I've Been Hijacked

Unzip HJT into it's own permanent folder before doing anything in order for it to create backups. (Not a temporary folder or directly on the desktop (in a folder on the desktop is fine) & not directly on your hard drive).

Download & instal Adaware from here
& update it.
In settings under 'scanning,' have it set to
'scan within archives,'
'scan active processes,'
'scan registry,'
'deepscan registry'
'scan my IE Favourites for banned URL's,'
'scan my host's file.'
In 'tweaks' under 'scanning engine' set it to 'unload recognised processes during scanning.'
Also in 'tweaks' under 'cleaning engine' set it to 'Automatically try to unregister objects prior to deletion' & 'let Windows remove files in use at next reboot.'
Do not run yet.
——————————–
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\CHRIS\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {0EDE603C-D054-4B9E-B857-752DB32AA30A} - C:\WINDOWS\System32\ngfli.dll
—————————
Download and install APM from: http://www.diamondcs.com.au/index.php?page=apm

Close all windows except HijackThis and fix the lines above.

In the upper window of APM select explorer.exe
In the lower window find and rightclick the BHO from the HijackThis log (C:\WINDOWS\System32\ngfli.dll)
Select Unload DLL and click OK on the prompts that follow.

Reboot and scan with AdAware to remove the txt and html protocol association.
————————-
Update hijackthis to version 1.98, rescan after a reboot & post that log back here please.

A few other problems to take care of now so, Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)

O4 - HKLM\..\Run: [GaHuIHSR] C:\documents and settings\chris\local settings\temp\GaHuIHSR.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-him.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Corx5Ux.exe
O4 - HKLM\..\Run: [vsnQ3sh] dmd2nls.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/16bb07f91f2bfc…ip/RdxIE601.cab
O16 - DPF: {B94B4225-E02E-4D3F-BADB-026F1E2F3AD7} (HttpDownloader Control) - file://C:\WINDOWS\SexDownloader.cab

O18 - Filter: text/html - {C487B864-0798-4A54-B241-CED262F7FB7E} - C:\WINDOWS\System32\ngfli.dll
O18 - Filter: text/plain - {C487B864-0798-4A54-B241-CED262F7FB7E} - C:\WINDOWS\System32\ngfli.dll

Reboot into safe mode following the instructions here & navigate to & delete the following if found:

C:\documents and settings\chris\local settings\temp Folder contents
C:\WINDOWS\System32\dp-him.exe File
C:\WINDOWS\System32\Corx5Ux.exe File

Reboot normally.

Go here for an on-line scan & set it to autoclean for you.
Try this scan as well.

Reboot after doing the above then post a fresh log please.

Ok. Do not worry as one of our experts will be along soon to help you remove the hijack. Should not be too long .

To get you started please do the following:

Click here to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and post here the information in the 'Value' field.

Click here or here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt here.

Unfortunately it's been withdrawn due to inappropriate use. There are other techniques so don't despair - I'd like to try something first though to see if it's an easier approach.

Click here: https://beta.activeupdate.trendmicro.com/fi…gentv1.0007.zip

Download and unzip it.

1. Turn off all applications running on your system, including any antivirus software.

2. Create a folder and copy the tool, FIXAGENT.EXE, into any folder in a local drive. Example: C:\FixAgent

3. Run the tool by double clicking the tool in Windows Explorer.

4. Enable any antivirus software that is installed on your system and perform a manual scan.

NOTE: This fix tool generates the log file, C:\FIXAGENT.LOG - post that in your next reply.

Repeat this also:

copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and post here the information in the 'Value' field.

Daemon I'm not too adept with computers. Could not figure out the fixagent method so i went back to findnfix. Copy of that log is below. Thanks, for joining in, I'm getting frustrated with all these problems. »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» –The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder and is the destination for the file to be moved.. -*Previous directions will no longer work… »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q832894-Q330994-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. Tue 07/13/2004 5:36pm up 0 days, 0:24 »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» *For *Helpers/Mods and/or users that are not familiar with any of the items on the scan results- I recommend using an alternative, once you know what to look for! »»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/12)»»»»»»»»»»»»»»»» »»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»* Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\HLP.DLL +++ File read error \\?\C:\WINDOWS\System32\HLP.DLL +++ File read error »»»»» (*2*) »»»»»…….. **File C:\FINDnFIX\LIST.TXT HLP.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ hlp.dll Sat May 15 2004 7:59:14p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLP.DLL »»»»»(*5*)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT ¯ Access denied ® ………………… HLP.DLL …..57344 15.05.2004 »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… C:\WINDOWS\SYSTEM32\ hlp.dll Sat May 15 2004 7:59:14p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLP.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Full access D9SQQD41\CHRIS (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM Full access D9SQQD41\CHRIS »»Member of…: (Admin logon required!) User is a member of group D9SQQD41\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created…»»»»»» 5:37pm up 0 days, 0:25 Tue 07/13/2004 A C:\FINDnFIX\keyback.hiv –a– - - - - - 8,192 07-13-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-13-2004 winkey.reg C:\FINDNFIX\ JUNKXXX Tue Jul 13 2004 5:36:38p .D… 1 item found: 0 files, 1 directory. »»Performing string scan…. 00001150:e , ." e , 00001190: ." e , vk | AppInit_DLLs ' 000011D0: vk y DeviceNotSelectedTimeout 1 5 00001210: ( 9 0 Handle vk ' GDIProcessHandle 00001250:Quotak vk x dlSpooler y e s =t 00001290: ( X vk | swapdisk vk 000012D0: utTransmissionRetryTimeout ( X 00001310: vk ' EnUSERProcessHandleQuota 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT AppInit_DLLs' ————– ————– No strings found. ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 2 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "" 0000 00 00 | .. 

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the HLP.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log1.txt - post it's contents in your next reply.

i had a file titled "log" and one titled "log2", the latter appeared automatically. Copies of both attached: LOG »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» –The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder and is the destination for the file to be moved.. -*Previous directions will no longer work… »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q832894-Q330994-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. Tue 07/13/2004 5:36pm up 0 days, 0:24 »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» *For *Helpers/Mods and/or users that are not familiar with any of the items on the scan results- I recommend using an alternative, once you know what to look for! »»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/12)»»»»»»»»»»»»»»»» »»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»* Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\HLP.DLL +++ File read error \\?\C:\WINDOWS\System32\HLP.DLL +++ File read error »»»»» (*2*) »»»»»…….. **File C:\FINDnFIX\LIST.TXT HLP.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ hlp.dll Sat May 15 2004 7:59:14p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLP.DLL »»»»»(*5*)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT ¯ Access denied ® ………………… HLP.DLL …..57344 15.05.2004 »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… C:\WINDOWS\SYSTEM32\ hlp.dll Sat May 15 2004 7:59:14p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLP.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Full access D9SQQD41\CHRIS (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM Full access D9SQQD41\CHRIS »»Member of…: (Admin logon required!) User is a member of group D9SQQD41\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created…»»»»»» 5:37pm up 0 days, 0:25 Tue 07/13/2004 A C:\FINDnFIX\keyback.hiv –a– - - - - - 8,192 07-13-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-13-2004 winkey.reg C:\FINDNFIX\ JUNKXXX Tue Jul 13 2004 5:36:38p .D… 1 item found: 0 files, 1 directory. »»Performing string scan…. 00001150:e , ." e , 00001190: ." e , vk | AppInit_DLLs ' 000011D0: vk y DeviceNotSelectedTimeout 1 5 00001210: ( 9 0 Handle vk ' GDIProcessHandle 00001250:Quotak vk x dlSpooler y e s =t 00001290: ( X vk | swapdisk vk 000012D0: utTransmissionRetryTimeout ( X 00001310: vk ' EnUSERProcessHandleQuota 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT AppInit_DLLs' ————– ————– No strings found. ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 2 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "" 0000 00 00 | ..  LOG2 »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» Thu 07/15/2004 5:21pm up 0 days, 0:06 Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q832894-Q330994-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. »»»»»»»»»»»»»»»»»»***LOG2!***»»»»»»»»»»»»»»»» This log will confirm if the file was successfully moved, and/or the right file was selected. Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» »»»»»»» (2) »»»»»»» **File C:\FINDnFIX\LIST.TXT »»»»»»» (3) »»»»»»» No matches found. Unknown/hidden files… No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»»»(5)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT »»»»»»» Search by size… No matches found. No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»*»»» Scanning for moved file… »»»*»»» \\?\C:\FINDnFIX\junkxxx\HLP.222 +++ File read error C:\FINDnFIX\junkxxx\HLP.222 +++ File read error C:\FINDNFIX\JUNKXXX\ hlp.222 Sat May 15 2004 7:59:14p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\FINDNFIX\JUNKXXX\HLP.222 fgrep: can't open input C:\FINDNFIX\JUNKXXX\HLP.222 A—-R HLP .222 0000E000 19:59.14 15/05/2004 -ra– - - - - - 57,344 05-15-2004 hlp.222 A R C:\FINDnFIX\junkxxx\hlp.222 CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock. MD5 Message Digest Algorithm by RSA Data Security, Inc. File name Size Date Time MD5 Hash ________________________________________________________________________C:\FINDnFIX\junkxxx\HLP.222 can't be opened. File: »»Permissions: C:\FINDnFIX\junkxxx\hlp.222 Directory "C:\FINDnFIX\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000009 –o- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000002 tc– 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000009 –o- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000002 tc– 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 0000001B -co- 10000000 —A —- —- BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x D9SQQD41\CHRIS Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Allow 0000001B -co- A0000000 R-X- —- —- BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: D9SQQD41\CHRIS Primary Group: D9SQQD41\None Directory "C:\FINDnFIX\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 0000001B -co- 10000000 —A —- —- BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x D9SQQD41\CHRIS Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Allow 0000001B -co- A0000000 R-X- —- —- BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: D9SQQD41\CHRIS Primary Group: D9SQQD41\None File "C:\FINDnFIX\junkxxx\hlp.222" Access is denied. erreur dans ListAccessRights sur C:\FINDnFIX\junkxxx\hlp.222 »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Full access D9SQQD41\CHRIS (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM Full access D9SQQD41\CHRIS 00001150:e , ." e , 00001190: ." e , x vk y DeviceNotSelecte 000011D0:dTimeout 1 5 ( vk ' GDIProce 00001210:ssHandleQuotak 9 0 Handle vk P dlSpooler 00001250: y e s =t vk | swapdisk 0 00001290:` vk utTransmissionRetryTimeout vk 000012D0: ' EnUSERProcessHandleQuota 0 ` 00001310: vk y AppInit_DLLs 00001350: x ; x l x l x l x7 x l x l x l x[ x x 00001390: l x l x L x x l x l x x{ x x l x x l x l x l x x l x 000013D0: l x l x x 00001410: XJ G D 9 00001450:S Q Q D 4 1 @ x 00001490: x xh x8 x x xXC h x x 000014D0: 0 1 2 3 4 5 6 7 8 9 a b c d e f 00001510: x x x x x x } + ) 8 xT x 00001550:x ———- NEWWIN.TXT AppInit_DLLsÿÿÿÿÀ ————– ————– ————– 0123456789abcdef =============================================================================== 57,344 bytes 5,734,400 cps Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01  I am awaiting your instructions. Thanks

That worked Nearly there, open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

Daemon