ckmaxwell
Topic Starter
Did you forget about me? Not trying to be a pain in the (you know what), but I've been dealing with this for 3 days.
After install reglite this is in value field -
"C:\WINDOWS\System32\kbdh.dll"
findnfix log is below
»»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»»
Microsoft Windows XP [Version 5.1.2600]
»»»IE build and last SP(s)
6.0.2800.1106 SP1-Q837009-Q832894-Q831167
The type of the file system is NTFS.
C: is not dirty.
Tue 07/06/2004
4:09pm up 0 days, 0:12
»»»»»»»»»»»»»»»»»»***LOG!***»»»»»»»»»»»»»»»»
Scanning for file(s)…
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» ………
»»Locked or 'Suspect' file(s) found…
C:\WINDOWS\System32\KBDH.DLL +++ File read error
\\?\C:\WINDOWS\System32\KBDH.DLL +++ File read error
»»»»» (*2*) »»»»»……..
**File C:\FINDnFIX\LIST.TXT
KBDH.DLL Can't Open!
»»»»» (*3*) »»»»»……..
C:\WINDOWS\SYSTEM32\
kbdh.dll Sun Jun 27 2004 4:10:42p A…R 57,344 56.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57,344 bytes 56.00 K
C:\WINDOWS\SYSTEM32\
kbdh.dll Sun Jun 27 2004 4:10:42p A…R 57,344 56.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57,344 bytes 56.00 K
unknown/hidden files…
No matches found.
»»»»» (*4*) »»»»»………
Sniffing……….
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\WINDOWS\SYSTEM32\KBDH.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\WINDOWS\SYSTEM32\KBDH.DLL
»»»»»(*5*)»»»»»
**File C:\WINDOWS\SYSTEM32\DLLXXX.TXT
¯ Access denied ® ………………… KBDH.DLL …..57344 27.06.2004
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512…)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448
»»Dumping Values……..
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)
»»Security settings for 'Windows' key:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
»»Member of…: (Admin logon required!)
User is a member of group BOBMAXWELL\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
»» Service search:(different variant) '"Network Security Service","__NS_Service_3"…
[SC] GetServiceKeyName FAILED 1060:
The specified service does not exist as an installed service.
[SC] GetServiceDisplayName FAILED 1060:
The specified service does not exist as an installed service.
»»Notepad check….
C:\WINDOWS\
notepad.exe Mon Mar 31 2003 8:00:00a A…. 66,048 64.50 K
1 item found: 1 file, 0 directories.
Total of file sizes: 66,048 bytes 64.50 K
No matches found.
C:\WINDOWS\SYSTEM32\DLLCACHE\
notepad.exe Mon Mar 31 2003 8:00:00a A…. 66,048 64.50 K
1 item found: 1 file, 0 directories.
Total of file sizes: 66,048 bytes 64.50 K
–a– W32i APP ENU 5.1.2600.0 shp 66,048 03-31-2003 notepad.exe
Language 0x0409 (English (United States))
CharSet 0x04b0 Unicode
OleSelfRegister Disabled
CompanyName Microsoft Corporation
FileDescription Notepad
InternalName Notepad
OriginalFilenam NOTEPAD.EXE
ProductName Microsoft® Windows® Operating System
ProductVersion 5.1.2600.0
FileVersion 5.1.2600.0 (xpclient.010817-1148)
LegalCopyright © Microsoft Corporation. All rights reserved.
VS_FIXEDFILEINFO:
Signature: feef04bd
Struc Ver: 00010000
FileVer: 00050001:0a280000 (5.1:2600.0)
ProdVer: 00050001:0a280000 (5.1:2600.0)
FlagMask: 0000003f
Flags: 00000000
OS: 00040004 NT Win32
FileType: 00000001 App
SubType: 00000000
FileDate: 00000000:00000000
»»Dir 'junkxxx' was created with the following permissions…
(FAT32=NA)
Directory "C:\junkxxx"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators
Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000000 t— 001F01FF —- DSPO rw+x BOBMAXWELL\Bob Maxwell
Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER
Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users
Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users
Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users
Owner: BOBMAXWELL\Bob Maxwell
Primary Group: BOBMAXWELL\None
»»»»»»Backups created…»»»»»»
4:10pm up 0 days, 0:13
Tue 07/06/2004
A C:\FINDnFIX\keyback.hiv
–a– - - - - - 8,192 07-06-2004 keyback.hiv
A C:\FINDnFIX\keys1\winkey.reg
–a– - - - - - 287 07-06-2004 winkey.reg
»»Performing string scan….
00001150: vk UDeviceNotSelecte
00001190:dTimeout 1 5 x h vk ' zGDIProce
000011D0:ssHandleQuota" 9 0 =t vk Spooler2
00001210: y e s _ vk 5swapdisk h
00001250: X vk . TransmissionRetryTimeout vk
00001290: ' 5 USERProcessHandleQuota5 h X
000012D0: vk : AppInit_DLLs C : \ W I N
00001310:D O W S \ S y s t e m 3 2 \ k b d h . d l l 3
00001350:
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
———- WIN.TXT
AppInit_DLLsۯ
————–
————–
yes
C:\WINDOWS\System32\kbdh.dll
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs"=""
**File C:\FINDnFIX\WIN.TXT
Ñ_åàÿÿÿvk € 5swapdisk h ° ð X Ðÿÿÿvk à . TransmissionRetryTimeoutÐÿÿÿvk €' 5 USERProcessHandleQuota5 àÿÿÿh ° ð X ˆ Ø Øÿÿÿvk : AppInit_DLLs€Ø ÀÿÿÿC : \ W I N D O W S \ S y s t e m 3 2 \ k b d h . d l l 3 À
