Browser Hijack

Dear Lappen, File is called res.dll, see below: Window Procedure Res.dll RUNDLL32.EXE C:\WINDOWS\SYSTEM\Res.dll C:\WINDOWS\RUNDLL32.EXE Log of StartDreck as a result of your suggested configuration herebelow: StartDreck (build 2.1.7 public stable) - 2004-08-17 @ 22:51:41 (GMT +02:00) Platform: Windows 98 (Win 4.10.1998 ) Internet Explorer: 6.0.2800.1106 Logged in as vppons at DELL »Registry »Run Keys »Current User »Run *MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background »RunOnce »Default User »Run *MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background »RunOnce »Local Machine »Run *ScanRegistry=c:\windows\scanregw.exe /autorun *TaskMonitor=c:\windows\taskmon.exe *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *LoadQM=loadqm.exe *HPDJ Taskbar Utility=C:\WINDOWS\SYSTEM\hpztsb04.exe *TkBellExe=C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot *EM_EXEC=C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE *SystemTray=SysTray.Exe *StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE +OptionalComponents +IMAIL *Installed=1 +MAPI *NoChange=1 *Installed=1 +MAPI *NoChange=1 *Installed=1 »RunOnce »RunServices *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SchedulingAgent=mstask.exe »RunServicesOnce **lsk=rundll32 C:\WINDOWS\SYSTEM\RES.DLL,StreamingDeviceSetup »RunOnceEx »RunServicesOnceEx »Browser Helper Objects (LM) *AcroIEHelper.AcroIEHlprObj.1/{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} `InprocServer32=C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL *{81245C90-EF22-11D8-AFBC-0050DD7A9E60} `InprocServer32=C:\WINDOWS\SYSTEM\HDGKEME.DLL »Files »System/Drivers »Running Processes +FF8FC329=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFF8371=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFF8B69=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFFC7ED9=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFC5A69=C:\TELES\TISDNMON.EXE +FFFCAF7D=C:\WINDOWS\SYSTEM\MSTASK.EXE +FFFD3C55=C:\WINDOWS\RUNDLL32.EXE +FFFD0941=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFDD315=C:\WINDOWS\EXPLORER.EXE +FFF24D59=C:\TELES\CWD.EXE +FFF2B7E1=C:\WINDOWS\TASKMON.EXE +FFF36345=C:\WINDOWS\LOADQM.EXE +FFF36D71=C:\WINDOWS\SYSTEM\HPZTSB04.EXE +FFF3DE85=C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE +FFF3D1A1=C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE +FFF02975=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFF0269D=C:\WINDOWS\SYSTEM\STIMON.EXE +FFF1C799=C:\PROGRAM FILES\MESSENGER\MSMSGS.EXE +FFF3AF71=C:\PROGRAM FILES\MSOFFICE\OFFICE\OSA.EXE +FFF38DC1=C:\WINDOWS\SYSTEM\DDHELP.EXE +FFF6F9C9=C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE +FFF75A71=C:\MY DOWNLOAD FILES\STARTDRECK\STARTDRECK.EXE »Application specific I have taken the liberty to also paste in the logfile according to the standard configuration of StartDreck, as I saw some suspect (to me as a layman at least) lines disabling something of Spybot, and defining "no home" with Int. Explorer. StartDreck (build 2.1.7 public stable) - 2004-08-17 @ 22:56:46 (GMT +02:00) Platform: Windows 98 (Win 4.10.1998 ) Internet Explorer: 6.0.2800.1106 Logged in as vppons at DELL »Registry »Run Keys »Current User »Run *MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background »RunOnce »Default User »Run *MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background »RunOnce »Local Machine »Run *ScanRegistry=c:\windows\scanregw.exe /autorun *TaskMonitor=c:\windows\taskmon.exe *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *LoadQM=loadqm.exe *HPDJ Taskbar Utility=C:\WINDOWS\SYSTEM\hpztsb04.exe *TkBellExe=C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot *EM_EXEC=C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE *SystemTray=SysTray.Exe *StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE +OptionalComponents +IMAIL *Installed=1 +MAPI *NoChange=1 *Installed=1 +MAPI *NoChange=1 *Installed=1 »RunOnce »RunServices *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SchedulingAgent=mstask.exe »RunServicesOnce **lsk=rundll32 C:\WINDOWS\SYSTEM\RES.DLL,StreamingDeviceSetup »RunOnceEx »RunServicesOnceEx »File Associations (CR) +.bat *batfile="%1" %* +.com *comfile="%1" %* +.disabled *SpybotSD.DisabledFile="C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\blindman.exe" "%1" +.exe *exefile="%1" %* +.hta *htafile=C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %* +.htm *htmlfile="C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome +.html *htmlfile="C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome +.js *JSFile=c:\windows\WScript.exe "%1" %* +.jse *JSEFile=c:\windows\WScript.exe "%1" %* +.pif *piffile="%1" %* +.reg *regfile=regedit.exe "%1" +.scr *scrfile="%1" /S +.txt *txtfile=c:\windows\NOTEPAD.EXE %1 +.vbs *VBSFile=c:\windows\WScript.exe "%1" %* +.vbe *VBEFile=c:\windows\WScript.exe "%1" %* +.wsh *WSHFile=c:\windows\WScript.exe "%1" %* +.wsf *WSFFile=c:\windows\WScript.exe "%1" %* +.lnk `lnkfile= [key or value does not exist] »Browser Helper Objects (LM) *AcroIEHelper.AcroIEHlprObj.1/{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} `InprocServer32=C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL *{81245C90-EF22-11D8-AFBC-0050DD7A9E60} `InprocServer32=C:\WINDOWS\SYSTEM\HDGKEME.DLL »Files »Autostart Folders »Current User *C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk »Default User *C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk »Local Machine »INI-Files »WIN.INI\[windows] *LOAD= *RUN=C:\DELL\WINBATCH.EXE »SYSTEM.INI\[boot] *SHELL=Explorer.exe »Text Files *C:\WINDOWS\msdos.sys *C:\msdos.sys *C:\config.sys *C:\autoexec.bat *C:\WINDOWS\wininit.bak *C:\WINDOWS\winstart.bat *C:\WINDOWS\dosstart.bat *C:\WINDOWS\hosts »System/Drivers »Running Processes +FF8FC329=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFF8371=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFF8B69=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFFC7ED9=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFC5A69=C:\TELES\TISDNMON.EXE +FFFCAF7D=C:\WINDOWS\SYSTEM\MSTASK.EXE +FFFD3C55=C:\WINDOWS\RUNDLL32.EXE +FFFD0941=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFDD315=C:\WINDOWS\EXPLORER.EXE +FFF24D59=C:\TELES\CWD.EXE +FFF2B7E1=C:\WINDOWS\TASKMON.EXE +FFF36345=C:\WINDOWS\LOADQM.EXE +FFF36D71=C:\WINDOWS\SYSTEM\HPZTSB04.EXE +FFF3DE85=C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE +FFF3D1A1=C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE +FFF02975=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFF0269D=C:\WINDOWS\SYSTEM\STIMON.EXE +FFF1C799=C:\PROGRAM FILES\MESSENGER\MSMSGS.EXE +FFF3AF71=C:\PROGRAM FILES\MSOFFICE\OFFICE\OSA.EXE +FFF38DC1=C:\WINDOWS\SYSTEM\DDHELP.EXE +FFF6F9C9=C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE +FFF7F0A5=C:\MY DOWNLOAD FILES\STARTDRECK\STARTDRECK.EXE »NT Services »Application specific I have also downloaded Win98Fix.zip and extracted it to a separate directory, but thus far I have not run the application. From the StartDreck log (link to res.dll, disabling and file association features) I have the feeling we are getting to the bottom of this now, correct? Anxiously waiting for your next instructions. Cheers,

Yes I'm hoping that we are closing in on this… -DoubleClick on: 'RunFix.reg' file in the folder Win98Fix, hit 'yes' on the prompt! -Restart computer! -File (res.dll) should be visible! -Do 'find files' for res.dll -delete the file res.dll After that run cwshredder and ad-aware Reboot Post a new HJT log

Dear Lappen,

Good news, after having followed your instructions, after rebooting , the system again requested to install the Messenger update, and after confirming the system indeed accepted the update. Haven't done anything else yet (like trying to install my McAfee Internet Security Suite).

Great! let's try to get the rest of the stuff from your log before doing any more instals

Fix these 3 lines with HJT

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O18 - Protocol: wavetop - (no CLSID) - (no file)

Reboot, use the internet with Internet Explorer for a while, Reboot again and post a new LOG, DO NOT use ad-aware or spybot again I want to see if your log changes from the one above

Looks good but one line still remains… Boot to safe mode and delete this line with HJT O18 - Protocol: wavetop - (no CLSID) - (no file) Reboot back to normal mode and run another HJT log and post i here. If that doesnt work I will ask someone else to look in to this

Dear Lappen, Bad news, I still do not manage to boot to safe mode. Screen turns blue with safe mode text on each angle, but then freezes, no start menu, no icons. Only possibility to reboot with ctrl-alt-del. Hence no possibility to follow instructions. Evidently system not yet fully fixed. Hope to hear soonest how to proceed. Regards, vppons

Ok I will ask someone lese to take a look at this

I have asked one of my fellow helpers to look in to this, I hope that they will post back tomorrow

Hi guys

This won't resolve the blue screen issue but should get rid of the O18 entry.

Click here to download wavefix.zip. Extract wavefix.reg from the zip file and save it to the desktop. When done, double click the wavefix.reg when asked to merge say yes.

Reboot and post a new HJT log when done.

Daemon, Lappen, One more question: should I by now try to install my McAfee Internet Security Suite in order to minimise the chance of any more misery, or would this hamper your efforts to repair my system? Cheers, vppons

Quite possibly. It's not actually harming you but it's irritating when it sticks in your log.

I need to modify the regfix. Please go to http://www.billsway.com/vbspage/ and scroll down to Registry Search Tool. Download, unzip and run RegSrch.vbs (you may need to enable your antivirus program to run the file).

Copy and paste this in the dialog box: wavetop

After a while a prompt will come up. Click OK to write the results to wordpad and post them.

Daemon, There you go: REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "wavetop" 21-08-04 14:20:45 ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wavetop] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SETUP\OptionalComponents] "WaveTop"="WaveTop" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SETUP\OptionalComponents\WaveTop] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SETUP\OptionalComponents\WaveTop] "INF"="WaveTop.inf" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SETUP\OptionalComponents\WaveTop] "Section"="WaveTop.Install" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\WaveTopPerUser] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\WaveTopPerUser] @="Windows Setup - WaveTop" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\WaveTopPerUser] "StubPath"="rundll.exe c:\\windows\\SYSTEM\\setupx.dll,InstallHinfSection WaveTopPerUserInstall 64 c:\\windows\\INF\\wavetop.inf" [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\HTT] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\Logit] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\Launcher] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\WaveProt] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\CacheManager] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\UnPacker] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\WaveUM] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop\CurrentVersion\WaveUM\Tasks] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver\TNLAUNCHER] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver\TNSystray] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver\TNRE] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver\TNRE\DCD_0] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver\TNM] [HKEY_LOCAL_MACHINE\SOFTWARE\WavePhore\WaveTop Receiver\TNCLIENT] [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\MEDIA\0020] "DriverDesc"="WaveTop ™ NABTS/CC VBI Codec" [HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\DeviceClasses\{07dad660-22f1-11d1-a9f4-00c04fbbde8f}\##.#0000000000000008#{07dad660-22f1-11d1-a9f4-00c04fbbde8f}\#GLOBAL\Device Parameters] "FriendlyName"="WaveTop ™ NABTS/CC VBI Codec" [HKEY_USERS\.Default\Software\Microsoft\Active Setup\Installed Components\WaveTopPerUser] [HKEY_USERS\.Default\Software\WavePhore\WaveTop] [HKEY_USERS\.Default\Software\WavePhore\WaveTop\CurrentVersion] [HKEY_USERS\.Default\Software\WavePhore\WaveTop\CurrentVersion\Options] I'll wait with installing McAfee, until we've fixed all problems. Cheers, vppons

Delete the wavefix files you downloaded earlier and click the link for the updated file. Follow the same procedure as before.

This will only target the O18 entry. It looks like that application left a lot of fragments behind - I'm reluctant to start removing those as I am not familiar with that program.

Post a new HJT log when done.

Have a look at this application - 30 day trial version:

http://www.macecraft.com/downloads/RegSupremePro_setup.exe