Please Help

Open the FindnFix folder and then open the keys1 folder. Right-click on the MOVEit.bat file and select 'edit'. That will open the file as an empty text file - copy and paste these 2 lines into the blank file:

move %WinDir%\System32\HLPGDG.DLL %SystemDrive%\junkxxx\HLPGDG.DLL
move %WinDir%\System32\RESJL.DLL %SystemDrive%\junkxxx\RESJL.DLL

Save the file and close. The next step will cause a restart. Still in the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot.

On restart, open the FindnFix folder again and double-click on RESTORE.bat. When it is finished, in FindnFix folder, there will be a file called Log1.txt - post it's contents in your next reply.

I get 2 error messages when I try to do this. One says "Windows cannot find 'C:\FINDnFIX\Keys1\MOVEit.bat'. Make sure you typed the name correctly, and then try again." The second one says: "An error prevents this program from continuing: Couls not read SFX info. It's likely corrupt."

Should I try to do a recover on my computer? By the way, when I opened the file (new file) that contains the FIXnFIND folder, there were 3 songs that were put in there than no one in my house downloaded. Don Henley, Michelle Santana, and a Phil Collins song. I deleted them & emptied my recycle bin.

move %WinDir%\System32\HLPGDG.DLL %SystemDrive%\junkxxx\HLPGDG.DLL
move %WinDir%\System32\RESJL.DLL %SystemDrive%\junkxxx\RESJL.DLL

<_<


We should only be moving one file, fortunately your version of XP is crippled and was unable to make the change

HLPGDG.DLL is the likely culprit here. Let's make sure. Click here to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and have a look at the information in the 'Value' field.

If it is C:\WINDOWS\System32\HLPGDG.DLL Then skip the step of editing MOVEit.bat and do this instead.

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the HLPGDG.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log1.txt - post it's contents in your next reply.

In the value field, it says C:\WINDOWS\System32\resjl.dll not the other one. should I still go on to the next step?

Oh well - 50-50 I guess

This is what you should do. In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the RESJL.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log1.txt - post it's contents in your next reply.

OK, here goes: »»»»»»»»»»»»»»»»»»*** freeatlast.100free.com ***»»»»»»»»»»»»»»»» Sun 06/27/2004 8:10pm up 0 days, 0:06 Microsoft Windows XP [Version 5.1.2600] The type of the file system is NTFS. C: is not dirty. *Locked files… \\?\C:\WINDOWS\System32\HLPGDG.DLL +++ File read error * result\\?\C:\junkxxx\RESJL.DLL »»»Filtering files in System32…….( 'R;H;S') »»» »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» C:\WINDOWS\SYSTEM32\ hlpgdg.dll Mon May 24 2004 1:20:12p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLPGDG.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» C:\JUNKXXX\ resjl.dll Mon Jun 21 2004 5:11:20p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\JUNKXXX\RESJL.DLL Search text: ÝSTREAMINGDEVICESETUP2Þ ®CASE Insensitive Match Searching ==>C:\JUNKXXX\RESJL.DLL Run Time(sec) 0 **File C:\JUNKXXX\RESJL.DLL 0000DEBE: 67 44 65 76 69 63 65 00 . 00 53 74 72 65 61 6D 69 gDevice. .Streami 0000DED3: 63 65 53 65 74 75 70 00 . 32 00 00 00 00 00 E0 01 ceSetup. 2…..à. rem replace this text with your given command… -ra– W32i - - - - 57,344 06-21-2004 resjl.dll A R C:\junkxxx\resjl.dll File: CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 »»Permissions: C:\junkxxx\resjl.dll BUILTIN\Administrators:F NT AUTHORITY\SYSTEM:F ANTHONY-MINDY\Owner:F BUILTIN\Users:R Directory "C:\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x ANTHONY-MINDY\Owner Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: ANTHONY-MINDY\Owner Primary Group: ANTHONY-MINDY\None Directory "C:\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 0000000A -c– 00000002 —- —- -w– BUILTIN\Users Allow 00000000 t— 001200A9 —- -S– r–x \Everyone Owner: BUILTIN\Administrators Primary Group: NT AUTHORITY\SYSTEM File "C:\junkxxx\resjl.dll" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x ANTHONY-MINDY\Owner Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Owner: ANTHONY-MINDY\Owner Primary Group: ANTHONY-MINDY\None »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM ———- WIN.TXT fùAppInit_DLLs֍æGÀÿÿÿC ———- NEWWIN.TXT fùAppInit_DLLs֍æG **File C:\FINDnFIX\NEWWIN.TXT **File C:\FINDnFIX\NEWWIN.TXT 000012F0: 01 00 00 00 01 00 66 F9 . 5F 44 4C 4C 73 D6 8D E6 ……fù _DLLs֍æ **File C:\FINDnFIX\NEWWIN.TXT Ñ_åàÿÿÿvk

Good Nearly there, open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Rescan with HJT and post a new log in your next reply.

I got the message returned to me, that I sent to those 2 e-mail addresses. Here's a copy of the returned e-mail:

Message from yahoo.com.
Unable to deliver message to the following address(es).

<[removed]>:
[removed] does not like recipient.
Remote host said: 552 Recipient Rejected: Sorry, the mailbox for
[removed] is full, please try resending mail later
Giving up on [removed].

<[removed]>:
[removed] does not like recipient.
Remote host said: 501 This system is not configured to relay mail from
<[removed]> to <[removed]> for [removed]
Giving up on [removed].

— Original message follows.

Return-Path: <[removed]>

The original message is over 5k. Message truncated to 1K.

Received: from unknown (HELO AnthonyMindy)
([removed]@[removed] with login)
by smtp811.mail.sc5.yahoo.com with SMTP; 28 Jun 2004 15:22:15 -0000
Message-ID: <000901c45d23$ac86a400$d89e4944@AnthonyMindy>
From: "Mindy & Anthony" <[removed]>
To: <[removed]>,
<[removed]>
Subject: Drag 'junkxxx.zip' to Submit here!
Date: Mon, 28 Jun 2004 10:21:58 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="—-=_NextPart_000_0005_01C45CF9.BEBEBD80"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409

This is a multi-part message in MIME format.

——=_NextPart_000_0005_01C45CF9.BEBEBD80
Content-Type: multipart/alternative;
boundary="—-=_NextPart_001_0006_01C45CF9.BEBEBD80"


——=_NextPart_001_0006_01C45CF9.BEBEBD80
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

http://forums.tomcoyote.org/index.php?show…3D11021&st=3D15
——=_NextPart_001_0006_01C45CF9.BEBEBD80
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding
*** MESSAGE TRUNCATED ***

Don't worry about the email.

With only HJT running, have it fix:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {3C4F0D2F-73D5-41E0-96CA-36504D1F4716} - C:\WINDOWS\System32\fkoaj.dll (file missing)

Reboot when done, rerun both AAW and CWShredder.

That will have killed off the hijacker, let's double-check that nothing else is lurking.

Go here and run online scans (all), allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan

Reboot when done.

Click here to download the VX2Finder.exe tool. Click on the VX2Finder.exe and then click on the Click to Find VX2.Betterinternet button. It will display the files, the Guardian Key and User Agent string. Now click the Make Log button. It will open the log in notepad. Copy and paste that log here and wait for further instructions.

Let me know how you get on.

etrust antivirus scan won't work. The other 2 worked though. Should I go ahead and reboot & download the VX2.Betterinternet?

Yeah, if they are not working then skip them.

Ad Aware found & deleted 2, CWShredder got rid of 1, House call found & deleted 80 files, and Panda Active Scan found & disinfected 7 files. When I run VX2Finder, the screen says: Files Found— Guardian Key— is called: User Agent String— When I push make log, nothing happens.

Good. Post a final log. How is it running now?