What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijacked Browser

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please bear with me-I'm a new member and not sure if I'm posting in the correct area. I need help to clear my hijacked browser. The following is my log. Please let me know what to delete: Thanks

Logfile of HijackThis v1.97.7
Scan saved at 10:14:02 AM, on 03/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\CHRIS\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://windowsupdate.microsoft.com/
N3 - Netscape 7: user_pref("browser.startup.homepage","www.globeinvestor.com"); (C:\Documents and Settings\CHRIS\Application Data\Mozilla\Profiles\default\0asl2yz4.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_Canada.src"); (C:\Documents and Settings\CHRIS\Application Data\Mozilla\Profiles\default\0asl2yz4.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {77FA72DA-6A0E-4115-9AF7-37E106BDDDBC} - C:\WINDOWS\System32\gckp.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Image] rundll32 C:\WINDOWS\image.dll,Install
O4 - HKLM\..\Run: [SpyBlocs] C:\Program Files\SpyBlocs\SpyBlocs.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\RunServices: [Image] rundll32 C:\WINDOWS\image.dll,Install
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
Post #2 last edited
Click here to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and post here the information in the 'Value' field.

Click here or here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.
Post #3
C:\WINDOWS\System32\d3doj.dll Am not able to complete 2nd part-I don't have notepad.exe to open log.txt!(I think I removed it when trying to fix this mess) What now? How do I get that program back? Thanks a lot for helping me!
Post #4
Click here to download xphidden.zip (so you can see hidden files and folders). Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

Then using Explorer, navigate to C:\Windows\System32\dllcache

You should see a version of notepad.exe in there, 65KB in size. Copy it to both these places:

C:\Windows\
C:\Windows\System32\

Then try again with the second part.
Post #5
Hope this is what you needed »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q813489-Q330994-Q818529-Q822925-Q828750-Q824145-Q832894-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. 04/07/2004 5:18am up 0 days, 19:14 »»»»»»»»»»»»»»»»»»***LOG!***»»»»»»»»»»»»»»»» Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\D3DOJ.DLL +++ File read error \\?\C:\WINDOWS\System32\D3DOJ.DLL +++ File read error »»»»» (*2*) »»»»»…….. **File C:\FINDnFIX\LIST.TXT D3DOJ.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ d3doj.dll Fri Jul 2 2004 10:15:58p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\D3DOJ.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group CHRIS-LORI\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »» Service search:(different variant) '"Network Security Service","__NS_Service_3"… [SC] GetServiceKeyName FAILED 1060: The specified service does not exist as an installed service. [SC] GetServiceDisplayName FAILED 1060: The specified service does not exist as an installed service. »»Notepad check…. C:\WINDOWS\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\DLLCACHE\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K –a– W32i APP ENU 5.1.2600.0 shp 66,048 07-02-2004 notepad.exe Language 0x0409 (English (United States)) CharSet 0x04b0 Unicode OleSelfRegister Disabled CompanyName Microsoft Corporation FileDescription Notepad InternalName Notepad OriginalFilenam NOTEPAD.EXE ProductName Microsoft® Windows® Operating System ProductVersion 5.1.2600.0 FileVersion 5.1.2600.0 (xpclient.010817-1148) LegalCopyright © Microsoft Corporation. All rights reserved. VS_FIXEDFILEINFO: Signature: feef04bd Struc Ver: 00010000 FileVer: 00050001:0a280000 (5.1:2600.0) ProdVer: 00050001:0a280000 (5.1:2600.0) FlagMask: 0000003f Flags: 00000000 OS: 00040004 NT Win32 FileType: 00000001 App SubType: 00000000 FileDate: 00000000:00000000 »»Dir 'junkxxx' was created with the following permissions… (FAT32=NA) Directory "C:\junkxxx" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x CHRIS-LORI\CHRIS Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: CHRIS-LORI\CHRIS Primary Group: CHRIS-LORI\None »»»»»»Backups created…»»»»»» 5:18am up 0 days, 19:15 04/07/2004 A C:\FINDnFIX\winBack.hiv –a– - - - - - 8,192 07-04-2004 winback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-04-2004 winkey.reg »»Performing 16bit string scan…. 00001150: A I vk UDeviceNotSelecte 00001190:dTimeout 1 5 P h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' ? USERProcessHandleQuota, h X 000012D0: vk < 9AppInit_DLLsx C : \ W I N 00001310:D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l 7 00001350:, ? # 6 00001390:r - f / 7 ; p ) 000013D0: - 4 L X l b h 00001410:U w i _ ] 8 $ @  / " e 00001450: p R 8  + 8 ' m 1 # 00001490:V f w T O 0 n - ? l 000014D0: > l V B P s 4 v n O ^ \ : 00001510: o O 7 F # * < 3 S 00001550: ———- WIN.TXT 9AppInit_DLLsxÃÀÿÿÿC REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "AppInit_DLLs"="" Windows UDeviceNotSelectedTimeout zGDIProcessHandleQuota" Spooler2 5swapdisk TransmissionRetryTimeout USERProcessHandleQuota, 9AppInit DLLsx **File C:\FINDnFIX\WIN.TXT Ñ_åàÿÿÿvk  €   5swapdisk h ° ð  X Ðÿÿÿvk  à   . TransmissionRetryTimeoutÐÿÿÿvk  €'   ?‚USERProcessHandleQuota, àÿÿÿh ° ð  X ˆ Ø Øÿÿÿvk <    9AppInit_DLLsxÃÀÿÿÿC : \ W I N D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l À Šÿ7ÎÿŸÿÃ,ÿÚíþÁþÀ°þ?#ÿ­ ±ÿ ÓÿØÿ´ÿÛÿ¤ÿÉÿØÿ¬ÿøÿ—ÿúÿ6ÿ ªþ ”þéÿµþ ÿr †ÿ¬ÿ‡Ùÿƒ ñ - f / 7 Âÿ ´ÿõÿ ; Ž Ò p ¼ ½ÿÌÖÿ•Ñÿ)±ÿ•»ÿã Åÿ íÿ- 4   L X ®l Ý­ ½ › Î b Î ÝÿÏ hÿô ÿì ±þU ²þwÿþØþiþ¼þ_þÄþžþèþ¿þ]ÿ°þ½ÿïþæÿ8ÿ ™ÿ$ üÿ@ 
Post #6
Good. Open the FINDnFIX folder and then open the keys1 folder. Right-click on the MOVEit.bat file and select 'edit'. That will open the file as an empty text file - copy and paste this line into the blank file:

move %WinDir%\System32\D3DOJ.DLL %SystemDrive%\junkxxx\D3DOJ.DLL

Save the file and close. The next step will cause a restart. Still in the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot.

On restart, open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log1.txt - post it's contents in your next reply.



Occasionally when trying to edit the MOVEit.bat file the following error occurs: "Windows cannot find "C:FINDnFIX\keys1\MOVEit.bat. Make sure you typed the name correctly then try again."

If that happens, skip that step and proceed this way instead. In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the D3DOJ.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log1.txt - post it's contents in your next reply.
Post #7
Here's the next file: »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q813489-Q330994-Q818529-Q822925-Q828750-Q824145-Q832894-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. 04/07/2004 5:18am up 0 days, 19:14 »»»»»»»»»»»»»»»»»»***LOG!***»»»»»»»»»»»»»»»» Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\D3DOJ.DLL +++ File read error \\?\C:\WINDOWS\System32\D3DOJ.DLL +++ File read error »»»»» (*2*) »»»»»…….. **File C:\FINDnFIX\LIST.TXT D3DOJ.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ d3doj.dll Fri Jul 2 2004 10:15:58p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\D3DOJ.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group CHRIS-LORI\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »» Service search:(different variant) '"Network Security Service","__NS_Service_3"… [SC] GetServiceKeyName FAILED 1060: The specified service does not exist as an installed service. [SC] GetServiceDisplayName FAILED 1060: The specified service does not exist as an installed service. »»Notepad check…. C:\WINDOWS\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\DLLCACHE\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K –a– W32i APP ENU 5.1.2600.0 shp 66,048 07-02-2004 notepad.exe Language 0x0409 (English (United States)) CharSet 0x04b0 Unicode OleSelfRegister Disabled CompanyName Microsoft Corporation FileDescription Notepad InternalName Notepad OriginalFilenam NOTEPAD.EXE ProductName Microsoft® Windows® Operating System ProductVersion 5.1.2600.0 FileVersion 5.1.2600.0 (xpclient.010817-1148) LegalCopyright © Microsoft Corporation. All rights reserved. VS_FIXEDFILEINFO: Signature: feef04bd Struc Ver: 00010000 FileVer: 00050001:0a280000 (5.1:2600.0) ProdVer: 00050001:0a280000 (5.1:2600.0) FlagMask: 0000003f Flags: 00000000 OS: 00040004 NT Win32 FileType: 00000001 App SubType: 00000000 FileDate: 00000000:00000000 »»Dir 'junkxxx' was created with the following permissions… (FAT32=NA) Directory "C:\junkxxx" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x CHRIS-LORI\CHRIS Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: CHRIS-LORI\CHRIS Primary Group: CHRIS-LORI\None »»»»»»Backups created…»»»»»» 5:18am up 0 days, 19:15 04/07/2004 A C:\FINDnFIX\winBack.hiv –a– - - - - - 8,192 07-04-2004 winback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-04-2004 winkey.reg »»Performing 16bit string scan…. 00001150: A I vk UDeviceNotSelecte 00001190:dTimeout 1 5 P h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' ? USERProcessHandleQuota, h X 000012D0: vk < 9AppInit_DLLsx C : \ W I N 00001310:D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l 7 00001350:, ? # 6 00001390:r - f / 7 ; p ) 000013D0: - 4 L X l b h 00001410:U w i _ ] 8 $ @  / " e 00001450: p R 8  + 8 ' m 1 # 00001490:V f w T O 0 n - ? l 000014D0: > l V B P s 4 v n O ^ \ : 00001510: o O 7 F # * < 3 S 00001550: ———- WIN.TXT 9AppInit_DLLsxÃÀÿÿÿC REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "AppInit_DLLs"="" Windows UDeviceNotSelectedTimeout zGDIProcessHandleQuota" Spooler2 5swapdisk TransmissionRetryTimeout USERProcessHandleQuota, 9AppInit DLLsx **File C:\FINDnFIX\WIN.TXT Ñ_åàÿÿÿvk  €   5swapdisk h ° ð  X Ðÿÿÿvk  à   . TransmissionRetryTimeoutÐÿÿÿvk  €'   ?‚USERProcessHandleQuota, àÿÿÿh ° ð  X ˆ Ø Øÿÿÿvk <    9AppInit_DLLsxÃÀÿÿÿC : \ W I N D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l À Šÿ7ÎÿŸÿÃ,ÿÚíþÁþÀ°þ?#ÿ­ ±ÿ ÓÿØÿ´ÿÛÿ¤ÿÉÿØÿ¬ÿøÿ—ÿúÿ6ÿ ªþ ”þéÿµþ ÿr †ÿ¬ÿ‡Ùÿƒ ñ - f / 7 Âÿ ´ÿõÿ ; Ž Ò p ¼ ½ÿÌÖÿ•Ñÿ)±ÿ•»ÿã Åÿ íÿ- 4   L X ®l Ý­ ½ › Î b Î ÝÿÏ hÿô ÿì ±þU ²þwÿþØþiþ¼þ_þÄþžþèþ¿þ]ÿ°þ½ÿïþæÿ8ÿ ™ÿ$ üÿ@ 
Post #8
Oops! I think that last post was the same file! I think this is the correct one: »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» 04/07/2004 11:47am up 0 days, 0:03 Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q813489-Q330994-Q818529-Q822925-Q828750-Q824145-Q832894-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. »»»»»»»»»»»»»»»»»»***LOG1!***»»»»»»»»»»»»»»»» Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» \\?\C:\WINDOWS\System32\D3DOJ.DLL +++ File read error C:\WINDOWS\System32\D3DOJ.DLL +++ File read error »»»»»»» (2) »»»»»»» **File C:\FINDnFIX\LIST.TXT D3DOJ.DLL Can't Open! »»»»»»» (3) »»»»»»» C:\WINDOWS\SYSTEM32\ d3doj.dll Fri Jul 2 2004 10:15:58p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\D3DOJ.DLL »»»*»»» Scanning for moved file… »»»*»»» No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. fgrep: no files found for C:\JUNKXXX\*.* rem replace this entire line with your given command.,.. File not found - C:\junkxxx\*.* »»Permissions: There are no more files. Directory "C:\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x CHRIS-LORI\CHRIS Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: CHRIS-LORI\CHRIS Primary Group: CHRIS-LORI\None Directory "C:\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 0000000A -c– 00000002 —- —- -w– BUILTIN\Users Allow 00000000 t— 001200A9 —- -S– r–x \Everyone Owner: BUILTIN\Administrators Primary Group: NT AUTHORITY\SYSTEM »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ C:\\WINDOWS\\System32\\d3doj.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = C:\WINDOWS\System32\d3doj.dll »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Notepad check…. C:\WINDOWS\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\DLLCACHE\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K –a– W32i APP ENU 5.1.2600.0 shp 66,048 07-02-2004 notepad.exe Language 0x0409 (English (United States)) CharSet 0x04b0 Unicode OleSelfRegister Disabled CompanyName Microsoft Corporation FileDescription Notepad InternalName Notepad OriginalFilenam NOTEPAD.EXE ProductName Microsoft® Windows® Operating System ProductVersion 5.1.2600.0 FileVersion 5.1.2600.0 (xpclient.010817-1148) LegalCopyright © Microsoft Corporation. All rights reserved. VS_FIXEDFILEINFO: Signature: feef04bd Struc Ver: 00010000 FileVer: 00050001:0a280000 (5.1:2600.0) ProdVer: 00050001:0a280000 (5.1:2600.0) FlagMask: 0000003f Flags: 00000000 OS: 00040004 NT Win32 FileType: 00000001 App SubType: 00000000 FileDate: 00000000:00000000 00001150: dio/ vk UDeviceNotSelecte 00001190:dTimeout 1 5 P h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' ? USERProcessHandleQuota, h X 000012D0: vk < . AppInit_DLLsurce C : \ W I N 00001310:D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l nformation, 00001350:visit the QuickTime 00001390:Web site. z lastModTimeStamp s 000013D0: z canUnload 00001410: mimetype-0 mime 00001450:type audio/x-gsm A , 5 description GSM 00001490: audio file (*.gsm) a A m extension gs 000014D0:m mimetype-1 00001510: mimetype video/x-mpeg 00001550: ———- WIN.TXT 9AppInit_DLLsxÃÀÿÿÿC ———- NEWWIN.TXT AppInit_DLLsurceÀÿÿÿC
Post #9
Hi Daemon. I have to be at work soon but if you let me know what my next stetp is I'll do it after work. Thanks again for you help!
Post #12
I think I did it wrong the 1st time.. this is I think correct now: »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» 06/07/2004 8:25pm up 0 days, 0:05 Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q813489-Q330994-Q818529-Q822925-Q828750-Q824145-Q832894-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. »»»»»»»»»»»»»»»»»»***LOG1!***»»»»»»»»»»»»»»»» Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» \\?\C:\WINDOWS\System32\D3DOJ.DLL +++ File read error C:\WINDOWS\System32\D3DOJ.DLL +++ File read error »»»»»»» (2) »»»»»»» **File C:\FINDnFIX\LIST.TXT D3DOJ.DLL Can't Open! »»»»»»» (3) »»»»»»» C:\WINDOWS\SYSTEM32\ d3doj.dll Fri Jul 2 2004 10:15:58p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\D3DOJ.DLL »»»*»»» Scanning for moved file… »»»*»»» No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. fgrep: no files found for C:\JUNKXXX\*.* rem replace this entire line with your given command.,.. File not found - C:\junkxxx\*.* »»Permissions: There are no more files. Directory "C:\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x CHRIS-LORI\CHRIS Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: CHRIS-LORI\CHRIS Primary Group: CHRIS-LORI\None Directory "C:\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 0000000A -c– 00000002 —- —- -w– BUILTIN\Users Allow 00000000 t— 001200A9 —- -S– r–x \Everyone Owner: BUILTIN\Administrators Primary Group: NT AUTHORITY\SYSTEM »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ C:\\WINDOWS\\System32\\d3doj.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = C:\WINDOWS\System32\d3doj.dll »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Notepad check…. C:\WINDOWS\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\DLLCACHE\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K –a– W32i APP ENU 5.1.2600.0 shp 66,048 07-02-2004 notepad.exe Language 0x0409 (English (United States)) CharSet 0x04b0 Unicode OleSelfRegister Disabled CompanyName Microsoft Corporation FileDescription Notepad InternalName Notepad OriginalFilenam NOTEPAD.EXE ProductName Microsoft® Windows® Operating System ProductVersion 5.1.2600.0 FileVersion 5.1.2600.0 (xpclient.010817-1148) LegalCopyright © Microsoft Corporation. All rights reserved. VS_FIXEDFILEINFO: Signature: feef04bd Struc Ver: 00010000 FileVer: 00050001:0a280000 (5.1:2600.0) ProdVer: 00050001:0a280000 (5.1:2600.0) FlagMask: 0000003f Flags: 00000000 OS: 00040004 NT Win32 FileType: 00000001 App SubType: 00000000 FileDate: 00000000:00000000 00001150: mety vk UDeviceNotSelecte 00001190:dTimeout 1 5 P h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' ? USERProcessHandleQuota, h X 000012D0: vk < . AppInit_DLLsurce C : \ W I N 00001310:D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l D 00001350: C y= mimetype video/flc OC
Post #14
Found it! Moved it to "junkxxx" and ran restore.it and this is what I got: »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» 07/07/2004 6:21am up 0 days, 10:01 Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q813489-Q330994-Q818529-Q822925-Q828750-Q824145-Q832894-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. »»»»»»»»»»»»»»»»»»***LOG1!***»»»»»»»»»»»»»»»» Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» »»»»»»» (2) »»»»»»» **File C:\FINDnFIX\LIST.TXT »»»»»»» (3) »»»»»»» No matches found. No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»*»»» Scanning for moved file… »»»*»»» * result\\?\C:\junkxxx\D3DOJ.222 C:\JUNKXXX\ d3doj.222 Fri Jul 2 2004 10:15:58p A…. 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\JUNKXXX\D3DOJ.222 **File C:\JUNKXXX\D3DOJ.222 0000DEBE: 67 44 65 76 69 63 65 00 . 00 53 74 72 65 61 6D 69 gDevice. .Streami 0000DED3: 63 65 53 65 74 75 70 00 . 32 00 00 00 00 00 E0 01 ceSetup. 2…..à. A—– D3DOJ .222 0000E000 22:15.58 02/07/2004 rem replace this entire line with your given command.,.. –a– W32i - - - - 57,344 07-02-2004 d3doj.222 A C:\junkxxx\d3doj.222 File: CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 »»Permissions: C:\junkxxx\d3doj.222 BUILTIN\Administrators:F NT AUTHORITY\SYSTEM:F CHRIS-LORI\CHRIS:F BUILTIN\Users:R Directory "C:\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x CHRIS-LORI\CHRIS Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: CHRIS-LORI\CHRIS Primary Group: CHRIS-LORI\None Directory "C:\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 0000000A -c– 00000002 —- —- -w– BUILTIN\Users Allow 00000000 t— 001200A9 —- -S– r–x \Everyone Owner: BUILTIN\Administrators Primary Group: NT AUTHORITY\SYSTEM File "C:\junkxxx\d3doj.222" Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x CHRIS-LORI\CHRIS Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Owner: CHRIS-LORI\CHRIS Primary Group: CHRIS-LORI\None »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 508 »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ C:\\WINDOWS\\System32\\d3doj.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = C:\WINDOWS\System32\d3doj.dll »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Notepad check…. C:\WINDOWS\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K C:\WINDOWS\SYSTEM32\DLLCACHE\ notepad.exe Fri Jul 2 2004 10:15:46p A…. 66,048 64.50 K 1 item found: 1 file, 0 directories. Total of file sizes: 66,048 bytes 64.50 K –a– W32i APP ENU 5.1.2600.0 shp 66,048 07-02-2004 notepad.exe Language 0x0409 (English (United States)) CharSet 0x04b0 Unicode OleSelfRegister Disabled CompanyName Microsoft Corporation FileDescription Notepad InternalName Notepad OriginalFilenam NOTEPAD.EXE ProductName Microsoft® Windows® Operating System ProductVersion 5.1.2600.0 FileVersion 5.1.2600.0 (xpclient.010817-1148) LegalCopyright © Microsoft Corporation. All rights reserved. VS_FIXEDFILEINFO: Signature: feef04bd Struc Ver: 00010000 FileVer: 00050001:0a280000 (5.1:2600.0) ProdVer: 00050001:0a280000 (5.1:2600.0) FlagMask: 0000003f Flags: 00000000 OS: 00040004 NT Win32 FileType: 00000001 App SubType: 00000000 FileDate: 00000000:00000000 00001150: vk UDeviceNotSelecte 00001190:dTimeout 1 5 P h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' ? USERProcessHandleQuota, h X 000012D0: vk < . AppInit_DLLsurce C : \ W I N 00001310:D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: ———- WIN.TXT 9AppInit_DLLsxÃÀÿÿÿC ———- NEWWIN.TXT AppInit_DLLsurceÀÿÿÿC **File C:\FINDnFIX\NEWWIN.TXT **File C:\FINDnFIX\NEWWIN.TXT 000012F0: 01 00 00 00 01 00 2E 00 . 5F 44 4C 4C 73 75 72 63 …….. _DLLsurc **File C:\FINDnFIX\NEWWIN.TXT Ñ_åàÿÿÿvk  €   5swapdisk h ° ð  X Ðÿÿÿvk  à   . TransmissionRetryTimeoutÐÿÿÿvk  €'   ?‚USERProcessHandleQuota, àÿÿÿh ° ð  X ˆ Ø Øÿÿÿvk <    . AppInit_DLLsurceÀÿÿÿC : \ W I N D O W S \ S y s t e m 3 2 \ d 3 d o j . d l l À ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿGx/ÚšV5¿iUéòUª!UUIà ¸‘nýþ"miW­þÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿýÿÿïÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¿õþÿþ÷Ðòÿÿÿÿÿÿÿÿÿß°-¥³õµˆŠ.î‡ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿûÿÿÿÿÿÿÿ
Post #15 last edited
Hmmm… :scratch: open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

Then do this again:

copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and post here the information in the 'Value' field.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI