FED-98E5-A8E515C744DC}"=""

Doenut

01-13-2005, 03:41 PM

Logfile of HijackThis v1.99.0
Scan saved at 1:15:40 PM, on 1/13/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\explorer.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wiwcrr.exe
O4 - HKLM\..\Run: [Dvx] C:\WINNT\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINNT\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [Uninstall_TBPS] C:\WINNT\Temp\TBuninst.exe /remove
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINNT\Temp\WTuninst.exe /remove
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Budfred

01-15-2005, 01:41 AM

I have been told that some of your files are broken and need to be fixed to get a complete log and see all the problems... Please go here and follow these instructions to do the fix:

http://support.microsoft.com/?kbid=324767

These are the DLLs to use KillBox on this time, but this will not fix the whole problem:

C:\WINNT\System32\HFL.DLL
C:\WINNT\System32\dnj0011me.dll
C:\WINNT\System32\j82qlif5182.dll
C:\WINNT\System32\i0lo0a33ed.dll
C:\WINNT\System32\hr8o05l3e.dll
C:\WINNT\System32\l66olgj316o.dll
C:\WINNT\System32\hr4q05h5e.dll

Then you also have some HJT fixes to do this time... Please open an HJT scan and check these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Dvx] C:\WINNT\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wiwcrr.exe
O4 - HKLM\..\Run: [vmss] C:\WINNT\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [Uninstall_TBPS] C:\WINNT\Temp\TBuninst.exe /remove

Close all open windows except HJT and click Fix Checked...

Reboot to Safe Mode and find and remove these folders and files if possible... KillBox or use the HJT file killer if needed...

C:\WINNT\system32\wsxsvc\wsxsvc.exe
C:\WINNT\system32\wiwcrr.exe
C:\WINNT\system32\vmss\vmss.exe
C:\WINNT\Temp\TBuninst.exe /remove

For that last one, you may want to simply empty your Temp folder... You can use Eraser to do that...

This will still not fix Narrator and we will need another log to find all the files to kill to do that... After you do these fixes, reboot and post a fresh HJT log, a FindVx2.bat log and also a FindNarrator.bat log... Do not reboot again if at all possible...

classicsoftware

01-15-2005, 11:23 AM

Doenut,

where do you live?

If you want, I can talk you through the DOS commands on the phone let me know.

Budfred

01-15-2005, 07:34 PM

classicsoftware,

That file is part of the Narrator infection and we can kill it when we have the Narrator log to look at... You probably won't succeed any other way because it will regenerate from the hidden files...

Doenut

01-17-2005, 12:49 PM

Okay, I'm not getting the wiwcrr.exe message any more. I ran AdAware several times on Friday and may have gotten rid of it then???

Following are my logs for your review:

Logfile of HijackThis v1.99.0
Scan saved at 10:42:50 AM, on 1/17/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\wiwgrr.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

01-17-2005, 12:52 PM

---------------- FindVX2 NT-2K-XP ----------------

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

***** Operating System *****

********* Date/Time ********

*********** Path ***********

FindVX2.bat is running from: C:\me\Media

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/17/2005 10:40a 222,820 huvcr70.dll
01/17/2005 10:40a 223,271 dnn4015qe.dll
01/17/2005 10:04a 222,820 j8l4li3q18.dll
01/13/2005 03:06p <DIR> dllcache
3 File(s) 668,911 bytes
1 Dir(s) 7,137,226,752 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/13/2005 03:06p <DIR> dllcache
01/07/2005 11:43a <DIR> vmss
01/07/2005 11:43a <DIR> wsxsvc
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
4 Dir(s) 7,137,226,752 bytes free

--------------- Files Named "Guard" --------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

-------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 7,137,226,752 bytes free

------------------- User Agent -------------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

--------------- Keys Under Notify ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnce]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\j8l4li3q18.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

Doenut

01-17-2005, 12:53 PM

Doenut

01-17-2005, 12:54 PM

AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{AF8DE18D-9065-4102-BC40-EB294A95BB07}"="Novell Connections"
"{04c23aa0-3d34-11d2-b788-008029605ac7}"="NDPS Shell Extension"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{8BE13461-936F-11D1-A87D-444553540000}"="Eraser Shell Extension"
"{5B985B0A-D5FC-4349-AFE2-00708F68460E}"=""
"{CBB01AFE-8118-45C4-81A8-8039992E8EB8}"=""
"{B294A3CA-9711-4F52-97D5-560CB57F4C70}"=""
"{E78E125E-52A7-4752-93E2-FCA4DD8A8436}"=""
"{53A6B9C2-435C-43CD-BC91-6E8AF5B1A661}"=""
"{2D372E05-357D-45E6-AB35-92C8DA7D7EFF}"=""
"{310EF404-6959-456E-ACF9-6E8722B82DD0}"=""
"{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}"=""
"{5C64FBB6-62AB-4FED-98E5-A8E515C744DC}"=""
"{7387D620-828D-4C9F-9275-E564EEE095FB}"=""
"{F4E222CF-4D20-47BC-9F6A-2F99C9C5D9C5}"=""

--------------- Locate.com Results ---------------

---------------- FindVX2 NT-2K-XP ----------------

Doenut

01-17-2005, 12:57 PM

Also, I wasn't able to open the FindNarrator.bat log. I double-click on it, and a black window pops up quickly and then disappears...

The files you wanted me to delete in safe mode were not found, but I did see a file called:
C:\WINNT\system32\wiwgrr.exe which was created today??

This thing may be moving around, but I'm not sure. Please advise.

Thanks!

Budfred

01-17-2005, 08:24 PM

Did you do that fix I posted from MS?? It appears that you will not be able to get accurate logs until you run that and we need the logs to fix Narrator... That said, the good news is that there is now an automated fix for Vx2 that will hopefully end the loop we are in now... Here is the canned speech for using it...

You have the latest version of VX2. Download L2mfix from one of these two

locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the

Install button to extract the files and follow the prompts, then open the

newly added l2mfix folder on your desktop. Double click l2mfix.bat and

select option #1 for Run Find Log by typing 1 and then pressing

enter. This will scan your computer and it may appear nothing is happening, then,

after a minute or 2, notepad will open with a log. Copy the contents of that log and

paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix

folder until you are asked to do so!

Doenut

01-18-2005, 12:24 PM

Budfred,

The problem is that the fix you suggested from Microsoft asks me to insert the CD. My company's IT dept. has the CD's in another part of the country, and I'd rather not ask them for the CD.

But, I am not getting the error message upon booting any more. Not sure if that helps or not. Would you like me to make a screenshot of my system 32 files for you? Surely there's another way around this. I'll follow your instructions from your most recent post now.

Thanks!

Doenut

01-18-2005, 12:31 PM

These are the registry keys present
************************************************** ********************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00, 2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00, 74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnce]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\j8l4li3q18.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00, 79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

************************************************** ********************************
useragent:
************************************************** ********************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=""

Files Found are not all bad files:

C:\WINNT\SYSTEM32\
dnn401~1.dll Mon Jan 17 2005 10:40:04a ..S.R 223,271 218.04 K

1 item found: 1 file, 0 directories.
Total of file sizes: 223,271 bytes 218.04 K

No matches found.

Budfred

01-18-2005, 08:59 PM

Here is the next step:

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!

Doenut

01-19-2005, 12:28 PM

Logs to follow...

My computer locked up yesterday, and I had to reboot. Hope that didn't hinder your efforts.

L2Mfix 1.01

Running From:
C:\Documents and Settings\me\Desktop\l2mfix

Vbruntimes Found!

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C access for really "Everyone"
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting up for Reboot

Starting Reboot!

C:\Documents and Settings\me\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\me\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1716 'explorer.exe'
Killing PID 1716 'explorer.exe'
Error 0x5 : Access is denied.

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1796 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINNT\system32\lytwn11n.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\rugwizc.dll
1 file(s) copied.
deleting: C:\WINNT\system32\lytwn11n.dll
Successfully Deleted: C:\WINNT\system32\lytwn11n.dll
deleting: C:\WINNT\system32\rugwizc.dll
Successfully Deleted: C:\WINNT\system32\rugwizc.dll

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: lytwn11n.dll (152 bytes security) (deflated 4%)
adding: rugwizc.dll (152 bytes security) (deflated 4%)
adding: cecho.reg (152 bytes security) (deflated 2%)
adding: Cleanup.reg (152 bytes security) (deflated 42%)
adding: echo.reg (152 bytes security) (deflated 9%)
adding: desktop.ini (152 bytes security) (deflated 15%)
adding: CLSID.txt (152 bytes security) (deflated 1%)
adding: direct.txt (152 bytes security) (stored 0%)
adding: lo2.txt (152 bytes security) (deflated 73%)
adding: readme.txt (152 bytes security) (deflated 46%)
adding: report.txt (152 bytes security) (deflated 76%)
adding: test.txt (152 bytes security) (deflated 33%)
adding: xfind.txt (152 bytes security) (deflated 28%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for really "Everyone"

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: lytwn11n.dll
deleting local copy: rugwizc.dll

The following Is the Current Export of the Winlogon notify key:
************************************************** **************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00, 2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00, 74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00, 79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

Doenut

01-19-2005, 12:29 PM

The following are the files found:
************************************************** **************************
C:\WINNT\system32\lytwn11n.dll
C:\WINNT\system32\rugwizc.dll

Registry Entries to be Deleted:
Please verify that the listing looks ok. It shouldn't be longer than 13 lines
If approved by helper double click the cleanup.reg in the l2mfix folder.
************************************************** **************************
REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD01EFA B-6205-4620-A3EE-778FA8FAE75E}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Shell Extensions\Approved\{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{FD07CE0E-4F37-41CB-9354-AAE396746A0C}"=-
************************************************** **************************
Desktop.ini Contents:
************************************************** **************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{FD07CE0E-4F37-41CB-9354-AAE396746A0C}</IDone>
<IDtwo>VT00</IDtwo>
<VERSION>200</VERSION>
************************************************** **************************
Classid's found from regsearch:
************************************************** **************************
{CD01EFAB-6205-4620-A3EE-778FA8FAE75E} C:\WINNT\system32\rugwizc.dll

Doenut

01-19-2005, 12:31 PM

Logfile of HijackThis v1.99.0
Scan saved at 10:20:51 AM, on 1/19/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\WINNT\system32\wiwgrr.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\rundll32.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =my company
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = my company
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = my company
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Budfred

01-19-2005, 11:17 PM

Here is the next step for the Vx2...

Go back to the l2mfix folder on your desktop and double click cleanup.reg. Click Yes to the confirmation message, then click OK.

Then open an HJT scan and check these to see if we can clean them out:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

Close all open windows except HJT and click Fix Checked...

Reboot and post a fresh log... Hopefully that will leave us with only Narrator to deal with...

Doenut

01-20-2005, 12:39 PM

Logfile of HijackThis v1.99.0
Scan saved at 10:35:17 AM, on 1/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\WINNT\system32\wiwgrr.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Budfred

01-20-2005, 11:19 PM

It looks like we finally killed Vx2... Congratulations... Now we need to see if we can get Narrator...

Try running FindNarrator.bat again and see if it will work this time...

You can also just try to kill this with KillBox and see if it works now that the big fix is done:

C:\WINNT\system32\wiwgrr.exe

If these options don't work, I will dig a bit deeper... Post back with a fresh log after reboot to let me know...

Doenut

01-21-2005, 12:46 AM

FindNarrator.bat still doesn't work - a little black box pops up and disappears. I tried Killbox, and got the illegal instruction message for wiwgrr.exe. Hmmm...

Fresh Log:

Logfile of HijackThis v1.99.0
Scan saved at 10:41:11 PM, on 1/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huhitt.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Budfred

01-21-2005, 12:57 AM

Well, wiwgrr.exe seems to be gone... Did you use the delete on reboot option with KillBox... It looks like it may have killed it and I don't see anything that substituted... You may need to get some repair of WinXP done with the help of IT, but I think the computer may be clean!! Keep an eye on it for a couple of days and post back if you see anymore problems... Also, let me know if the user is able to install some protections programs... SpywareBlaster, SpywareGuard, the TeaTimer function in Spybot and IE-Spyads would all be a good idea.... Also, if you don't already have a firewall through the network, that would be important too....

Oops... I spoke too soon... I just noticed this... you need to kill it:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huhitt.exe

Doenut

01-21-2005, 01:26 AM

I put the huhitt.exe into killbox and after reboot got illegal instruction boxes for both wiwgrr.exe and huhitt.exe. Not sure if they will go away like the wiwcrr.exe did, but if you have any suggestions, I'm all ears. Here's a fresh log for hopefully the last time!

My sincere thanks for your help. Why anyone would want to go to the effort to screw people's computers up is beyond me, and why people like you would know how to fix it boggles my mind. Thanks for being available. I'll download the preventive measures you suggested. Let me know if there's anything else I need to do.

Regards,

Doenut

Logfile of HijackThis v1.99.0
Scan saved at 11:23:43 PM, on 1/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wiwgrr.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: huhitt.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

01-21-2005, 01:51 AM

One more thing... I ran AdAware and it was running fine until I got to the "Scanning Browser Cache" section. It still locks up and won't go any further...

Budfred

01-21-2005, 11:43 PM

You still have Narrator... As I understand it, you need to repair WinXP to get the log to work and to show what needs to be fixed... Apparently this will fix it for you (hopefully)...

http://www.oldmp.com/forms/download/xpservicepack2.htm

Try it and then see if you can run the FindNarrator.bat file again... You may want to download the latest FindIt since it may have been updated to work better...

http://lineofire.geekstogo.com/FindIt%20NT-2K-XP.zip

If you can get a log, post it here... If not, let me know what happened... Also, you can try running Ad-Aware SE in Safe Mode and see if it goes all the way through...

Doenut

01-24-2005, 11:49 AM

Bud,

The fix you linked me to is for Windows XP. I have Windows 2000 Professional on my computer - should this make a difference? I won't change anything until I hear back from you.

thanks!

Doenut

01-24-2005, 01:38 PM

Okay, I read through the fix instructions and saw that the fix was appropriate for win2000. I did the fix, and have eliminated the wiwgrr.exe pop-up.

Also, I tried to run FindNarrator.bat, and get a very brief black pop-up box. It quickly disappears and won't work...

Here's my FindVx2 log in case you need it:

---------------- FindVX2 NT-2K-XP ----------------

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

***** Operating System *****

********* Date/Time ********

*********** Path ***********

FindVX2.bat is running from: C:\me\Media

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/24/2005 10:05a <DIR> dllcache
01/18/2005 05:12p 222,820 k0440ahqed4e0.dll
1 File(s) 222,820 bytes
1 Dir(s) 7,001,309,184 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/24/2005 10:05a <DIR> dllcache
01/07/2005 11:43a <DIR> vmss
01/07/2005 11:43a <DIR> wsxsvc
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
4 Dir(s) 7,001,309,184 bytes free

--------------- Files Named "Guard" --------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

-------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 7,001,309,184 bytes free

------------------- User Agent -------------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{D5DCD143-0ED8-4796-BA98-554BB6D75FFC}"=""

--------------- Keys Under Notify ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

Doenut

01-24-2005, 01:42 PM

Doenut

01-24-2005, 01:43 PM

AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{AF8DE18D-9065-4102-BC40-EB294A95BB07}"="Novell Connections"
"{04c23aa0-3d34-11d2-b788-008029605ac7}"="NDPS Shell Extension"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{8BE13461-936F-11D1-A87D-444553540000}"="Eraser Shell Extension"
"{5B985B0A-D5FC-4349-AFE2-00708F68460E}"=""
"{CBB01AFE-8118-45C4-81A8-8039992E8EB8}"=""
"{B294A3CA-9711-4F52-97D5-560CB57F4C70}"=""
"{E78E125E-52A7-4752-93E2-FCA4DD8A8436}"=""
"{53A6B9C2-435C-43CD-BC91-6E8AF5B1A661}"=""
"{2D372E05-357D-45E6-AB35-92C8DA7D7EFF}"=""
"{310EF404-6959-456E-ACF9-6E8722B82DD0}"=""
"{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}"=""
"{5C64FBB6-62AB-4FED-98E5-A8E515C744DC}"=""
"{7387D620-828D-4C9F-9275-E564EEE095FB}"=""
"{F4E222CF-4D20-47BC-9F6A-2F99C9C5D9C5}"=""
"{9B7891AB-A29D-418D-B5A9-67590AF04CC2}"=""
"{C6042AF9-F68C-4BE4-A5EE-6C82F8834E10}"=""
"{7F1E7156-A7BE-4719-8E12-A8670F1419FA}"=""
"{9FBB091C-33FB-4062-8667-7AA8DB42153C}"=""

--------------- Locate.com Results ---------------

C:\WINNT\SYSTEM32\
k0440a~1.dll Tue Jan 18 2005 5:12:08p ..S.R 222,820 217.60 K

1 item found: 1 file, 0 directories.
Total of file sizes: 222,820 bytes 217.60 K

---------------- FindVX2 NT-2K-XP ----------------

Budfred

01-24-2005, 11:35 PM

It looks like you still have some Vx2 left... Download l2mfix.exe again since it has been updated and is more powerful now... Run the first and second steps... Don't post the log from the first step, but save it in case we need it later... Post the log from the cleaning step... Also post a fresh HJT log after a reboot...

Sorry about forgetting you have Win2000....

Doenut

01-26-2005, 07:20 PM

L2Mfix 1.02

Running From:
C:\Documents and Settings\me\Desktop\l2mfix

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C access for really "Everyone"
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting up for Reboot

Starting Reboot!

C:\Documents and Settings\me\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\me\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1728 'explorer.exe'
Killing PID 1728 'explorer.exe'
Error 0x5 : Access is denied.

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Error, Cannot find a process with an image name of rundll32.exe

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINNT\system32\k0440ahqed4e0.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\ndptools.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\tjpmonui.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\wttdecod.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\WZonfig.dll
1 file(s) copied.
deleting: C:\WINNT\system32\k0440ahqed4e0.dll
Successfully Deleted: C:\WINNT\system32\k0440ahqed4e0.dll
deleting: C:\WINNT\system32\ndptools.dll
Successfully Deleted: C:\WINNT\system32\ndptools.dll
deleting: C:\WINNT\system32\tjpmonui.dll
Successfully Deleted: C:\WINNT\system32\tjpmonui.dll
deleting: C:\WINNT\system32\wttdecod.dll
Successfully Deleted: C:\WINNT\system32\wttdecod.dll
deleting: C:\WINNT\system32\WZonfig.dll
Successfully Deleted: C:\WINNT\system32\WZonfig.dll

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: k0440ahqed4e0.dll (152 bytes security) (deflated 3%)
adding: ndptools.dll (152 bytes security) (deflated 4%)
adding: tjpmonui.dll (152 bytes security) (deflated 4%)
adding: wttdecod.dll (152 bytes security) (deflated 4%)
adding: WZonfig.dll (152 bytes security) (deflated 4%)
updating: cecho.reg (152 bytes security) (deflated 2%)
updating: Cleanup.reg (152 bytes security) (deflated 44%)
updating: echo.reg (152 bytes security) (deflated 9%)
adding: clear.reg (152 bytes security) (deflated 68%)
updating: desktop.ini (152 bytes security) (deflated 13%)
updating: direct.txt (152 bytes security) (stored 0%)
updating: lo2.txt (152 bytes security) (deflated 75%)
updating: readme.txt (152 bytes security) (deflated 49%)
updating: report.txt (152 bytes security) (deflated 73%)
updating: test.txt (152 bytes security) (deflated 59%)
updating: xfind.txt (152 bytes security) (deflated 51%)
adding: log.txt (152 bytes security) (deflated 78%)
adding: test2.txt (152 bytes security) (deflated 47%)
adding: backregs/2D372E05-357D-45E6-AB35-92C8DA7D7EFF.reg (152 bytes security) (deflated 70%)
adding: backregs/310EF404-6959-456E-ACF9-6E8722B82DD0.reg (152 bytes security) (deflated 70%)
adding: backregs/53A6B9C2-435C-43CD-BC91-6E8AF5B1A661.reg (152 bytes security) (deflated 70%)
adding: backregs/5B985B0A-D5FC-4349-AFE2-00708F68460E.reg (152 bytes security) (deflated 70%)
adding: backregs/5C64FBB6-62AB-4FED-98E5-A8E515C744DC.reg (152 bytes security) (deflated 70%)
adding: backregs/7387D620-828D-4C9F-9275-E564EEE095FB.reg (152 bytes security) (deflated 70%)
adding: backregs/7F1E7156-A7BE-4719-8E12-A8670F1419FA.reg (152 bytes security) (deflated 70%)
adding: backregs/9B7891AB-A29D-418D-B5A9-67590AF04CC2.reg (152 bytes security) (deflated 70%)
adding: backregs/9FBB091C-33FB-4062-8667-7AA8DB42153C.reg (152 bytes security) (deflated 70%)
adding: backregs/B294A3CA-9711-4F52-97D5-560CB57F4C70.reg (152 bytes security) (deflated 70%)
adding: backregs/C6042AF9-F68C-4BE4-A5EE-6C82F8834E10.reg (152 bytes security) (deflated 70%)
adding: backregs/CBB01AFE-8118-45C4-81A8-8039992E8EB8.reg (152 bytes security) (deflated 71%)
adding: backregs/E78E125E-52A7-4752-93E2-FCA4DD8A8436.reg (152 bytes security) (deflated 70%)
adding: backregs/F4E222CF-4D20-47BC-9F6A-2F99C9C5D9C5.reg (152 bytes security) (deflated 70%)
adding: backregs/shell.reg (152 bytes security) (deflated 74%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for really "Everyone"

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: k0440ahqed4e0.dll
deleting local copy: ndptools.dll
deleting local copy: tjpmonui.dll
deleting local copy: wttdecod.dll
deleting local copy: WZonfig.dll

The following Is the Current Export of the Winlogon notify key:
************************************************** **************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00, 2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

Doenut

01-26-2005, 07:21 PM

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00, 74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00, 79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

The following are the files found:
************************************************** **************************
C:\WINNT\system32\k0440ahqed4e0.dll
C:\WINNT\system32\ndptools.dll
C:\WINNT\system32\tjpmonui.dll
C:\WINNT\system32\wttdecod.dll
C:\WINNT\system32\WZonfig.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
************************************************** **************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Shell Extensions\Approved]
"{5B985B0A-D5FC-4349-AFE2-00708F68460E}"=-
"{CBB01AFE-8118-45C4-81A8-8039992E8EB8}"=-
"{B294A3CA-9711-4F52-97D5-560CB57F4C70}"=-
"{E78E125E-52A7-4752-93E2-FCA4DD8A8436}"=-
"{53A6B9C2-435C-43CD-BC91-6E8AF5B1A661}"=-
"{2D372E05-357D-45E6-AB35-92C8DA7D7EFF}"=-
"{310EF404-6959-456E-ACF9-6E8722B82DD0}"=-
"{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}"=-
"{5C64FBB6-62AB-4FED-98E5-A8E515C744DC}"=-
"{7387D620-828D-4C9F-9275-E564EEE095FB}"=-
"{F4E222CF-4D20-47BC-9F6A-2F99C9C5D9C5}"=-
"{9B7891AB-A29D-418D-B5A9-67590AF04CC2}"=-
"{C6042AF9-F68C-4BE4-A5EE-6C82F8834E10}"=-
"{7F1E7156-A7BE-4719-8E12-A8670F1419FA}"=-
"{9FBB091C-33FB-4062-8667-7AA8DB42153C}"=-
[-HKEY_CLASSES_ROOT\CLSID\{5B985B0A-D5FC-4349-AFE2-00708F68460E}]
[-HKEY_CLASSES_ROOT\CLSID\{CBB01AFE-8118-45C4-81A8-8039992E8EB8}]
[-HKEY_CLASSES_ROOT\CLSID\{B294A3CA-9711-4F52-97D5-560CB57F4C70}]
[-HKEY_CLASSES_ROOT\CLSID\{E78E125E-52A7-4752-93E2-FCA4DD8A8436}]
[-HKEY_CLASSES_ROOT\CLSID\{53A6B9C2-435C-43CD-BC91-6E8AF5B1A661}]
[-HKEY_CLASSES_ROOT\CLSID\{2D372E05-357D-45E6-AB35-92C8DA7D7EFF}]
[-HKEY_CLASSES_ROOT\CLSID\{310EF404-6959-456E-ACF9-6E8722B82DD0}]
[-HKEY_CLASSES_ROOT\CLSID\{CD01EFAB-6205-4620-A3EE-778FA8FAE75E}]
[-HKEY_CLASSES_ROOT\CLSID\{5C64FBB6-62AB-4FED-98E5-A8E515C744DC}]
[-HKEY_CLASSES_ROOT\CLSID\{7387D620-828D-4C9F-9275-E564EEE095FB}]
[-HKEY_CLASSES_ROOT\CLSID\{F4E222CF-4D20-47BC-9F6A-2F99C9C5D9C5}]
[-HKEY_CLASSES_ROOT\CLSID\{9B7891AB-A29D-418D-B5A9-67590AF04CC2}]
[-HKEY_CLASSES_ROOT\CLSID\{C6042AF9-F68C-4BE4-A5EE-6C82F8834E10}]
[-HKEY_CLASSES_ROOT\CLSID\{7F1E7156-A7BE-4719-8E12-A8670F1419FA}]
[-HKEY_CLASSES_ROOT\CLSID\{9FBB091C-33FB-4062-8667-7AA8DB42153C}]
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{D5DCD143-0ED8-4796-BA98-554BB6D75FFC}"=-
************************************************** **************************
Desktop.ini Contents:
************************************************** **************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{D5DCD143-0ED8-4796-BA98-554BB6D75FFC}</IDone>
<IDtwo>AD</IDtwo>
<VERSION>200</VERSION>
************************************************** **************************
Classid's found from regsearch:
************************************************** **************************

Doenut

01-26-2005, 07:22 PM

Logfile of HijackThis v1.99.0
Scan saved at 5:20:18 PM, on 1/26/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wiwgrr.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: huhitt.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: Domain =
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: NameServer = 192.53.101.22,192.53.101.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Budfred

01-26-2005, 09:35 PM

This is back, try to fix it with HJT and post a new log again after reboot...

O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wiwgrr.exe

Also, please post a new Vx2Find.bat log so we can see if it is really gone this time....

Doenut

01-27-2005, 11:16 AM

Logfile of HijackThis v1.99.0
Scan saved at 9:10:58 AM, on 1/27/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\DOCUME~1\me\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: huhitt.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: Domain = .com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A310BB61-0C22-4A4C-A88D-B9CA92CACCFB}: NameServer = 192.53.101.22,192.53.101.23
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

01-27-2005, 11:19 AM

---------------- FindVX2 NT-2K-XP ----------------

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

***** Operating System *****

********* Date/Time ********

*********** Path ***********

FindVX2.bat is running from: C:\me\Media

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/24/2005 10:05a <DIR> dllcache
0 File(s) 0 bytes
1 Dir(s) 6,992,048,128 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/24/2005 10:05a <DIR> dllcache
01/07/2005 11:43a <DIR> vmss
01/07/2005 11:43a <DIR> wsxsvc
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
4 Dir(s) 6,992,048,128 bytes free

--------------- Files Named "Guard" --------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

-------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 6,992,048,128 bytes free

------------------- User Agent -------------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]

--------------- Keys Under Notify ----------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

Doenut

01-27-2005, 11:20 AM

Doenut

01-27-2005, 11:21 AM

"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{AF8DE18D-9065-4102-BC40-EB294A95BB07}"="Novell Connections"
"{04c23aa0-3d34-11d2-b788-008029605ac7}"="NDPS Shell Extension"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{8BE13461-936F-11D1-A87D-444553540000}"="Eraser Shell Extension"

--------------- Locate.com Results ---------------

---------------- FindVX2 NT-2K-XP ----------------

Doenut

01-27-2005, 11:31 AM

Budfred,

Another thing: When I boot my computer up, I get a window with the title,
"16 Bit MS-Dos Subsystem." It has a black window behind it, and the contents of the Subsystem window are:
"C:\Docume~1\ALLUSE~1\STARTM~1\Programs\Startup\huh itt.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0de9 IP:0dec OP:0f 03 c8 bf 70 Choose 'Close' to terminate the application."

The fix you pointed me to for the wiwgrr.exe worked for a day or so, but yesterday, I got a brief Black pop-up box with wiwgrr mentioned in it before it disappeared. I think that since I deleted wiwgrr in HJT, I shouldn't see it again unless its root is not killed. But, I also have a feeling that the huhitt may be somehow related and am hoping that there's a fix for it too.

As always, thanks for your help. It looks like we may be getting close to a fix.

Budfred

01-28-2005, 12:52 AM

I am afraid I am not so optimistic this time... I have asked some more expert people to take a look and let me know what I am missing... You still have signs of Vx2, Narrator and some other things that go along with them... I will get back to you tomorrow hopefully...

Budfred

01-29-2005, 12:44 AM

Okay, a couple more ideas...

One suggestion is that what I am still seeing there is leftovers from the main infection and that Ad-Aware SE may be able to clean it up... Try running Ad-Aware's Vx2 Add-on after first downloading and installing the latest version... Update Ad-Aware itself and run a full scan....

For the Narrator problem... It was suggest that you use this version of the Findit tool to see if we can see the root files that keep restoring it, so try this and post the log:

http://www.thatcomputerguy.us/downloads/finditnt2000xp.zip

Maybe we will get it all this time... ;) :rolleyes:

Edit: One other point I forgot, make sure you unzip that file and install it in a folder so that it will run properly... At least one person who reviewed this process suggested that may be why it is not running properly...

Doenut

01-31-2005, 02:29 PM

I updated AdAware, ran the Vx2 Add-on, got a "Clean" log.

Ran AdAware several times, and it still locks up while scanning Browser Cache...

I tried the version of FindIt you linked me to, and it didn't work. The following log is from an earlier version of FindIt you gave me which I installed into a folder and was able to run successfully:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/24/2005 10:05a <DIR> dllcache
0 File(s) 0 bytes
1 Dir(s) 6,969,712,640 bytes free

------- Hidden Files in System32 Directory -------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

01/24/2005 10:05a <DIR> dllcache
01/07/2005 11:43a <DIR> vmss
01/07/2005 11:43a <DIR> wsxsvc
09/30/2003 12:20p <DIR> GroupPolicy
09/30/2003 12:11p 21,692 folder.htt
09/30/2003 12:11p 271 desktop.ini
2 File(s) 21,963 bytes
4 Dir(s) 6,969,712,640 bytes free

---------- Files Named "Guard" -------------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

--------- Temp Files in System32 Directory --------

Volume in drive C has no label.
Volume Serial Number is 6069-E44C

Directory of C:\WINNT\System32

08/03/2004 11:56p 1,236,480 ~GLH0014.TMP
08/03/2004 11:56p 1,236,480 ~GLH001a.TMP
03/31/2003 06:00a 44,032 ~GLH0019.TMP
03/31/2003 06:00a 44,032 ~GLH0013.TMP
07/24/2002 06:00a 2,577 CONFIG.TMP
5 File(s) 2,563,601 bytes
0 Dir(s) 6,969,712,640 bytes free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]

------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
"Asynchronous"=dword:00000000
"DLLName"="ckpNotify.dll"
"Impersonate"=dword:00000001
"Logoff"="WLEventLogOff"
"Logon"="WLEventLogOn"
"Shutdown"="WLEventShutDown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"StartShell"="NavStartShellEvent"
"DllName"="C:\\WINNT\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
"Logoff"="SebringUserLogoff"
"Logon"="SebringUserLogon"
"Impersonate"=dword:00000000
"Dllname"="C:\\WINNT\\system32\\LgNotify.dll"
"Asynchronous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

---------------- Xfind Results -----------------

'Xfind' is not recognized as an internal or external command,
operable program or batch file.

-------------- Locate.com Results ---------------

Doenut

01-31-2005, 04:15 PM

Budfred,

I looked at my System 32 file and found the following which may be at fault here:

angelex.exe
exdl0.exe
exdl.exe
exul.exe
exclean.exe

All of these were modified after December 2nd which was when this problem started. I did a Google search for some of these and came up with a software called "Counter Spy" which claims to be able to get rid of these trojans.

Here's the link: http://research.sunbelt-software.com/threat_display.cfm?name=eXact.Downloader

Let me know if you think this may be a viable means of getting rid of the problem.

Thanks!

Budfred

01-31-2005, 09:12 PM

My consultants are saying that Vx2 is probably dead and we just need to clean up the leftovers... I am asking for help to write a Reg file to do that...

I don't know why we can't get a decent log of the Narrator files, but that seems to be the main problem now... You can try CounterSpy if you would like... It may do the job since it is associated with Giant which is what MS is using as the basis for their antispyware... You could also try their beta MS Antispyware and see if that works...

Are you sure you unzipped that FindIt file to a permanent folder??

I will get back to you as soon as I know more...

Doenut

02-01-2005, 12:40 PM

Yes, I even tried it several more times into different folders. Still get the black popup box.

Ran AdAware, still can't get it to go through all the way. Found some dll's that AdAware can't delete...

I'll try the CounterSpy and see if it works.

Doenut

02-01-2005, 12:50 PM

Another thing... I found DMVlite on my Add/Remove Programs list. Got the typical offer to download software to uninsall the program. Needless to say, I didn't download the software since I thought it would make things worse. Any suggestions???

Budfred

02-01-2005, 10:56 PM

Okay, I found another approach to try to finish the cleanup... Please download mwavscan here:

http://www.mwti.net/antivirus/free_utilities.asp

Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Copy and paste it in your next reply.

I have lost track of whether you have KillBox yet... If you don't, please go to the link for HJT and download it, we will need it after we get the log...

And don't download the uninstaller for that piece of garbage... it doesn't work anyway...

Doenut

02-01-2005, 11:23 PM

Hey Bud,

Looks like we're both at the computer. I'm following your instructions as we speak and will be back with you shortly.

Doenut

02-02-2005, 01:58 AM

Whoa Nellie!
Can you say, "Infected?" Curious to know what your next step is. I have Killbox ready when you are...

By the way, I couldn't copy and paste the results from the bottom box and had to copy and paste the following from the log. :eek:

Tue Feb 01 21:24:57 2005 => File C:\WINNT\system32\eoenbb.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:05 2005 => File C:\WINNT\system32\wiwgrr.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:16 2005 => File C:\WINNT\system32\hzhaww.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:30 2005 => File C:\WINNT\zeta.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:31 2005 => File C:\WINNT\autoheal.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:31 2005 => File C:\WINNT\cb8032_SIAC.exe infected by "not-a-virus:AdWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:33 2005 => File C:\WINNT\iconu.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:47 2005 => File C:\WINNT\system32\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:47 2005 => File C:\WINNT\system32\aklsp.dll infected by "TrojanDownloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:47 2005 => File C:\WINNT\system32\akrules.dll infected by "TrojanDownloader.Win32.Agent.bt" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:47 2005 => File C:\WINNT\system32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:51 2005 => File C:\WINNT\system32\calsp.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:59 2005 => File C:\WINNT\system32\cwcqoo.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:25:59 2005 => File C:\WINNT\system32\cycqoo.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:01 2005 => File C:\WINNT\system32\d2kpax.exe infected by "Trojan.Win32.Dialer.bh" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:07 2005 => File C:\WINNT\system32\doolsav.dat infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:14 2005 => File C:\WINNT\system32\exdl.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:14 2005 => File C:\WINNT\system32\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:15 2005 => File C:\WINNT\system32\exul.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:27 2005 => File C:\WINNT\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.

Tue Feb 01 21:26:30 2005 => File C:\WINNT\system32\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:43 2005 => File C:\WINNT\system32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:26:55 2005 => File C:\WINNT\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:27:05 2005 => File C:\WINNT\system32\papkbb.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:14 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.fr2E5C infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:15 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.fr45EA infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:15 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.fr6B39 infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:15 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.fr76FC infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:16 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.fr85F5 infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:16 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.fr9BAD infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:16 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.frA01E infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:16 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.frAABB infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:28:16 2005 => File C:\DOCUME~1\me\LOCALS~1\Temp\temp.frCF0E infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:29:54 2005 => File C:\me\Media\l2mfix.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.

Tue Feb 01 21:39:04 2005 => File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zi p infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:14 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04C40000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:14 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04C40001.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:14 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04C80002.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04C80003.VBN infected by "Exploit.HTML.ObjData" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04CC0000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04CC0001.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04CC0002.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04D00001.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04D40000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04D80000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04DC0000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04DC0001.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04E00001.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04E40000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04E80000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04EC0000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Doenut

02-02-2005, 01:59 AM

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04EC0001.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:15 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04F00000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04F00001.VBN infected by "Exploit.VBS.Phel.a" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05000000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05340000.VBN infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780000.VBN infected by "TrojanDownloader.Win32.Small.yk" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780001.VBN infected by "TrojanDownloader.Win32.Small.yk" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780002.VBN infected by "TrojanDownloader.Win32.Small.yk" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780003.VBN infected by "TrojanDownloader.Win32.Small.yk" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780004.VBN infected by "TrojanDownloader.Win32.Small.yk" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:16 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780005.VBN infected by "TrojanDownloader.Win32.Small.yk" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:17 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780006.VBN infected by "TrojanDownloader.Win32.Agent.di" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:17 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05780007.VBN infected by "TrojanDownloader.Win32.Agent.di" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:17 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CE40000.VBN infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:17 2005 => File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CE40001.VBN infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:39:59 2005 => File C:\Documents and Settings\me\Desktop\hotburnpropatch-w32-x86-251.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Tue Feb 01 21:40:00 2005 => File C:\Documents and Settings\me\Desktop\l2mfix\backup.zip infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:01 2005 => File C:\Documents and Settings\me\Desktop\l2mfix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.

Tue Feb 01 21:40:02 2005 => File C:\Documents and Settings\me\Desktop\l2mfix.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.

Tue Feb 01 21:40:32 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.fr2E5C infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.fr45EA infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.fr6B39 infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.fr76FC infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.fr85F5 infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.fr9BAD infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.frA01E infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.frAABB infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:40:33 2005 => File C:\Documents and Settings\me\Local Settings\Temp\temp.frCF0E infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:41:25 2005 => File C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\P37PSZIT\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:41:26 2005 => File C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\YMLDWJGK\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:41:26 2005 => File C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\YMLDWJGK\AppWrap[4].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.

Tue Feb 01 21:45:55 2005 => File C:\pop.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:14:13 2005 => File C:\sauronsp.chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:14:13 2005 => File C:\sb.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:16:55 2005 => File C:\WINNT\EliteSideBar\EliteSideBar 08.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:16:55 2005 => File C:\WINNT\EliteToolBar\EliteToolBar version 59.dll infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:18:21 2005 => File C:\WINNT\iconu.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:25:47 2005 => File C:\WINNT\system32\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:25:47 2005 => File C:\WINNT\system32\aklsp.dll infected by "TrojanDownloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:25:47 2005 => File C:\WINNT\system32\akrules.dll infected by "TrojanDownloader.Win32.Agent.bt" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:25:48 2005 => File C:\WINNT\system32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:25:51 2005 => File C:\WINNT\system32\calsp.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:26:06 2005 => File C:\WINNT\system32\cwcqoo.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:26:06 2005 => File C:\WINNT\system32\cycqoo.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:26:07 2005 => File C:\WINNT\system32\d2kpax.exe infected by "Trojan.Win32.Dialer.bh" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:27:41 2005 => File C:\WINNT\system32\doolsav.dat infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Doenut

02-02-2005, 01:59 AM

Tue Feb 01 22:36:38 2005 => File C:\WINNT\system32\exdl.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:36:38 2005 => File C:\WINNT\system32\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:36:39 2005 => File C:\WINNT\system32\exul.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:36:49 2005 => File C:\WINNT\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.

Tue Feb 01 22:36:51 2005 => File C:\WINNT\system32\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:37:02 2005 => File C:\WINNT\system32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:37:14 2005 => File C:\WINNT\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:37:34 2005 => File C:\WINNT\system32\papkbb.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:28 2005 => File C:\WINNT\system32\vmss\vmss.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:55 2005 => File C:\WINNT\system32\wsxsvc\wsx.dll infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:55 2005 => File C:\WINNT\system32\wsxsvc\wsx.ocx infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:55 2005 => File C:\WINNT\system32\wsxsvc\wsxsvc.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:57 2005 => File C:\WINNT\Temp\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:57 2005 => File C:\WINNT\Temp\aklsp.dll infected by "TrojanDownloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:57 2005 => File C:\WINNT\Temp\akrules.dll infected by "TrojanDownloader.Win32.Agent.bt" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:38:59 2005 => File C:\WINNT\Temp\f1285278.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:01 2005 => File C:\WINNT\Temp\nsdtmp09.dll infected by "not-a-virus:AdWare.MetaDirect.a" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:02 2005 => File C:\WINNT\Temp\ss_cdt_setup.exe infected by "not-a-virus:AdWare.Sidesearch.e" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:02 2005 => File C:\WINNT\Temp\suicidetb.exe infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:03 2005 => File C:\WINNT\Temp\Temporary Internet Files\Content.IE5\V0O6HOU3\protector_update[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:04 2005 => File C:\WINNT\Temp\Temporary Internet Files\Content.IE5\VV3X50C5\track[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:04 2005 => File C:\WINNT\Temp\Temporary Internet Files\Content.IE5\VV3X50C5\track[2].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:05 2005 => File C:\WINNT\Temp\THI3AA0.tmp\twaintec.cab infected by "not-a-virus:AdWare.BiSpy.m" Virus. Action Taken: No Action Taken.

Tue Feb 01 22:39:05 2005 => File C:\WINNT\Temp\vmstmp\vmstmp.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Budfred

02-02-2005, 11:05 PM

Okay... This is going to be tedious, but I think it will finally kill the crap here... Start by downloading Eraser and then run it in Safe Mode before and after you clean out the other files:

http://www.tolvanen.com/eraser/

Clean out the temp files in general, but particularly these:

C:\WINNT\Temp\Temporary Internet Files\Content.IE5\

Now to use KillBox... Boot to Safe Mode and start killing files... If they don't delete, put them in again and set to delete on reboot... Reboot to Safe Mode once they are all entered... Hopefully most of them will just quietly die... Run the mwavscan again after you clean up and see if any remain... If so, try to kill them again...

C:\WINNT\system32\eoenbb.dll
C:\WINNT\system32\wiwgrr.exe
C:\WINNT\system32\hzhaww.exe
C:\WINNT\zeta.exe
C:\WINNT\autoheal.exe
C:\WINNT\cb8032_SIAC.exe
C:\WINNT\iconu.exe
C:\WINNT\system32\akcore.dll
C:\WINNT\system32\aklsp.dll
C:\WINNT\system32\akrules.dll
C:\WINNT\system32\angelex.exe
C:\WINNT\system32\calsp.dll
C:\WINNT\system32\cwcqoo.dll
C:\WINNT\system32\cycqoo.dll
C:\WINNT\system32\d2kpax.exe
C:\WINNT\system32\doolsav.dat
C:\WINNT\system32\exdl.exe
C:\WINNT\system32\exdl0.exe
C:\WINNT\system32\exul.exe
C:\WINNT\system32\instsrv.exe
C:\WINNT\system32\javexulm.vxd
C:\WINNT\system32\mqexdlm.srg
C:\WINNT\system32\netut80ex.vxd
C:\WINNT\system32\papkbb.dat
C:\Documents and Settings\me\Desktop\hotburnpropatch-w32-x86-251.exe
C:\pop.exe
C:\sauronsp.chm
C:\sb.exe
C:\WINNT\EliteSideBar\EliteSideBar 08.dll
C:\WINNT\EliteToolBar\EliteToolBar version 59.dll
C:\WINNT\system32\mqexdlm.srg
C:\WINNT\system32\vmss\vmss.exe
C:\WINNT\system32\wsxsvc\wsx.dll
C:\WINNT\system32\wsxsvc\wsx.ocx
C:\WINNT\system32\wsxsvc\wsxsvc.exe

I suggest that you also clean out the Quarantined files in Norton and Spybot since they are showing up in this log too... If Eraser doesn't completely clean out those Temp folders, we will have to deal with them as well, but hopefully that won't be necessary... When you finish as much as you feel comfortable doing, post back with a progress report, an HJT log and a mwavscan log... Hopefully they will be clean...

Doenut

02-03-2005, 03:31 PM

Please have a look at the mwavscan log below. The file addresses look differently from the last time I ran it. I was able to "successfully" kill the files you told me to, but it looks like they may not have gone away. I didn't want to proceed until you looked at this log.

Also, is there a better way to post my log? I'm not able to cut and paste from the bottom window in the tool and have to sort through the log manually which takes a lot of time. Any suggestions?

Thu Feb 03 11:33:57 2005 => File C:\!Submit\aklsp.dll infected by "TrojanDownloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:57 2005 => File C:\!Submit\akrules.dll infected by "TrojanDownloader.Win32.Agent.bt" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:57 2005 => File C:\!Submit\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:58 2005 => File C:\!Submit\autoheal.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:58 2005 => File C:\!Submit\calsp.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:58 2005 => File C:\!Submit\cb8032_SIAC.exe infected by "not-a-virus:AdWare.BargainBuddy.j" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:58 2005 => File C:\!Submit\cwcqoo.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:58 2005 => File C:\!Submit\cycqoo.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\d2kpax.exe infected by "Trojan.Win32.Dialer.bh" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\doolsav.dat infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\EliteSideBar 08.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\EliteToolBar version 59.dll infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\eoenbb.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\exdl.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:33:59 2005 => File C:\!Submit\exul.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\hotburnpropatch-w32-x86-251.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\hzhaww.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\iconu.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:03 2005 => File C:\!Submit\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:04 2005 => File C:\!Submit\papkbb.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:04 2005 => File C:\!Submit\pop.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:04 2005 => File C:\!Submit\sauronsp.chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:04 2005 => File C:\!Submit\sb.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:04 2005 => File C:\!Submit\vmss.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:05 2005 => File C:\!Submit\wiwgrr.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:05 2005 => File C:\!Submit\wsx.dll infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:05 2005 => File C:\!Submit\wsx.ocx infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:05 2005 => File C:\!Submit\wsxsvc.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:05 2005 => File C:\!Submit\zeta.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:34:44 2005 => File C:\me\Media\l2mfix.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.

Thu Feb 03 11:43:44 2005 => File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zi p infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:44:35 2005 => File C:\Documents and Settings\me\Desktop\l2mfix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.

Thu Feb 03 11:44:37 2005 => File C:\Documents and Settings\me\Desktop\l2mfix.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.

Thu Feb 03 11:45:48 2005 => File C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\P37PSZIT\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.

Thu Feb 03 11:45:49 2005 => File C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\YMLDWJGK\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
Thu Feb 03 11:45:49 2005 => File C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\YMLDWJGK\AppWrap[4].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:03:09 2005 => File C:\Program Files\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Thu Feb 03 12:14:13 2005 => File C:\Program Files\ORL\VNC\omnithread_rt.dll tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC-based.g. No Action Taken.

Thu Feb 03 12:14:13 2005 => File C:\Program Files\ORL\VNC\VNCHooks.dll tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

Thu Feb 03 12:14:13 2005 => File C:\Program Files\ORL\VNC\vncviewer.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

Thu Feb 03 12:14:13 2005 => File C:\Program Files\ORL\VNC\WinVNC.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

Thu Feb 03 12:18:04 2005 => File C:\unzipped\vnc-3.3.3r9_x86_win32[1]\vnc_x86_win32\vncviewer\vncviewer.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

Thu Feb 03 12:18:05 2005 => File C:\visorxsp.chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:16 2005 => File C:\WINNT\Temp\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:16 2005 => File C:\WINNT\Temp\aklsp.dll infected by "TrojanDownloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:16 2005 => File C:\WINNT\Temp\akrules.dll infected by "TrojanDownloader.Win32.Agent.bt" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:18 2005 => File C:\WINNT\Temp\f1285278.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:20 2005 => File C:\WINNT\Temp\nsdtmp09.dll infected by "not-a-virus:AdWare.MetaDirect.a" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:21 2005 => File C:\WINNT\Temp\ss_cdt_setup.exe infected by "not-a-virus:AdWare.Sidesearch.e" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:21 2005 => File C:\WINNT\Temp\suicidetb.exe infected by "not-a-virus:AdWare.ToolBat.EliteBar.z" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:22 2005 => File C:\WINNT\Temp\THI3AA0.tmp\twaintec.cab infected by "not-a-virus:AdWare.BiSpy.m" Virus. Action Taken: No Action Taken.

Thu Feb 03 12:42:22 2005 => File C:\WINNT\Temp\vmstmp\vmstmp.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.

Doenut

02-03-2005, 03:34 PM

Logfile of HijackThis v1.99.0
Scan saved at 1:31:25 PM, on 2/3/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\me\Media\HijackThis.exe
C:\Program Files\HP\hpcoretech\soln\HPOSM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: huhitt.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

02-03-2005, 03:37 PM

By the way, I just ran the C:\!Submit folder through Eraser. Not sure if that makes a big difference, but its contents were all the viruses I ran through KillBox. Let me know if I messed something up.

Thanks!

Budfred

02-03-2005, 10:03 PM

It looks like we are finally close to killing these monsters...

The C:\!Submit\ items are set up by KillBox to submit the files for analysis if I am not mistaken... It is okay that you killed them...

This one is Spybot's fixed file:

Thu Feb 03 11:43:44 2005 => File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zi p infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.

Really the only ones which need to be fixed are in the temp folders.... Try using Eraser in Safe Mode to kill them and use KillBox on them if they persist... These are the ones:

C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\P37PSZIT\AppWrap[2].exe
C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\YMLDWJGK\AppWrap[2].exe
C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\YMLDWJGK\AppWrap[4].exe
C:\WINNT\Temp\akcore.dll
C:\WINNT\Temp\aklsp.dll
C:\WINNT\Temp\akrules.dll
C:\WINNT\Temp\f1285278.exe
C:\WINNT\Temp\nsdtmp09.dll
C:\WINNT\Temp\ss_cdt_setup.exe
C:\WINNT\Temp\suicidetb.exe
C:\WINNT\Temp\THI3AA0.tmp\twaintec.cab
C:\WINNT\Temp\vmstmp\vmstmp.exe

This one will require KillBox for sure:

C:\visorxsp.chm

This one will need to be fixed in HJT and you will need to find and delete it as well:

O4 - Global Startup: huhitt.exe

It may be here, so try this in KillBox:

C:\Docume~1\ALLUSE~1\STARTM~1\Programs\Startup\huh itt.exe

After you finish this set, reboot and post a fresh HJT and mwavscan log... I am not sure what you are saying about not being able to copy the log... Are you trying to "cut" or are you trying to "copy"... "Copy" is the option to use... Hopefully it will be a pretty short log this time.... :)

Doenut

02-04-2005, 04:40 PM

Budfred,

I'm pretty sure I got rid of everything. I ran mwavscan again and only came up with 11 entries. Only one was labeled "virus" and it was the Spybot Recovery file which I erased. The others were labeled "not a virus," and I don't see them being a problem.

The mwavscan doesn't let you right click on the viruses found, so that's why I couldn't copy and paste (that's why I'm not going to go through the log manually since I don't think there's anything malicious in the log and it's too tedious).

Anyway, please check the following HJT log and let me know if there's anything else that looks suspicious. Many thanks for the hard work you have put into this deal.

Logfile of HijackThis v1.99.0
Scan saved at 10:53:20 AM, on 2/4/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
C:\WINNT\system32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\1XConfig.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Eraser\eraser.exe
C:\WINNT\DvzCommon\DvzMsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINNT\system32\HPZipm12.exe
C:\me\Media\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Application Window.lnk = C:\Program Files\Novell\ZENworks\NALWIN32.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - [url]http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab[/url]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - [url]https://themeetingson.webex.com/client/v_themeetingson/webex/ieatgpc.cab[/url]
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mycompany
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mycompany
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Novell Application Launcher - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Wol SerNT.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\Zen Rem32.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINNT\system32\S24EvMon.exe
O23 - Service: Check Point SecuRemote Service - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Workstation Manager - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

Doenut

02-04-2005, 04:44 PM

One more thing... (there's always one more thing)

I still have DMVlite on my add/remove programs list. Is there a quick way to get rid of it instead of downloading their software?

Budfred

02-04-2005, 10:12 PM

The mwavscan doesn't let you right click on the viruses found, so that's why I couldn't copy and paste (that's why I'm not going to go through the log manually since I don't think there's anything malicious in the log and it's too tedious). Well, assuming you right about what is left there, this looks like a clean computer... If you can highlight the log, it should be possible to use Ctrl-C to copy it and the paste it here... You might want to try that just so I can make sure it is clean...

I still have DMVlite on my add/remove programs list. Is there a quick way to get rid of it instead of downloading their software? It you try to remove it again, it Windows may offer you the choice of getting rid of the item in the list since the actual program is gone... If not, CrapCleaner might do it or there might even be something in Eraser that would... I am afraid I am not well versed in that type of cleanup...

In any case, it looks like it is time for celebration... I am impressed that you stuck with this for so long and glad we found a way to kill those things...

Here is my prevention speech to help avoid something similar happening again... I would lock this one up like Fort Knox if I were you.... :)

This is a good time to set up protection against further attacks. Read the article linked below about "How did I get infected". You need an antivirus that is updated, a good firewall (a router firewall is not enough) and a spyware blocker like SpywareBlaster and also IE-Spyads. All of these have good free versions available... be very cautious about any security software that advertises in popups or other intrusive ways, they are not only usually useless, but also often have malware in them....

http://www.computercops.biz/postlite7736-.html

Also, make sure all critical updates are installed... Let me know if you encounter any more problems with this one...