Logfile of HijackThis v1.98.0
side issue - are you ddeerrff from Dell Community Forums.
=============================
Could you please go to this site and run the online AV scan.
http://www.pandasoftware.es/activescan/activescan-com.asp
Some things to do before running.
Close all other windows - leave just the one internet explorer window in which this scan program will run.
=====================
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.
CWShredder available from :-
http://www.zerosrealm.com/downloads.php
http://www.aluriasoftware.com/tools/cwshredder.zip
Please run it in safe mode (F8 at boot/computer startup)
=====================
please post a new hijackthis log after a reboot.
First, the program you referred me to - - was not in english - - could not use. Second - - I could not get my computer to run in safe mode by keying F8 at boot up - - So what to do??? I do know that the trojan varient on my computer is a Coolwebsearch one called: CWS.Smartsearch.2 - - how can I get rid of this???
The pandasoftware website is normally in english - well it is for me when I access it.
Try this instead
1.Download the Hoster from here:
http://members.aol.com/toadbee/hoster.zip
2. Install the program and run it.
3. Press 'Restore Original Hosts' and press 'OK'
4. Exit Program.
Please post back with a new hijackthis log.
Logfile of HijackThis v1.97.7
The first hijackthis log that you posted was from version 1.98.0 the latest is from an older version.
Could you delete the older version and post a log from the latest version 1.98.0.
===================
http://downloads.subratam.org/FINDnFIX.exe
run that program… it installs a folder c:\findnfix go to this folder and in
it run the !log!.bat program…. will take 5 minutes, when done a log.txt
file is created in the same folder…. post the contents of that txt file
here and we will continue the fix.
=====================================
here is the new log from highjack:
here is the log from findnfix:
»»»»»»»»»»»»»»»»»»*** 100freeatlast.100free.com ***»»»»»»»»»»»»»»»»
–The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder
and is the destination for the file to be moved..
-*Previous directions will no longer work…
»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»
Microsoft Windows XP [Version 5.1.2600]
»»»IE build and last SP(s)
6.0.2800.1106 SP1-Q832894-Q330994-Q837009-Q831167-Q823353
The type of the file system is NTFS.
C: is not dirty.
Mon 19 Jul 04 10:41:56
10:41am up 3 days, 16:39
»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
You must know how to ID the file based on the filters provided in
the scan, as not all the files flagged are bad.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided should help narrow down the list, and hopefully
pinpoint the culprit.
Along with that,registry scan logged at the end should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
*For *Helpers/Mods and/or users that are not familiar with any of the
items on the scan results- I recommend using an alternative, once
you know what to look for!
»»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/19)»»»»»»»»»»»»»»»»
»»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»*
Scanning for file(s)…
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» ………
»»Locked or 'Suspect' file(s) found…
C:\WINDOWS\System32\WINAELJ.DLL +++ File read error
\\?\C:\WINDOWS\System32\WINAELJ.DLL +++ File read error
»»»»» (*2*) »»»»»……..
**File C:\FINDnFIX\LIST.TXT
WINAELJ.DLL Can't Open!
»»»»» (*3*) »»»»»……..
C:\WINDOWS\SYSTEM32\
winaelj.dll Wed Apr 28 2004 5:25:10p A…R 57,344 56.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57,344 bytes 56.00 K
unknown/hidden files…
No matches found.
»»»»» (*4*) »»»»»………
Sniffing……….
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\WINDOWS\SYSTEM32\WINAELJ.DLL
»»»»»(*5*)»»»»»
**File C:\WINDOWS\SYSTEM32\DLLXXX.TXT
¯ Access denied ® ………………… WINAELJ.DLL …..57344 28.04.2004
»»»»»(*6*)»»»»»
fgrep: can't open input C:\WINDOWS\SYSTEM32\WINAELJ.DLL
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size…
C:\WINDOWS\SYSTEM32\
winaelj.dll Wed Apr 28 2004 5:25:10p A…R 57,344 56.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57,344 bytes 56.00 K
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\WINDOWS\SYSTEM32\WINAELJ.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512…)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448
»»Dumping Values……..
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
»»Security settings for 'Windows' key:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
»»Member of…: (Admin logon required!)
User is a member of group DCKVY811\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
»»»»»»Backups created…»»»»»»
10:45am up 3 days, 16:42
Mon 19 Jul 04 10:45:26
A C:\FINDnFIX\keyback.hiv
–a– - - - - - 8,192 07-19-2004 keyback.hiv
A C:\FINDnFIX\keys1\winkey.reg
–a– - - - - - 287 07-19-2004 winkey.reg
*Temp backups…
.
..
keyback2.hi_
winkey2.re_
C:\FINDNFIX\
JUNKXXX Mon Jul 19 2004 10:41:54a .D…
1 item found: 0 files, 1 directory.
»»Performing string scan….
00001150: vk @ f AppInit_DLLs G
00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ w i n a e l j . d l
000011D0:l Dist h vk UDeviceNotSelectedTimeout
00001210: 1 5 P 9 0 vk ' zGDIProce
00001250:ssHandleQuota" vk Spooler2 y e s _
00001290: h 0 ` vk 5swapdisk vk
000012D0: . TransmissionRetryTimeout h 0 `
00001310: vk ' " USERProcessHandleQuota0
00001350:1Q4 ~ P4
00001390: ~ P4 $ ~
000013D0: O4 P ~ N4
00001410: | P N4 H
00001450: XK M4 p p VM4
00001490: zL4 ,
000014D0: -L4 X IK4
00001510: J4
00001550: 8 J4 ` I4
00001590: # 0$ H4
000015D0: 4 : H4 `
———- WIN.TXT
fùAppInit_DLLsÖæG¸ÿÿÿC
————–
————–
$01180: AppInit_DLLs
$011F7: UDeviceNotSelectedTimeout
$01247: zGDIProcessHandleQuota
$012E0: TransmissionRetryTimeout
$01330: USERProcessHandleQuota0
————–
————–
C:\WINDOWS\System32\winaelj.dll
————–
————–
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 64 bytes, including the 2 for string termination.
[AppInitDLLs]
Ansi string : "C:\WINDOWS\System32\winaelj.dll"
0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O.
0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e.
0020 6d 00 33 00 32 00 5c 00 77 00 69 00 6e 00 61 00 | m.3.2.\.w.i.n.a.
0030 65 00 6c 00 6a 00 2e 00 64 00 6c 00 6c 00 00 00 | e.l.j…d.l.l…
Logfile of HijackThis v1.97.7
Your hijcakthis is still not the latest version (1.98.0) - please delete these copies you have and download from here:-
http://www.downloads.subratam.org/hijackthis.zip
Sorry about this but the latest version shows lots more info for me to see what is wrong.
Unzip to the folder c:\hjt and do a new scan and log please.
Logfile of HijackThis v1.98.0
This will take couple or more steps to fix.
Be sure to Follow the next set of steps carefully, in
the exact order specified:
1.)
*Get ready to restart your computer.
- Open the FINDnFIX\Keys1\ Subfolder And
DoubleClick on the "FIX.bat" file.
-You will get a prompt preparing for auto-restart in 15 seconds.
-Let it restart!
————————————————————————–
2.)
On restart, Go to Start/Search, and find:
winaelj.dll (Should be in c:\windows\System32 folder)
-When found, select the "winaelj.dll" file And use the folder's top menu:
edit>……move to folder>… (From the search results)
Scroll and Select the following path as destination:
-> C:\ -> FINDnFIX… -> Click once to expand, and select the
->…junkxxx Subfolder as final destination, and move
the "winaelj.dll " into that Subfolder.(C:\FINDnFIX\junkxxx)
(you might get a prompt about 'read-only' file -Simply 'ok' it!)
————————————————————–
3.)
When done, Open the C:\FINDnFIX main folder and
Run the -> "RESTORE.bat" file ,
It will run and generate new log (log1.txt)
Post it here.
===================================================
*Note:
Do not change/move around or
tamper with any of the file(s) folder(s) and path
included in the 'FINDnFIX' folder
Post back with that log and a new hijackthis log please.
ChrisRLG: My problem has been solved - - I have already completed the process you are just beginning with me at Daemon's instruction to a separate topic I posted on my problem under a different heading. Thanks - - no more "about blank" - - derf
Glad it is solved.
Topic closed and moved to solved topics.