Constant Pop-ups And Redirecting

Could you click here to download Beta-Fix.exe (2K/XP only!) by freeatlast. Double-click on the Beta-Fix.exe and it will install a folder called Beta-Fix on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Ok, here ya go: Microsoft Windows XP [Version 5.1.2600] The type of the file system is NTFS. C: is not dirty. Thu 06/24/2004 5:32am up 0 days, 6:18 »»»»»»»»»»»»»»»»»»***Attention!***»»»»»»»»»»»»»»»» Files listed in this section (in System32) are not always definitive! Always Double Check and be sure the file pointed doesn't exist! »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\RESHM.DLL +++ File read error \\?\C:\WINDOWS\System32\RESHM.DLL +++ File read error »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» »»»Special 'locked' files scan in 'System32'…….. **File C:\Beta-Fix\LIST.TXT RESHM.DLL Can't Open! ****Filtering files in System32… (-h -s -r…) *** »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» C:\WINDOWS\SYSTEM32\ reshm.dll Wed Jun 23 2004 10:23:32p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K C:\WINDOWS\SYSTEM32\ krhco.dll Mon Jun 7 2004 9:07:34p A.SH. 70,656 69.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 70,656 bytes 69.00 K Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\KRHCO.DLL Sniffed -> C:\WINDOWS\SYSTEM32\RESHM.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group MICHAEL\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»Dir 'junkxxx' was created with the following permissions… (FAT32=NA) Directory "C:\junkxxx" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x MICHAEL\Michael Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: MICHAEL\Michael Primary Group: MICHAEL\None »»»»»»Backups created…»»»»»» 5:34am up 0 days, 6:20 Thu 06/24/2004 A C:\Beta-Fix\winBackup.hiv –a– - - - - - 8,192 06-24-2004 winbackup.hiv A C:\Beta-Fix\keys1\winkey.reg –a– - - - - - 287 06-24-2004 winkey.reg »»Performing 16bit string scan…. ———- WIN.TXT AppInit_DLLsÿÿÿÿÀÿÿÿC REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "AppInit_DLLs"="" Windows UDeviceNotSelectedTimeout zGDIProcessHandleQuota" Spooler2 5swapdisk TransmissionRetryTimeout USERProcessHandleQuotai AppInit **File C:\Beta-Fix\WIN.TXT Ñ_åàÿÿÿvk  €

5swapdisk h
°
ð
 X Ðÿÿÿvk  à


. TransmissionRetryTimeoutÐÿÿÿvk  €' 
, USERProcessHandleQuotai àÿÿÿh
°
ð
 X ˆ Ø Øÿÿÿvk < 

X AppInit_DLLsÿÿÿÿÀÿÿÿC : \ W I N D O W S \ S y s t e m 3 2 \ r e s h m . d l l À 

Open the Beta-Fix folder and then open the keys1 folder. Right-click on the MOVEit.bat file and select 'edit'. That will open the file as empty text file - copy and paste this line into the blank file:

move %WinDir%\System32\RESHM.DLL %SystemDrive%\junkxxx\RESHM.DLL

Save the file and close. The next step will cause a restart. Still in the keys1 folder, double click on FIX.bat. You will get an alert of about 20 seconds before reboot - allow it to reboot.

On restart, open the Beta-Fix folder again and double-click on RESTORE.bat. When it is finished, in Beta-Fix folder, there will be a file called Log1.txt - post it's contents in your next reply.

Thu 06/24/2004 11:35am up 0 days, 0:01 Microsoft Windows XP [Version 5.1.2600] The type of the file system is NTFS. C: is not dirty. *Locked files… * result\\?\C:\junkxxx\RESHM.DLL »»»Filtering files in System32…….( 'R;H;S') »»» »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» No matches found. C:\WINDOWS\SYSTEM32\ krhco.dll Mon Jun 7 2004 9:07:34p A.SH. 70,656 69.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 70,656 bytes 69.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\KRHCO.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» C:\JUNKXXX\ reshm.dll Wed Jun 23 2004 10:23:32p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\JUNKXXX\RESHM.DLL Search text: ÝSTREAMINGDEVICESETUP2Þ ®CASE Insensitive Match Searching ==>C:\JUNKXXX\RESHM.DLL Run Time(sec) 0 **File C:\JUNKXXX\RESHM.DLL 0000DEBE: 67 44 65 76 69 63 65 00 . 00 53 74 72 65 61 6D 69 gDevice. .Streami 0000DED3: 63 65 53 65 74 75 70 00 . 32 00 00 00 00 00 E0 01 ceSetup. 2…..à. move %WinDir%\System32\RESHM.DLL %SystemDrive%\junkxxx\RESHM.DLL -ra– W32i - - - - 57,344 06-23-2004 reshm.dll A R C:\junkxxx\RESHM.DLL File: CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 »»Permissions: C:\junkxxx\RESHM.DLL Everyone:(special access:) SYNCHRONIZE FILE_EXECUTE BUILTIN\Administrators:F Directory "C:\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x MICHAEL\Michael Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: MICHAEL\Michael Primary Group: MICHAEL\None Directory "C:\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 0000000A -c– 00000002 —- —- -w– BUILTIN\Users Allow 00000000 t— 001200A9 —- -S– r–x \Everyone Owner: BUILTIN\Administrators Primary Group: NT AUTHORITY\SYSTEM File "C:\junkxxx\RESHM.DLL" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000000 t— 00100020 —- —- —x \Everyone Allow 00000000 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Owner: MICHAEL\Michael Primary Group: MICHAEL\None »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM ———- WIN.TXT AppInit_DLLsÿÿÿÿÀÿÿÿC ———- NEWWIN.TXT AppInit_DLLsÿÿÿÿ **File C:\Beta-Fix\NEWWIN.TXT **File C:\Beta-Fix\NEWWIN.TXT 000012F0: 01 00 00 00 01 00 76 00 . 5F 44 4C 4C 73 FF FF FF ……v. _DLLsÿÿÿ **File C:\Beta-Fix\NEWWIN.TXT Ñ_åàÿÿÿvk  €

5swapdisk h
°
ð
 X Ðÿÿÿvk  à


. TransmissionRetryTimeoutÐÿÿÿvk  €' 
, USERProcessHandleQuotai àÿÿÿh
°
ð
 X ˆ Ø Øÿÿÿvk  €

v AppInit_DLLsÿÿÿÿ

Well done Nearly there, open the Beta-Fix folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. When done, please delete the entire Beta-Fix folder. Rescan with HJT and post a new log in your next reply.

Create a new folder called C:\HijackThis, move the HijackThis.exe file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hbill.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://hbill.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://hbill.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hbill.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://hbill.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\hbill.dll/sp.html#96676
O2 - BHO: (no name) - {D40655FE-E21F-1542-6249-715743732B2D} - C:\WINDOWS\system32\ntej.dll
O4 - HKLM\..\Run: [appln32.exe] C:\WINDOWS\appln32.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/14f1dcd1d38926…ip/RdxIE601.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50148/QDow_AS2.cab

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\appln32.exe

Reboot when done, rescan with HJT and post a new log here for a final check over.

You have got rid of one infection but have a bunch of new ones. Open Ad-Aware. Before scanning click on "check for updates now" to make sure you have the latest reference file. Then click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and post a new log here.

OK, last bit. If you have rebooted since posting your last log then please rescan, post a new one and await further clarification, otherwise follow these instructions.


The 'Search' function within Windows XP will not automatically show hidden files even if your folder options settings are set to do that. Do this so you can see hidden files and folders - click here to download xphidden.zip. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

Press Ctrl>Alt>Delete to bring up Task Manager. Click the Processes tab and double-click the Image Name column header to alphabetically sort the processes. Scroll through the list and look for the following entries, end the process on each when found:

appln32.exe
sysqo.exe

Next, click Start>Run and type Services.msc, hit OK. Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then change the Startup Type to Disabled. Now hit Apply and then OK and close any open windows.

Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\adihz.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://adihz.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://adihz.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\adihz.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://adihz.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\adihz.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: (no name) - {3F760D6A-3449-7FEF-18EE-9FEA64879371} - C:\WINDOWS\system32\msob.dll
O4 - HKLM\..\Run: [appln32.exe] C:\WINDOWS\appln32.exe

Reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\appln32.exe
C:\WINDOWS\sysqo.exe

Boot back into normal mode. Click here to download cwsuninst.zip. Extract cwsuninst.reg from the zip file and save it to the desktop. When done, double-click the cwsuninst.reg and when asked to merge say yes.

Three files were also deleted from your computer by this malware and need to be replaced.

control.exe - go here and download the version of control.exe for your operating system. If you are running Windows 2000, copy it to c:\winnt\system32\. For Windows XP, copy it to c:\windows\system32\.

Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program.

Spybot S&D - you will also need to replace one file. Go here here and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program.

Run HijackThis again and post a new log in this thread.

No you haven't made anything worse. I have amended my fix in line with your latest log - work through it all again.