What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Programs won't launch correctly. Also getting IE redirects

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi Folks,

I need some help with my desktop computer running XP Media Edition. I got this computer from a friend who upgraded and didn't want to deal with trying to fix this old desktop. I did my usual/go-to stuff: ran an MBAM scan and fix and also ran CCleaner and its registry scan. Both programs fixed a bunch of stuff but there is one threat that MBAM apparently can't get rid of.

When I run the full MBAM scan, I only get one error:
Registry Data Items Infected:
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (C:\Program Files\conhost.exe "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.

But even though I quarantine it and then delete it, the next time I run a scan, I get the same 1 error found! CCleaner's registry tool is doing something similar.

After scanning the registry, Ccleaner reports:
Problem: Open With Apllication Issue
Location: C:\Program Files\conhost.exe "%1"%*
Registry Key: HKCR\exefile\shell\open

But again, after I "fix" it and rescan, I get the same exact error.


As far as actual symptoms that the computer is showing, I can only think of two off the top of my head. For one, when try to launch a program that should be executable (such as MBAM, ccleaner, HJT, etc.) it asks me to choose a program to run the file with, and then I have to browse and manually select the .exe file that I just double clicked in the first place. It's like when you try to open a music or image file that is in a format that you've not used before, only these are actual programs that I'm trying to run. Also, I am getting the dreaded random redirects in Internet Explorer. I had that particular problem with a laptop before, and after several days of trying to track down the rootkit problem, me and my professional helper both decided that it was best to just reformat the drive and start over with a fresh installation. But that isn't an option with this computer, so hopefully the redirect thing won't be such a pain this time around!


Directly below, I've pasted a HJT log, and directly below that, I've pasted the complete MBAM log. THANKS in advanced!


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:48:49 PM, on 8/18/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
O1 - Hosts: ::1 localhost
O1 - Hosts: 209.44.111.57 spydetect.microsoft.com
O1 - Hosts: 209.44.111.57 antivirwin2009.com
O1 - Hosts: 209.44.111.57 www.antivirwin2009.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe nogui
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] "C:\Program Files\Verizon\McciTrayApp.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Personal Coach.lnk = ?
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O4 - Global Startup: ZyXEL G-220 v2 Wireless Adapter Utility.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\HP_Administrator\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…20Installer.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://ak.g.gametap.com/static/cab_headles…pWebUpdater.cab
O18 - Filter hijack: text/html - {d1012a18-ecc0-47f3-ba95-23414bdb2da6} - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

–
End of file - 13413 bytes



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4442

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/17/2010 8:26:50 PM
mbam-log-2010-08-17 (20-26-50).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 283340
Time elapsed: 2 hour(s), 37 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (C:\Program Files\conhost.exe "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #2
Hello there, seanakaforty

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait. :)
Post #3
Hi,

Make sure these settings are correct.

Open Internet Explorer
  • at the top click Tools
  • Click Internet Options
  • Click Connections tab
  • Click Lan Settings button
  • Make sure the box beside "Use a proxy sever for your Lan" is UNchecked
  • OK your way out.
===================================================

Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)

===================================================

Please re-open HijackThis and click on Do a system scan only. Check the boxes next to all the entries listed below.(If exist)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
O1 - Hosts: 209.44.111.57 spydetect.microsoft.com
O1 - Hosts: 209.44.111.57 antivirwin2009.com
O1 - Hosts: 209.44.111.57 www.antivirwin2009.com
O18 - Filter hijack: text/html - {d1012a18-ecc0-47f3-ba95-23414bdb2da6} - (no file)


Note : Do not worry if you are unable to find any of these entries, continue with the ones that you discovered. Now close all windows other than HijackThis, then click Fix checked. Close HijackThis.

===================================================

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in
    netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
===================================================

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

On your next reply please post :
exeHelper log
OTL log
GMER log

Good Day!
Post #4
Conspire: I'm having trouble with the GMER scan. I start the scan, and then when I come back later (it's been taking at least a few hours to complete… is that normal?) GMER is not open anymore. I don't know whether it is freezing/closing in the middle of the scan or just automatically closing when the scan is finished, but it is nowhere to be found when I come back to the computer. I have done everything else that you suggested though. The various logs are attached to this post

Attachments:

Post #5
Hi,

Go to My Computer-> Tools-> Folder Options-> View tab:
  • Under the Hidden files and folders heading:
  • Select - Show hidden files and folders.
  • Uncheck- Hide protected operating system files (recommended) option.
  • Also, make sure there is no checkmark beside Hide file extensions for known file types.
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
jotti.org
VirScan
Virus Total

click on Browse, and upload the following file for analysis:
C:\WINDOWS\System32\drivers\wmhawtzl.sys
C:\WINDOWS\is-LVP7K.exe
C:\WINDOWS\is-LVP7K.msg
C:\WINDOWS\is-LVP7K.lst

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

===================================================

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7171
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1
O33 - MountPoints2\{35753f57-7824-11db-9a7a-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{35753f57-7824-11db-9a7a-806d6172696f}\Shell\AutoRun\command - "" = d:\mplay.com – File not found
O33 - MountPoints2\{a70834b4-5abe-11de-8386-0018f37acae7}\Shell\AutoRun\command - "" = K:\MOVIEMK.EXE – File not found
O33 - MountPoints2\{e6b32d8e-6113-11de-838c-0018f37acae7}\Shell\AutoRun\command - "" = K:\SYMLCSVC.EXE – File not found
O33 - MountPoints2\{fdae3eb8-bd56-11dd-81d2-0018f37acae7}\Shell - "" = AutoRun
O33 - MountPoints2\{fdae3eb8-bd56-11dd-81d2-0018f37acae7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fdae3eb8-bd56-11dd-81d2-0018f37acae7}\Shell\AutoRun\command - "" = K:\LaunchU3.exe – File not found
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\LaunchU3.exe – File not found
[2009/01/23 20:00:52 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\datime3232.dll
[2009/01/23 20:00:47 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\d3d93232.dll
[2009/01/23 20:00:46 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\d3d83232.dll
[2009/01/23 20:00:45 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\D2HTOOLS32.dll
[2009/01/23 20:00:43 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\ctl3d3232.dll
[2009/01/23 20:00:37 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\CRDE200132.dll
[2009/01/23 20:00:31 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\comdlg3232.dll
[2009/01/23 20:00:23 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\clb32.dll
[2009/01/23 20:00:22 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\cic32.dll
[2009/01/23 20:00:20 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\certmgr32.dll
[2009/01/23 20:00:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\cdm32.dll
[2009/01/23 20:00:16 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\cc325032.dll
[2009/01/23 20:00:15 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\catsrvps32.dll
[2009/01/23 20:00:14 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\cards32.dll
[2009/01/23 20:00:11 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\bthserv32.dll
[2009/01/23 20:00:07 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\bitsprx332.dll
[2009/01/23 20:00:05 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\bdco1ins32.dll
[2009/01/23 20:00:04 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\bcbmm32.dll
[2009/01/23 20:00:01 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\avifile32.dll
[2009/01/23 19:59:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fxsmon32.dll
[2009/01/23 19:58:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fxsevent32.dll
[2009/01/23 19:57:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fxscomex32.dll
[2009/01/23 19:56:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fxsclntR32.dll
[2009/01/23 19:48:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fdco_l205232.dll
[2009/01/23 19:47:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fdco_l104132.dll
[2009/01/23 19:46:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fdco_l103632.dll
[2009/01/23 19:45:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fdco_l103132.dll
[2009/01/23 19:41:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\expsrv3232.dll
[2009/01/23 19:40:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\eventcls3232.dll
[2009/01/23 19:37:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\ersvc3232.dll
[2009/01/23 19:33:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dxtmsft3232.dll
[2009/01/23 19:31:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dx7vb3232.dll
[2009/01/23 19:31:54 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dsound3d3232.dll
[2009/01/23 19:31:53 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dskquoui3232.dll
[2009/01/23 19:31:50 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\ds32gt3232.dll
[2009/01/23 19:31:49 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\drprov3232.dll
[2009/01/23 19:31:46 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dpwsock3232.dll
[2009/01/23 19:31:44 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dpv103232.dll
[2009/01/23 19:31:43 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dpus1032.dll
[2009/01/23 19:31:42 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dpu103232.dll
[2009/01/23 19:31:36 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\docprop3232.dll
[2009/01/23 19:31:24 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\divxdec_040c3232.dll
[2009/01/23 19:31:23 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\DivX3232.dll
[2009/01/23 19:31:20 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dimap3232.dll
[2009/01/23 19:31:11 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\delphimm32.dll
[2009/01/23 19:31:03 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\d3dim70032.dll
[2009/01/23 19:31:02 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\d3d932.dll
[2009/01/23 19:31:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\D2HLINK32.dll
[2009/01/23 19:30:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\fdco_l102832.dll
[2009/01/23 19:30:57 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\exts32.dll
[2009/01/23 19:30:36 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dpv1032.dll
[2009/01/23 19:30:35 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dpu1032.dll
[2009/01/23 19:30:28 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dnssd32.dll
[2009/01/23 19:30:21 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\dmconfig32.dll
[2009/01/23 19:30:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\divxdec_040c32.dll
O35 - HKLM\..exefile [open] – C:\Program Files\conhost.exe "%1" %* File not found
O37 - HKLM\…exe [@ = exefile] – C:\Program Files\conhost.exe "%1" %* File not found

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
""="exefile"

:Files
C:\Program Files\conhost.exe

:Commands
[purity]
[emptytemp]
[resethosts]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
===================================================

Please try to run GMER in Safe Mode this time.

Reboot your computer in Safe Mode
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Tutorial if you need it How to boot into Safemode

===================================================

On your next reply please post :
File scanner report
OTL fix log
Fresh OTL log
GMER log

Good Day!
Post #6
Conspire: I couldn't find the first file that you told me to scan (C:\WINDOWS\System32\drivers\wmhawtzl.sys). I didn't do a search for the file to see if it might be located somewhere else on the drive, but it definitely wasn't in the directory C:\WINDOWS\System32\drivers. However, I did scan the other 3 files. The results are below: Filename: is-LVP7K.exe Status: Scan finished. 0 out of 19 scanners reported malware. Scan taken on: Sun 22 Aug 2010 22:03:11 (CET) Permalink ——————————————————————————– Additional info File size: 711168 bytes Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: 296a2fac6a99515a8a57d6af147890e6 SHA1: 44e5e5bedf8527fd15a25ff0fab1cd8cd34b82a8 Filename: is-LVP7K.lst Status: Scan finished. 0 out of 19 scanners reported malware. Scan taken on: Sun 22 Aug 2010 22:06:16 (CET) Permalink ——————————————————————————– Additional info File size: 418 bytes Filetype: ASCII English text, with CRLF line terminators MD5: 0ad4b758174d501dd280863a1298f2fb SHA1: 0efadd51ea1b75fb992daf7982189eb1dc94fbfa Filename: is-LVP7K.msg Status: Scan finished. 0 out of 19 scanners reported malware. Scan taken on: Sun 22 Aug 2010 22:12:21 (CET) Permalink ——————————————————————————– Additional info File size: 10562 bytes Filetype: Unknown MD5: f4b802e37404aaeeafc3116079932f92 SHA1: b707f0334d971e81872672169e612ca80c191cca I've also attached an OTL Log. In your last post, you asked for an OTL Fix Log and a Fresh OTL Log. I'm not sure exactly what this means. I did the custom fix that you wanted me to do, but it did not produce a log. It just said that the computer needed to reboot to complete the fixes. But there was no mention of a log, and no log appeared on my desktop (where OTL.exe is located) even after I rebooted. Then I did a new OTL scan (no custom scans/fixes, I just clicked on the Scan button at the top of OTL). It DID produce a log which is the one which I've attached. Is this what you meant by "Fresh OTL log?" Also, should I have inserted the custom scan text that I used for the first OTL scan I did a couple of days ago? Finally got GMER to complete successfully (in Safe Mode). It's log is also attached.

Attachments:

Post #7
Hi,

Is this what you meant by "Fresh OTL log?" Also, should I have inserted the custom scan text that I used for the first OTL scan I did a couple of days ago?

Yes, when I mean fresh OTL log, I need you to run the OTL scan again without copy/paste the custom scans command and post back the log back here as you did on your last post. The OTL should have produce a fix log for you when I posted the fix for you, and it should be located in C:\_OTL\MovedFiles which the file name looks something like this "08222010 173000.log". The number represents the time stamp for the creation of the log. Look for it and then post back here in your next reply.


Download Combofix from any of the links below but rename it to ConspireCF before saving it to your desktop.

Link 1
Link 2


==================================

Double click on the renamed ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

===================================================

On your next reply please post :
OTL fix log
Combofix log

Good Day!
Post #9
Hi,

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\system32\drivers\wmhawtzl.sys

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
@="""%1"" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
@=''exefile"

Rootkit::
C:\WINDOWS\system32\SKYNETdhopxmse.dat
C:\WINDOWS\system32\SKYNETkbcmpxvg.dll
C:\WINDOWS\system32\SKYNETkcjgktal.dat
C:\WINDOWS\system32\SKYNETaqcdwdeq.dll
C:\WINDOWS\system32\drivers\SKYNETndwyasvl.sys

Driver::
wlqwukvxccjbp
SKYNETxtpjdkxb

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]


===================================================

On your next reply please post :
Combofix log

Good Day!
Post #10
Conspire, It will not let be open Combofix by dragging a text file into it. It says application not found. The only way I can open Combofix (which is still renamed ConspireCF by the way) is to double click on it. Then it opens up the screen to choose which application to open it with (which was the original problem that I reported in my original post). If I select the Combofix logo from the list, it brings up a series of other "choose apllication" windows for applications that I didn't even ask it to open. I hit cancel on these because I don't know why they are popping up. But everytime I close one, another pops up. Eventually, after I've closed out all of these unwanted "choose application" windows, Combofix will open. But using the drag technique, I just get a no application found message. When the choose application window that seemed particularly suspicious given the problems I'm having with executables. In the midst of a bunch of windows trying to open iexplore.exe, there was one that wanted to open a file called "hideexec.exe." I'm not sure if that is exactly it because I was trying to close out of all of them so fast, but I thought that was an interesting name for a file. Any suggestions? Should I try the drag method of opening CF in Safe Mode maybe?
Post #11
Hi,

Sorry for the late reply.

I noticed that in your OTL fix log has a rather odd account name in your system : ShoppingReport - Did you create that account?

Yes, please try to perform the fix in Safe mode.

Reboot your computer in Safe Mode
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Tutorial if you need it How to boot into Safemode
Post #12

I noticed that in your OTL fix log has a rather odd account name in your system : ShoppingReport - Did you create that account?



No. Not sure where that came from. That username doesn't show up as an actual user to login with in Windows though. And when I go to documents and settings –> Users, that folder appears to be empty (unless the files are hidden; I forgot to check). Also, I already tried dragging the script file into ComboFix in Safe Mode. That didn't work either. Got the application not found message. Should I try downloading ComboFix again? Right now, I'm still using the original one that is renamed "ConspireCF." Also, do you find anything suspicious about the "hideexec.exe" (or similar) file that I mentioned in my last post? I saw it when I tried to open ComboFix the normal way (just clicking the icon, not dragging the text file into it). It triggered a bunch of "choose the program you want to use to open the file" windows. I'm not sure why all these windows popped up when all I wanted to do was open a single instance of ComboFix. Most of the windows wanted to open Internet Explorer, but I think one of them wanted to open a file called hideexec.exe.
Post #13
Hi,

I'm not sure the hideexec.exe is a legit file or not because I need to have a full directory in order for me to determine it. Right now there's one registry entry that we have to fix in order to get Combofix running.

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
O35 - HKLM\..exefile [open] – C:\Program Files\conhost.exe "%1" %* File not found
O37 - HKLM\…exe [@ = exefile] – C:\Program Files\conhost.exe "%1" %* File not found

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI