My Log File... Thanks!

Click here to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and post here the information in the 'Value' field.

Click here or here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Sorry it took me so long to post me results, if anyone thought slavery ended last century, they were wrong!!! they make work 2 weekend on a row in my job!!! OK, thanks FORUM GOD, hope I can get rid of this about:blank thing! Value: C:\WINDOWS\System32\logpppc.dll FINDnFIX log: »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» –The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder and is the destination for the file to be moved.. -*Previous directions will no longer work… »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2600.0000 Q328676-Q323759-Q324929-Q813489-Q818529-Q822925-Q832894-Q837009 The type of the file system is FAT32. C: is not dirty. Fri 07/16/2004 7:37pm up 0 days, 0:35 »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» *For *Helpers/Mods and/or users that are not familiar with any of the items on the scan results- I recommend using an alternative, once you know what to look for! »»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/12)»»»»»»»»»»»»»»»» »»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»* Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\LOGPPPC.DLL +++ File read error \\?\C:\WINDOWS\System32\LOGPPPC.DLL +++ File read error »»»»» (*2*) »»»»»…….. **File C:\FINDnFIX\LIST.TXT LOGPPPC.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ logpppc.dll Wed Apr 21 2004 7:52:56p ….R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\LOGPPPC.DLL »»»»»(*5*)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT ¯ Access denied ® ………………… LOGPPPC.DLL …..57344 21.04.2004 »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… C:\WINDOWS\SYSTEM32\ logpppc.dll Wed Apr 21 2004 7:52:56p ….R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\LOGPPPC.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group ANDRES-9AQSKR5X\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created…»»»»»» 7:39pm up 0 days, 0:36 Fri 07/16/2004 A C:\FINDnFIX\keyback.hiv –a– - - - - - 8,192 07-16-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-16-2004 winkey.reg C:\FINDNFIX\ JUNKXXX Fri Jul 16 2004 7:37:16p .D… 1 item found: 0 files, 1 directory. »»Performing string scan…. 00001150: ? 00001190: y vk @ f AppInit_ 000011D0:DLLs G C : \ W I N D O W S \ S y s t e m 3 2 \ l o g p p p 00001210:c . d l l r o vk X UDeviceNotSelecte 00001250:dTimeout 1 5 ( W 9 0 ! vk ' z 00001290:GDIProcessHandleQuota" vk Spooler2 y e 000012D0:s ( x vk =pswapdisk 00001310: vk h R TransmissionRetryTimeout ( x 00001350: ` vk ' USERProcessHandleQuota 00001390:p 9E 9E u@9E u;9E u6h zx u x u u F8 000013D0: x E F< 9E h zx u x E u u 00001410: x M E k 3 E E E E Ph 00001450:zx SW E Ph zx SW E Phpzx SW 00001490: E Phhzx S u W x 9E u(9E u#9E u E F8 E F< E 000014D0: F@ E 9E E M M M ( h fx 00001510:P x 9E u F E Ph`zx S u W W E 00001550: Ph zx S u W 7 E Ph zx S u W E 00001590: Ph zx S u W  E hXzx P x u F 000015D0: hTzx P x u F f 8 u F A ———- WIN.TXT fùAppInit_DLLs֍æG¸ÿÿÿC ————– ————– C:\WINDOWS\System32\logpppc.dll ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 64 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINDOWS\System32\logpppc.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O. 0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e. 0020 6d 00 33 00 32 00 5c 00 6c 00 6f 00 67 00 70 00 | m.3.2.\.l.o.g.p. 0030 70 00 70 00 63 00 2e 00 64 00 6c 00 6c 00 00 00 | p.p.c…d.l.l… 

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the LOGPPPC.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

Ok, here it goes: »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» Tue 07/20/2004 7:06pm up 0 days, 0:04 Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2600.0000 Q328676-Q323759-Q324929-Q813489-Q818529-Q822925-Q832894-Q837009 The type of the file system is FAT32. C: is not dirty. »»»»»»»»»»»»»»»»»»***LOG2!***»»»»»»»»»»»»»»»» This log will confirm if the file was successfully moved, and/or the right file was selected. Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» »»»»»»» (2) »»»»»»» **File C:\FINDnFIX\LIST.TXT »»»»»»» (3) »»»»»»» No matches found. Unknown/hidden files… No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»»»(5)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT »»»»»»» Search by size… No matches found. No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»*»»» Scanning for moved file… »»»*»»» * result\\?\C:\FINDnFIX\junkxxx\LOGPPPC.222 C:\FINDNFIX\JUNKXXX\ logpppc.222 Wed Apr 21 2004 7:52:56p A…. 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\FINDNFIX\JUNKXXX\LOGPPPC.222 **File C:\FINDNFIX\JUNKXXX\LOGPPPC.222 0000DEBE: 67 44 65 76 69 63 65 00 . 00 53 74 72 65 61 6D 69 gDevice. .Streami 0000DED3: 63 65 53 65 74 75 70 00 . 32 00 00 00 00 00 E0 01 ceSetup. 2…..à. A—– LOGPPPC .222 0000E000 19:52.56 21/04/2004 –a– W32i - - - - 57,344 04-21-2004 logpppc.222 A C:\FINDnFIX\junkxxx\logpppc.222 CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock. MD5 Message Digest Algorithm by RSA Data Security, Inc. File name Size Date Time MD5 Hash ________________________________________________________________________ LOGPPPC.222 57344 04-21-104 19:52 c185b36f9969d3a6d2122ba7cbc02249File: CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 »»Permissions: C:\FINDnFIX\junkxxx\logpppc.222 No permissions are set. All user have full control. Directory "C:\FINDnFIX\junkxxx\." Permissions: NA Auditing: NA Owner: \Everyone Primary Group: \Everyone Directory "C:\FINDnFIX\junkxxx\.." Permissions: NA Auditing: NA Owner: \Everyone Primary Group: \Everyone File "C:\FINDnFIX\junkxxx\logpppc.222" Permissions: NA Auditing: NA Owner: \Everyone Primary Group: \Everyone This file system is FAT32, it does not enforce ACLs ! »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM 00001150: ? 00001190: vk UDeviceNo 000011D0:tSelectedTimeout 1 5 ( W vk ' z 00001210:GDIProcessHandleQuota" 9 0 ! vk X 00001250:Spooler2 y e s vk =pswapdisk 00001290: 8 h vk ( R TransmissionRetryTimeout 000012D0: vk ' USERProcessHandleQuota 8 00001310:h vk f AppInit_DLLs G 00001350: P . / H 0 @ 1 @ 2 $ 00001390:3 4 4 D 5 t P 6 P 7 8 000013D0: 9 : $ ; 4 < D = T 00001410: > d ? t @ A B 00001450:C $ D 4 E D F T G d H 00001490: t I J K M 000014D0: N O P @ Q R P 00001510:S X T $ P U 4 H V D @ W T P X 00001550: ———- NEWWIN.TXT fùAppInit_DLLs֍æG¸ ————– ————– ————– ARDDISKVOLUME1\WINDOWS\SYSTEM32\CRYPT32.DLL \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\MSASN1.DLL \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\WTSAPI32.DLL \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\WINSTA. \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\NTDLL.DLL \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\KERNEL32.DLL \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\UNICODE.NLS \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\LOCALE.NLS \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SORTTBLS.NLS \DEVICE\HARDDISKVOLUME1\FINDNFIX\FILES2\XCACLS.EXE \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\ADVAPI32.DLL \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\RPCRT4.DLL \DEVICE\HARDDISKVOLUME1 ——– C:\FINDNFIX\JUNKXXX\LOGPPPC.222 InstallStreamingDeviceStreamingDeviceSetupStreamingDeviceSetup2 =============================================================================== 57,344 bytes 819,200 cps Files: 1 Records: 13,139 Matches: 3 Elapsed Time: 00:00:00.07 

Nearly there, open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

Looks OK now, couple of fragments - with only HJT running have it fix:

O2 - BHO: (no name) - {566FF026-2D78-4ADF-BC1C-778F5A547236} - (no file)
O2 - BHO: (no name) - {7ED91ACB-AFB7-4765-BA10-EBD937BB5013} - (no file)

Reboot when done and you should be good to go. How is it running now?

Untill now is running fine!! I try so many things for so much time that only worked for a couple of days that I'm still skeptical… Thanks a lot for your help!!!! Andy.

You're welcome - glad to help You'll be OK now.

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.