Internet Explorer

Great!!!

Now, could you post the contents of this file:

C:\WINDOWS\WININIT.

Into this thread.

Were you able to run either of the online virus scans, and what did they find?

It says C:\WINDOWS\WININIT. cannot be run from within windows

Right click on the file, then "Open with", Choose "notepad". Copy the contents from notepad into this thread.

here is the file it had four sections [Rename] NUL=C:\WINDOWS\HISTORY\HISTORY.IE5\INDEX.DAT NUL=C:\WINDOWS\HISTORY\HISTORY.IE5\MSHIST~2\INDEX.DAT NUL=C:\WINDOWS\HISTORY\HISTORY.IE5\MSHIST~3\INDEX.DAT NUL=C:\WINDOWS\HISTORY\HISTORY.IE5\INDEX.DAT [Rename] C:\WINDOWS\SYSTEM\DDRAW.DLL=C:\WINDOWS\SYSTEM\SET50E3.TMP C:\WINDOWS\SYSTEM\DPMODEMX.DLL=C:\WINDOWS\SYSTEM\SET50F4.TMP C:\WINDOWS\SYSTEM\DPWSOCKX.DLL=C:\WINDOWS\SYSTEM\SET50F5.TMP C:\WINDOWS\SYSTEM\DMUSIC.DLL=C:\WINDOWS\SYSTEM\SET5102.TMP C:\WINDOWS\SYSTEM\DSOUND.DLL=C:\WINDOWS\SYSTEM\SET5110.TMP C:\WINDOWS\SYSTEM\DINPUT.DLL=C:\WINDOWS\SYSTEM\SET5111.TMP NUL=C:\WINDOWS\SYSTEM\D3D8.DLL C:\WINDOWS\SYSTEM\D3D8.DLL=C:\WINDOWS\SYSTEM\SET5122.TMP NUL=C:\WINDOWS\SYSTEM\D3D9.DLL C:\WINDOWS\SYSTEM\D3D9.DLL=C:\WINDOWS\SYSTEM\SET5124.TMP NUL=C:\WINDOWS\SYSTEM\DPNET.DLL C:\WINDOWS\SYSTEM\DPNET.DLL=C:\WINDOWS\SYSTEM\SET5131.TMP C:\WINDOWS\SYSTEM\DPVOICE.DLL=C:\WINDOWS\SYSTEM\SET5133.TMP NUL=C:\WINDOWS\SYSTEM\DIACTFRM.DLL C:\WINDOWS\SYSTEM\DIACTFRM.DLL=C:\WINDOWS\SYSTEM\SET5134.TMP NUL=C:\WINDOWS\SYSTEM\DINPUT8.DLL C:\WINDOWS\SYSTEM\DINPUT8.DLL=C:\WINDOWS\SYSTEM\SET5140.TMP NUL=C:\WINDOWS\SYSTEM\DSDMOPRP.DLL C:\WINDOWS\SYSTEM\DSDMOPRP.DLL=C:\WINDOWS\SYSTEM\SET5142.TMP C:\WINDOWS\SYSTEM\DEVENUM.DLL=C:\WINDOWS\SYSTEM\SET5144.TMP C:\WINDOWS\SYSTEM\MSWEBDVD.DLL=C:\WINDOWS\SYSTEM\SET5150.TMP C:\WINDOWS\SYSTEM\QCAP.DLL=C:\WINDOWS\SYSTEM\SET5151.TMP C:\WINDOWS\SYSTEM\QDV.DLL=C:\WINDOWS\SYSTEM\SET5152.TMP C:\WINDOWS\SYSTEM\QDVD.DLL=C:\WINDOWS\SYSTEM\SET5154.TMP C:\WINDOWS\SYSTEM\QEDIT.DLL=C:\WINDOWS\SYSTEM\SET5155.TMP C:\WINDOWS\SYSTEM\QUARTZ.DLL=C:\WINDOWS\SYSTEM\SET5162.TMP NUL=C:\WINDOWS\SYSTEM\DIRECTX\MIGRATE\MIGRATE.DLL C:\WINDOWS\SYSTEM\DIRECTX\MIGRATE\MIGRATE.DLL=C:\WINDOWS\SYSTEM\DIRECTX\MIGRATE\SET5164.TMP ERROR: DELETE_FILE C:\WINDOWS\TEMP\OLDB361.TMP C:\_RESTORE\TEMP\OLDB361.0 0x3 ERROR: DELETE_FILE C:\WINDOWS\TEMP\OLDB355.TMP C:\_RESTORE\TEMP\OLDB355.0 0x3 ERROR: DELETE_FILE C:\WINDOWS\COOKIES\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\COOKIES\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\HISTORY\HISTORY.IE5\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\HISTORY\HISTORY.IE5\MSHIST~2\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\HISTORY\HISTORY.IE5\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\ADWARE\FSG_4104.EXE C:\_RESTORE\TEMP\FSG_4104.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\MYSETP.EXE C:\_RESTORE\TEMP\MYSETP.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\P2PSETUP.EXE C:\_RESTORE\TEMP\P2PSETUP.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\GUUB041.TMP C:\_RESTORE\TEMP\GUUB041.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\P2PNET~6.EXE C:\_RESTORE\TEMP\P2PNET~6.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\ADWARE\FSG_41~1.EXE C:\_RESTORE\TEMP\FSG_41~1.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\MYSETP.EXE C:\_RESTORE\TEMP\MYSETP.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\P2PSETUP.EXE C:\_RESTORE\TEMP\P2PSETUP.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP4.HTM C:\_RESTORE\TEMP\DRMTEMP4.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP3.HTM C:\_RESTORE\TEMP\DRMTEMP3.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP2.HTM C:\_RESTORE\TEMP\DRMTEMP2.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP1.HTM C:\_RESTORE\TEMP\DRMTEMP1.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP6.HTM C:\_RESTORE\TEMP\DRMTEMP6.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\GUU4075.TMP C:\_RESTORE\TEMP\GUU4075.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\ADWARE\FSG_4104.EXE C:\_RESTORE\TEMP\FSG_4104.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\MYSETP.EXE C:\_RESTORE\TEMP\MYSETP.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\ADWARE\FSG_4104A.EXE C:\_RESTORE\TEMP\FSG_4104A.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\P2PNET~7.EXE C:\_RESTORE\TEMP\P2PNET~7.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\SYSTEM\P2PNET~1\MARSHAL.DLL C:\_RESTORE\TEMP\MARSHAL.1 0x22 ERROR: DELETE_FILE C:\WINDOWS\SYSTEM\P2PNET~1\MARSHAL.DLL C:\_RESTORE\TEMP\MARSHAL.1 0x22 ERROR: DELETE_FILE C:\WINDOWS\TEMP\P2PNET~8.EXE C:\_RESTORE\TEMP\P2PNET~8.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\SYSTEM\P2PNET~1\MARSHAL2.DLL C:\_RESTORE\TEMP\MARSHAL2.0 0x22 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP8.HTM C:\_RESTORE\TEMP\DRMTEMP8.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP7.HTM C:\_RESTORE\TEMP\DRMTEMP7.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~15.HTM C:\_RESTORE\TEMP\DRMTE~15.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~14.HTM C:\_RESTORE\TEMP\DRMTE~14.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~13.HTM C:\_RESTORE\TEMP\DRMTE~13.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~12.HTM C:\_RESTORE\TEMP\DRMTE~12.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~11.HTM C:\_RESTORE\TEMP\DRMTE~11.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~10.HTM C:\_RESTORE\TEMP\DRMTE~10.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~9.HTM C:\_RESTORE\TEMP\DRMTEM~9.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~8.HTM C:\_RESTORE\TEMP\DRMTEM~8.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~7.HTM C:\_RESTORE\TEMP\DRMTEM~7.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~6.HTM C:\_RESTORE\TEMP\DRMTEM~6.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~5.HTM C:\_RESTORE\TEMP\DRMTEM~5.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~4.HTM C:\_RESTORE\TEMP\DRMTEM~4.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~3.HTM C:\_RESTORE\TEMP\DRMTEM~3.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~2.HTM C:\_RESTORE\TEMP\DRMTEM~2.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~15.HTM C:\_RESTORE\TEMP\DRMTE~15.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~14.HTM C:\_RESTORE\TEMP\DRMTE~14.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~13.HTM C:\_RESTORE\TEMP\DRMTE~13.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~12.HTM C:\_RESTORE\TEMP\DRMTE~12.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~11.HTM C:\_RESTORE\TEMP\DRMTE~11.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~10.HTM C:\_RESTORE\TEMP\DRMTE~10.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~9.HTM C:\_RESTORE\TEMP\DRMTEM~9.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~8.HTM C:\_RESTORE\TEMP\DRMTEM~8.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~7.HTM C:\_RESTORE\TEMP\DRMTEM~7.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~6.HTM C:\_RESTORE\TEMP\DRMTEM~6.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~5.HTM C:\_RESTORE\TEMP\DRMTEM~5.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~4.HTM C:\_RESTORE\TEMP\DRMTEM~4.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~3.HTM C:\_RESTORE\TEMP\DRMTEM~3.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~2.HTM C:\_RESTORE\TEMP\DRMTEM~2.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEM~1.HTM C:\_RESTORE\TEMP\DRMTEM~1.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTEMP9.HTM C:\_RESTORE\TEMP\DRMTEMP9.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\DRMTE~16.HTM C:\_RESTORE\TEMP\DRMTE~16.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\ADWARE\FSG_4104.EXE C:\_RESTORE\TEMP\FSG_4104.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMP\MYSETP.EXE C:\_RESTORE\TEMP\MYSETP.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\SYSTEM\P2PNET~1\MARSHAL.DLL C:\_RESTORE\TEMP\MARSHAL.1 0x22 ERROR: DELETE_FILE C:\WINDOWS\SYSTEM\P2PNET~1\MARSHAL2.DLL C:\_RESTORE\TEMP\MARSHAL2.0 0x22 ERROR: DELETE_FILE C:\WINDOWS\TEMP\GUU7211.TMP C:\_RESTORE\TEMP\GUU7211.0 0x20 ERROR: DELETE_FILE C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL C:\_RESTORE\TEMP\PERFEC~1.0 0x20 ERROR: RENAME_FILE C:\PROGRA~1\PERFEC~1 C:\WINDOWS\TEMP\PERFEC~1 0x0 ERROR: DELETE_FILE C:\WINDOWS\TEMP\P2PNET~9.EXE C:\_RESTORE\TEMP\P2PNET~9.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\SYSTEM\P2PNET~1\MARSHAL3.DLL C:\_RESTORE\TEMP\MARSHAL3.0 0x22 ERROR: DELETE_FILE C:\PROGRA~1\GRISOFT\AVG6\VERSION.AVG C:\_RESTORE\TEMP\VERSION.0 0x20 ERROR: DELETE_FILE C:\PROGRA~1\GRISOFT\AVG6\AVGCORE.VXD C:\_RESTORE\TEMP\AVGCORE.0 0x0 ERROR: DELETE_FILE C:\PROGRA~1\GRISOFT\AVG6\AVG.OVL C:\_RESTORE\TEMP\AVG.0 0x0 ERROR: DELETE_FILE C:\PROGRA~1\GRISOFT\AVG6\MINIAVI.AVG C:\_RESTORE\TEMP\MINIAVI.0 0x0 ERROR: DELETE_FILE C:\PROGRA~1\GRISOFT\AVG6\MICROAVI.AVG C:\_RESTORE\TEMP\MICROAVI.0 0x0 ERROR: DELETE_FILE C:\WINDOWS\COOKIES\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\COOKIES\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: DELETE_FILE C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20 ERROR: RENAME_FILE C:\PROGRA~1\PERFEC~1 C:\WINDOWS\TEMP\PERFEC~1 0x DELETE_FILE C:\WINDOWS\HISTORY\HISTORY.IE5\INDEX.DAT C:\_RESTORE\TEMP\INDEX.0 0x20

Oh and also was not able to run either of the virus scans. they said unable to display page Thanks for all your doing

Pull up the task manager, and end these tasks if they are running:

D3BO.EXE
ATLLX32.EXE
IEQR.EXE
CRBP.EXE

Click Start Menu
Select Run menu
Type "command"

A DOS window appears on the screen.

In that DOS window, type these commands:

regsvr32 /u CRBP.DLL
del C:\WINDOWS\CRBP.DLL
del C:\WINDOWS\D3BO.EXE
del C:\WINDOWS\SYSTEM\ATLLX32.EXE
del C:\WINDOWS\IEQR.EXE
del C:\WINDOWS\CRBP.EXE
exit

Then navigate to your "C:\WINDOWS\TEMP\" folder.

Delete all the ".exe" files created on or after 06/20/2004 in the C:\WINDOWS\TEMP folder.

Reboot.

Try IE.

If IE still get's an error, please do this:

1. Write the error down, and post it next time.
2. Boot in "safe" mode and try IE.

Reboot and post a new log file.

Each time i type in the commands in the dos window i get the message bad command or file name.

My bad!!!

The folder where the exe is isn't in your path.

The commands should be this:

c:\windows\system\regsvr32 /u CRBP.DLL
del C:\WINDOWS\CRBP.DLL
del C:\WINDOWS\D3BO.EXE
del C:\WINDOWS\SYSTEM\ATLLX32.EXE
del C:\WINDOWS\IEQR.EXE
del C:\WINDOWS\CRBP.EXE
exit

Could you try something for me. Click here to download TheKillbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\WINDOWS\CRBP.EXE

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The C:\WINDOWS\CRBP.EXE listing should show up in the window. Then repeat the process, this time adding:

C:\WINDOWS\CRBP.DLL

If that's successful you should have the two files listed. Then repeat so that all these files appear in the list as well:

C:\WINDOWS\D3BO.EXE
C:\WINDOWS\SYSTEM\ATLLX32.EXE
C:\WINDOWS\IEQR.EXE
C:\WINDOWS\SYSTEM\IPIC.EXE
C:\WINDOWS\MSFZ.EXE
C:\WINDOWS\SYSTEM\WINJK.EXE
C:\WINDOWS\APPKN.EXE
C:\WINDOWS\SYSTEM\ADDEA32.EXE
C:\WINDOWS\SYSTEM\WINUP32.EXE
C:\WINDOWS\JAVALD.EXE
C:\WINDOWS\SDKMT32.EXE
C:\WINDOWS\SYSTEM\APIGM32.EXE
C:\WINDOWS\SYSTEM\D3PB.EXE
C:\WINDOWS\D3ZF32.EXE

When they are all there, in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {58C94033-D071-41C6-1E7C-1D1E8C934FA8} - C:\WINDOWS\CRBP.DLL
O4 - HKLM\..\Run: [CRBP.EXE] C:\WINDOWS\CRBP.EXE
O4 - HKLM\..\RunServices: [D3BO.EXE] C:\WINDOWS\D3BO.EXE
O4 - HKLM\..\RunServices: [ATLLX32.EXE] C:\WINDOWS\SYSTEM\ATLLX32.EXE
O4 - HKLM\..\RunServices: [IEQR.EXE] C:\WINDOWS\IEQR.EXE
O4 - HKLM\..\RunServices: [IPIC.EXE] C:\WINDOWS\SYSTEM\IPIC.EXE
O4 - HKLM\..\RunServices: [MSFZ.EXE] C:\WINDOWS\MSFZ.EXE
O4 - HKLM\..\RunServices: [WINJK.EXE] C:\WINDOWS\SYSTEM\WINJK.EXE
O4 - HKLM\..\RunServices: [APPKN.EXE] C:\WINDOWS\APPKN.EXE
O4 - HKLM\..\RunServices: [ADDEA32.EXE] C:\WINDOWS\SYSTEM\ADDEA32.EXE
O4 - HKLM\..\RunServices: [WINUP32.EXE] C:\WINDOWS\SYSTEM\WINUP32.EXE
O4 - HKLM\..\RunServices: [JAVALD.EXE] C:\WINDOWS\JAVALD.EXE
O4 - HKLM\..\RunServices: [SDKMT32.EXE] C:\WINDOWS\SDKMT32.EXE
O4 - HKLM\..\RunServices: [APIGM32.EXE] C:\WINDOWS\SYSTEM\APIGM32.EXE
O4 - HKLM\..\RunServices: [D3PB.EXE] C:\WINDOWS\SYSTEM\D3PB.EXE
O4 - HKLM\..\RunServices: [D3ZF32.EXE] C:\WINDOWS\D3ZF32.EXE
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab

Reboot when done. Rescan with HJT and post a new log.

IE not working is not the main problem here. You have an aggressive viral infection that morphs when we try to remove it.

Could you go here and run an online scan, allow it to delete whatever it finds:

TrendMicro HouseCall

Reboot when done. Rescan with HJT and post a new log here.

tcooley, What version of Netscape are you using? I have versions 4.5, 6.2, and 7.1 on my machine. If I have the same version of Netscape you do, and I can get one of the online virus scans to work on my machine, then maybe I can help you get it to run.