Help! About Blank Hijack

Could you click here to download Beta-Fix.exe (2K/XP only!) by freeatlast. Double-click on the Beta-Fix.exe and it will install a folder called Beta-Fix on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Hai hai, I can't download the file, only the files below beta-fix. I don't now why. What do you suggest me to do now? Ps. A: i'm a woman and blond! b: I'm not a technical wizzkid, just somebody who knows a little bit about computers when it's not super technical. Thanks

That's strange - I just downloaded it again Have another go - let me know if you have further problems.

Microsoft Windows XP [versie 5.1.2600] Het type bestandssysteem is NTFS. C: bevat geen fouten. wo 23-06-2004 1:14pm up 0 days, 1:06 »»»»»»»»»»»»»»»»»»***Attention!***»»»»»»»»»»»»»»»» Files listed in this section (in System32) are not always definitive! Always Double Check and be sure the file pointed doesn't exist! »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\KBD.DLL +++ File read error \\?\C:\WINDOWS\System32\KBD.DLL +++ File read error »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» »»»Special 'locked' files scan in 'System32'…….. **File C:\Beta-Fix\LIST.TXT KBD.DLL Can't Open! ****Filtering files in System32… (-h -s -r…) *** »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» C:\WINDOWS\SYSTEM32\ kbd.dll Mon 21 Jun 2004 18:38:40 A…R 57.344 56,00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57.344 bytes 56,00 K No matches found. »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\KBD.DLL »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read INGEBOUWD\Gebruikers (ID-IO) ALLOW Read INGEBOUWD\Gebruikers (ID-NI) ALLOW Full access INGEBOUWD\Administrators (ID-IO) ALLOW Full access INGEBOUWD\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access MAKER EIGENAAR Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read INGEBOUWD\Gebruikers Full access INGEBOUWD\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group SN033330020074\Geen. User is a member of group \Iedereen. User is a member of group INGEBOUWD\Administrators. User is a member of group INGEBOUWD\Gebruikers. User is a member of group \LOKAAL. User is a member of group NT AUTHORITY\INTERACTIEF. User is a member of group NT AUTHORITY\Geverifieerde gebruikers. »»Dir 'junkxxx' was created with the following permissions… (FAT32=NA) Directory "C:\junkxxx" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x INGEBOUWD\Administrators Allow 0000001B -co- 10000000 —A —- —- INGEBOUWD\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x SN033330020074\Coby Franken Allow 0000001B -co- 10000000 —A —- —- \MAKER EIGENAAR Allow 00000010 t— 001200A9 —- -S– r–x INGEBOUWD\Gebruikers Allow 0000001B -co- A0000000 R-X- —- —- INGEBOUWD\Gebruikers Allow 00000012 tc– 00000004 —- —- –+- INGEBOUWD\Gebruikers Allow 00000012 tc– 00000002 —- —- -w– INGEBOUWD\Gebruikers Owner: SN033330020074\Coby Franken Primary Group: SN033330020074\Geen »»»»»»Backups created…»»»»»» 1:15pm up 0 days, 1:07 wo 23-06-2004 A C:\Beta-Fix\winBackup.hiv –a– - - - - - 8,192 06-23-2004 winbackup.hiv A C:\Beta-Fix\keys1\winkey.reg –a– - - - - - 287 06-23-2004 winkey.reg »»Performing 16bit string scan…. ———- WIN.TXT fùAppInit_DLLs֍æGÀÿÿÿC REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 Windows AppInit UDeviceNotSelectedTimeout zGDIProcessHandleQuota" Spooler2 swapdisk TransmissionRetryTimeout o"USERProcessHandleQuotae/ **File C:\Beta-Fix\WIN.TXT regf




Pugf 

There are some Dutch words in the log, do i need to translate it for you? Regards Polleke

No - that's OK thanks. I have got what I need.

Open the Beta-Fix folder and then open the keys1 folder. Right-click on the "MOVEit.bat" file, select–> edit. Copy and paste this line into the blank file:

move %WinDir%\System32\KBD.DLL %SystemDrive%\junkxxx\KBD.DLL

Save the file and close. The next step will cause a restart. Still in the keys1 folder, double click on FIX.bat. You will get an alert of ~20 secs before reboot - allow it to reboot.

On restart, open the Beta-Fix folder again and double-click on RESTORE.bat. When it is finished, in Beta-Fix folder, there will be a file called Log1.txt - post it's contents in your next reply.

Uhhh, sorry. i understand perfectly what you're saying but where exactly can i find the "batch file"where you are referring to below?
I can't find a file with that name.

This is what i see in my explorer:

beta-fix:
files2
keys1
!LOG
an
fgrep
findit
locate
log
reg
restore
snif
win
winbackup.hiv
xfind
xray

files2:
dureg
filever
fssv
ifmember
last
regDACL
rehash
services
ServiWin
Submit file
un
uptime
win
zip
ZIPZAP

keys1:
FIX
MOVEit <– this one
NirComline
winclean
windowsr1
winkey

Open the Beta-Fix folder and then open the keys1 folder. Right-click on the "MOVEit.bat" file, select–> edit. Copy and paste this line into the blank file:

move %WinDir%\System32\KBD.DLL %SystemDrive%\junkxxx\KBD.DLL

Highlighted it for you - corrected my typo.

He he, i finally got it! wo 23-06-2004 2:12pm up 0 days, 0:02 Microsoft Windows XP [versie 5.1.2600] Het type bestandssysteem is NTFS. C: bevat geen fouten. *Locked files… * result\\?\C:\junkxxx\KBD.DLL »»»Filtering files in System32…….( 'R;H;S') »»» »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» C:\JUNKXXX\ kbd.dll Mon 21 Jun 2004 18:38:40 A…R 57.344 56,00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57.344 bytes 56,00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\JUNKXXX\KBD.DLL Search text: ÝSTREAMINGDEVICESETUP2Þ ®CASE Insensitive Match Searching ==>C:\JUNKXXX\KBD.DLL Run Time(sec) 0 **File C:\JUNKXXX\KBD.DLL 0000DEBE: 67 44 65 76 69 63 65 00 . 00 53 74 72 65 61 6D 69 gDevice. .Streami 0000DED3: 63 65 53 65 74 75 70 00 . 32 00 00 00 00 00 E0 01 ceSetup. 2…..à. move %WinDir%\System32\KBD.DLL %SystemDrive%\junkxxx\KBD.DLL -ra– W32i - - - - 57,344 06-21-2004 kbd.dll A R C:\junkxxx\KBD.DLL File: CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 »»Permissions: C:\junkxxx\KBD.DLL Iedereen:(speciale toegang:) SYNCHRONIZE FILE_EXECUTE INGEBOUWD\Administrators:F Directory "C:\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x INGEBOUWD\Administrators Allow 0000001B -co- 101F01FF —A DSPO rw+x INGEBOUWD\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x SN033330020074\Coby Franken Allow 0000001B -co- 10000000 —A —- —- \MAKER EIGENAAR Allow 00000010 t— 001200A9 —- -S– r–x INGEBOUWD\Gebruikers Allow 0000001B -co- A0000000 R-X- —- —- INGEBOUWD\Gebruikers Allow 00000012 tc– 00000004 —- —- –+- INGEBOUWD\Gebruikers Allow 00000012 tc– 00000002 —- —- -w– INGEBOUWD\Gebruikers Owner: SN033330020074\Coby Franken Primary Group: SN033330020074\Geen Directory "C:\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000000 t— 001F01FF —- DSPO rw+x INGEBOUWD\Administrators Allow 0000000B -co- 10000000 —A —- —- INGEBOUWD\Administrators Allow 00000000 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- \MAKER EIGENAAR Allow 00000000 t— 001200A9 —- -S– r–x INGEBOUWD\Gebruikers Allow 0000000B -co- A0000000 R-X- —- —- INGEBOUWD\Gebruikers Allow 00000002 tc– 00000004 —- —- –+- INGEBOUWD\Gebruikers Allow 0000000A -c– 00000002 —- —- -w– INGEBOUWD\Gebruikers Allow 00000000 t— 001200A9 —- -S– r–x \Iedereen Owner: INGEBOUWD\Administrators Primary Group: INGEBOUWD\Administrators File "C:\junkxxx\KBD.DLL" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000000 t— 00100020 —- —- —x \Iedereen Allow 00000000 t— 001F01FF —- DSPO rw+x INGEBOUWD\Administrators Owner: SN033330020074\Coby Franken Primary Group: SN033330020074\Geen »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read INGEBOUWD\Gebruikers (ID-IO) ALLOW Read INGEBOUWD\Gebruikers (ID-NI) ALLOW Full access INGEBOUWD\Administrators (ID-IO) ALLOW Full access INGEBOUWD\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access MAKER EIGENAAR Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read INGEBOUWD\Gebruikers Full access INGEBOUWD\Administrators Full access NT AUTHORITY\SYSTEM ———- WIN.TXT fùAppInit_DLLs֍æGÀÿÿÿC ———- NEWWIN.TXT AppInit_DLLsÿÿÿÿ **File C:\Beta-Fix\NEWWIN.TXT **File C:\Beta-Fix\NEWWIN.TXT 000012F0: 01 00 00 00 01 00 76 00 . 5F 44 4C 4C 73 FF FF FF ……v. _DLLsÿÿÿ **File C:\Beta-Fix\NEWWIN.TXT regf




Pugf

Well done

OK, last steps, open the Beta-Fix again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses. Please be sure to include a link to this thread in the body of your email.

When done, please delete the entire Beta-Fix folder. Rescan with HJT and post a new log in your next reply.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COBYFR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\COBYFR~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\COBYFR~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COBYFR~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\COBYFR~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\COBYFR~1\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {A4B33F56-5336-4E76-B5E5-27F136128C5C} - C:\WINDOWS\System32\agk.dll (file missing)
O4 - HKLM\..\Run: [ytrvaibwe] C:\WINDOWS\System32\qjhmaxyw.exe
O4 - HKLM\..\Run: [amszljilfn] C:\WINDOWS\System32\qjhmaxyw.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\System32\qjhmaxyw.exe

Reboot when done, rescan with HJT and post a new log here for a final check over.

When i press F8 after reboot it says BOOT MENU Floppy Harddisk HL-DT-STDVDrom GDR8 Realtek boot agent This is nor correct. What did i do wrong? Regards, Polleke

Safe Mode is an approach I use as default - not always necessary. Reboot as normal and see if you can delete that file.