Tried Most Solutions Already, Hope You Can Help

Yikes, there's a lot in there. Do all this:

Click here to download the PeperFix tool, save it to your desktop, doubleclick on it, click 'Find and Fix' and reboot if prompted.

Click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. Reboot when done.

Click here to download Spybot Search & Destroy - install, update, scan and fix all RED items it finds. Reboot when done.

Click here to download Ad-Aware and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Then click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done.

Go here and run online scans (all), allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan

Reboot when done.

Rescan with HJT and post a new log here.

Click here or here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Click here to download xphidden.zip (so you can see hidden files and folders). Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

Then using Explorer, navigate to C:\Windows\System32\dllcache

You should see a version of notepad.exe in there, 65KB in size. Copy it to both these places:

C:\Windows\
C:\Windows\System32\

Then try again.

Also go here : http://www.dougknox.com/xp/utils/xp_starttrack.htm

Download and install. Run StartupTracker and post the log it generates.

Thanks again for all the help, Here is the log from Startup Tracker: 7/31/2004 2:18:40 PM – Registry – HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce No Items Found – Registry – HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ccApp "c:\Program Files\Common Files\Symantec Shared\ccApp.exe" TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot HPDJ Taskbar Utility C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe NeroFilterCheck C:\WINDOWS\system32\NeroCheck.exe hrtcm C:\WINDOWS\hrtcm.exe 9fI C:\documents and settings\owner\local settings\temp\9fI.exe mmtask C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe Prein C:\DOCUME~1\Owner\LOCALS~1\Temp\app97.tmp 2P6WFAX43ZHE7C C:\WINDOWS\System32\Dyf0o5.exe 80aZ C:\documents and settings\owner\local settings\temp\80aZ.exe QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime AutoUpdater "C:\Program Files\AutoUpdate\AutoUpdate.exe" t3rQ34S upstvid.exe – Registry – HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce No Items Found – Registry – HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BackupNotify c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe c004RQe8P cdofmsp.exe – Registry – HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce No Items Found – Start Menu - Current User – spamsubtract.lnk – Start Menu - All Users – HP Digital Imaging Monitor.lnk QuickBooks Update Agent.lnk Quicken Scheduled Updates.lnk – Disabled Items – AGRSMMSG ALCXMNTR hphmon05 hphupd05 hpsysdrv NAV CfgWiz ps2 RECGUARD Reminder jusched shwicon2k TkBellExe sgtray VTTimer – Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon – Explorer.exe – Running Processes – System Idle Process System smss.exe \SystemRoot\System32\smss.exe csrss.exe winlogon.exe winlogon.exe services.exe C:\WINDOWS\system32\services.exe lsass.exe C:\WINDOWS\system32\lsass.exe svchost.exe C:\WINDOWS\system32\svchost -k rpcss svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe CCSETMGR.EXE "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" CCEVTMGR.EXE "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" explorer.exe C:\WINDOWS\Explorer.EXE spoolsv.exe C:\WINDOWS\system32\spoolsv.exe NAVAPSVC.EXE "c:\Program Files\Norton AntiVirus\navapsvc.exe" SAVSCAN.EXE "c:\Program Files\Norton AntiVirus\SAVScan.exe" CCAPP.EXE "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" realsched.exe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot svchost.exe hpztsb08.exe "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" hrtcm.exe "C:\WINDOWS\hrtcm.exe" 9fI.exe "C:\documents and settings\owner\local settings\temp\9fI.exe" mmtask.exe "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" 80aZ.exe "C:\documents and settings\owner\local settings\temp\80aZ.exe" qttask.exe "C:\Program Files\QuickTime\qttask.exe" -atboottime cdofmsp.exe "C:\WINDOWS\System32\cdofmsp.exe" hpqtra08.exe "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" rnathchk.exe "C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe" qbupdate.exe "C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe" wuauclt.exe "C:\WINDOWS\System32\wuauclt.exe" IEXPLORE.EXE "C:\Program Files\Internet Explorer\iexplore.exe" cmd.exe cmd /c ""C:\FINDnFIX\!LOG!.BAT" " ntvdm.exe "C:\WINDOWS\system32\ntvdm.exe" -f StartupTracker3.exe "C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 1 for StartupTracker3[1].zip\StartupTracker3.exe" wmiprvse.exe – Running Services – Name: AudioSrv Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: BITS Description: Uses idle network bandwidth to transfer data. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: ccEvtMgr Description: Symantec Event Manager Startup Mode: Auto Run from: "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" Name: ccSetMgr Description: Symantec Settings Manager Startup Mode: Auto Run from: "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" Name: CryptSvc Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Auto Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs Name: Dhcp Description: Manages network configuration by registering and updating IP addresses and DNS names. Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: Dnscache Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService Name: Eventlog Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Startup Mode: Auto Run from: C:\WINDOWS\system32\services.exe Name: EventSystem Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: FastUserSwitchingCompatibility Description: Provides management for applications that require assistance in a multiple user environment. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: lanmanworkstation Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: navapsvc Description: Handles Norton AntiVirus Auto-Protect events. Startup Mode: Auto Run from: "c:\Program Files\Norton AntiVirus\navapsvc.exe" Name: Netman Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: Nla Description: Collects and stores network configuration and location information, and notifies applications when this information changes. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: PlugPlay Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. Startup Mode: Auto Run from: C:\WINDOWS\system32\services.exe Name: ProtectedStorage Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. Startup Mode: Auto Run from: C:\WINDOWS\system32\lsass.exe Name: RasMan Description: Creates a network connection. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: RpcSs Description: Provides the endpoint mapper and other miscellaneous RPC services. Startup Mode: Auto Run from: C:\WINDOWS\system32\svchost -k rpcss Name: SamSs Description: Stores security information for local user accounts. Startup Mode: Auto Run from: C:\WINDOWS\system32\lsass.exe Name: SAVScan Description: Handles Norton AntiVirus Auto-Protect Archive Scanning Startup Mode: Auto Run from: c:\Program Files\Norton AntiVirus\SAVScan.exe Name: Schedule Description: Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: SENS Description: Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. Startup Mode: Auto Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs Name: ShellHWDetection Description: Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: Spooler Description: Loads files to memory for later printing. Startup Mode: Auto Run from: C:\WINDOWS\system32\spoolsv.exe Name: srservice Description: Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: SSDPSRV Description: Enables discovery of UPnP devices on your home network. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k LocalService Name: TapiSrv Description: Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: TermService Description: Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. Startup Mode: Manual Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: Themes Description: Provides user experience theme management. Startup Mode: Auto Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs Name: winmgmt Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Startup Mode: Auto Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs Name: wuauserv Description: Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site. Startup Mode: Auto Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs And here is the FindNFix log: »»»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q330994-Q824145-Q828750-Q832894-Q837009-Q831167-Q823353 The type of the file system is NTFS. C: is not dirty. Sat 31 Jul 04 14:22:53 2:22pm up 0 days, 4:59 »»»»»»'Dos devices'… Location Type Name/Units Attributes ====================================================== XXXX:XXXX CHAR NUL 1000000000000100 02E6:0000 CHAR XMSXXXX0 1010000000000000 0070:0024 CHAR CON 1000000000010011 0070:0036 CHAR AUX 1000000000000000 0070:0048 CHAR PRN 1010100011000000 0070:005A CHAR CLOCK$ 1000000000001000 0070:006C CHAR COM1 1000000000000000 0070:007E CHAR LPT1 1010100011000000 0070:0090 CHAR LPT2 1010100011000000 0070:00A2 CHAR LPT3 1010100011000000 0070:00B4 CHAR COM2 1000000000000000 0070:00C6 CHAR COM3 1000000000000000 0070:00D8 CHAR COM4 1000000000000000 ====================================================== »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder »»»»»»»»»»»»»»»»»»***LOG!***(*updated 7/30)»»»»»»»»»»»»»»»» »»»*»»»*Use at your own risk!»»»*»»»* Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\WDMEO.DLL +++ File read error \\?\C:\WINDOWS\System32\WDMEO.DLL +++ File read error »»»»» (*2*) »»»»»…….. WDMEO.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ wdmeo.dll Thu Jun 17 2004 7:48:54a A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\WDMEO.DLL SNiF 1.34 statistics Matching files : 1 Amount in bytes : 57344 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» ¯ Access denied ® ………………… WDMEO.DLL …..57344 17.06.2004 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\WDMEO.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… C:\WINDOWS\SYSTEM32\ wdmeo.dll Thu Jun 17 2004 7:48:54a A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\WDMEO.DLL SNiF 1.34 statistics Matching files : 1 Amount in bytes : 57344 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group BEN2\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created…»»»»»» 2:23pm up 0 days, 5:00 Sat 31 Jul 04 14:23:45 A C:\FINDnFIX\keyback.hiv –a– - - - - - 8,192 07-27-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-27-2004 winkey.reg *Temp backups… . .. keyback2.hi_ winkey2.re_ C:\FINDNFIX\ JUNKXXX Tue Jul 27 2004 7:54:54p .D… 1 item found: 0 files, 1 directory. »»Performing string scan…. 00001150: vk < f AppInit_DLLs G 00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ w d m e o . d l l 000011D0: h vk UDeviceNotSelectedTimeout 1 5 00001210: ( 9 0 =t vk ' zGDIProcessHandle 00001250:Quota" vk x Spooler2 y e s _ h 00001290: ( X vk 5swapdisk vk 000012D0: . TransmissionRetryTimeout h ( X 00001310: vk ' R USERProcessHandleQuota2 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT fùAppInit_DLLs֍æGÀÿÿÿC ————– ————– $01180: AppInit_DLLs $011EF: UDeviceNotSelectedTimeout $0123F: zGDIProcessHandleQuota $012D8: TransmissionRetryTimeout $01328: USERProcessHandleQuota2 ————– ————– C:\WINDOWS\System32\wdmeo.dll ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 60 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINDOWS\System32\wdmeo.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O. 0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e. 0020 6d 00 33 00 32 00 5c 00 77 00 64 00 6d 00 65 00 | m.3.2.\.w.d.m.e. 0030 6f 00 2e 00 64 00 6c 00 6c 00 00 00 | o…d.l.l… ———— Dos mem debug… Segment Size Owner Type Vectors ======================================================= 0216 021E0 IO SYSTEM DATA 0435 00A20 COMMAND PROGRAM 22 23 24 2E D3 04D8 00070 MSDOS FREE 04E0 00420 COMMAND ENVIRONMENT 0523 00350 MSDOS FREE 0559 00840 LMEM PROGRAM 05DE 9A210 MSDOS FREE =======================================================  I hope this gets us somewhere! Can't say enough thanks for the effort so far. Ben

Create a new folder called C:\HijackThis, move the HijackThis.exe file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - URLSearchHook: (no name) - _{4FC95EDD-4796-4966-9049-29649C80111D} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll (file missing)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {583767D9-7890-42C1-9A67-0CFF7AAA01FB} - C:\WINDOWS\System32\beco.dll (file missing)
O2 - BHO: (no name) - {8403CB53-12B3-4537-9DEC-4F12F70A883D} - C:\WINDOWS\System32\anti-pp.dll
O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Program Files\Common Files\midaddle\midaddle.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O4 - HKLM\..\Run: [hrtcm] C:\WINDOWS\hrtcm.exe
O4 - HKLM\..\Run: [9fI] C:\documents and settings\owner\local settings\temp\9fI.exe
O4 - HKLM\..\Run: [Prein] C:\DOCUME~1\Owner\LOCALS~1\Temp\app97.tmp
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Dyf0o5.exe
O4 - HKLM\..\Run: [80aZ] C:\documents and settings\owner\local settings\temp\80aZ.exe
O4 - HKLM\..\Run: [t3rQ34S] sccrator.exe
O4 - HKCU\..\Run: [c004RQe8P] scldefui.exe
O18 - Filter: text/html - {EE7A946E-61FA-4979-87B8-A6C462E6FA62} - C:\WINDOWS\digfilt.dll

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\hrtcm.exe
C:\documents and settings\owner\local settings\temp\9fI.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\app97.tmp
C:\documents and settings\owner\local settings\temp\80aZ.exe
C:\WINDOWS\System32\sccrator.exe
C:\WINDOWS\System32\scldefui.exe

Reboot when done. Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Then disable Norton. Open FindnFix again. In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the WDMEO.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply. Also post a new HJT log.

Looking better. Delete the entire FindnFix folder.

Click here to download TheKillbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\WINDOWS\System32\vga71.exe

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The C:\WINDOWS\System32\vga71.exe listing should show up in the window. Then repeat the process, this time adding:

C:\WINDOWS\System32\mmfshell.exe

If that's successful you should have the two files listed. Then repeat so that all these files appear in the list as well:

C:\documents and settings\owner\local settings\temp\cqr87sFDm.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Documents and Settings\Owner\Local Settings\Temp\bGQ1P18Fe.dll

When they are all there, in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

With only HijackThis running, scan and when complete, remove the following entries (if still there) by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\SysAI\AproposPlugin.dll (file missing)
O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Owner\Local Settings\Temp\bGQ1P18Fe.dll
O2 - BHO: (no name) - {EE7B14C2-02BA-422D-8001-89EED4EF2140} - C:\WINDOWS\System32\gbjmi.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [t3rQ34S] mmfshell.exe
O4 - HKLM\..\Run: [cqr87sFDm] C:\documents and settings\owner\local settings\temp\cqr87sFDm.exe
O4 - HKCU\..\Run: [c004RQe8P] vga71.exe

Reboot when done. Rescan with HJT and post a new log.

That's a clean log - how is it running now?

so far, so good! Point me towards your piggy bank so I canmake a donation! Thanks SOO much! -Ben

You're welcome - glad to help (there's a link at the top of the page to support the site)

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.