Okay. The value field has:
C:\WINDOWS\System32\kbdlek.dll
I noticed in the original first time you asked me to run this step, you also asked me to run the restore file and post the log. Let me know if I need to do this again. Thanks for your help with this.
Since 8 days have passed since my last post, I just thought I'd check to see if my thread has been forgotten. Or maybe you're simply backlogged with a lot of users….
I am a bit surprised why two different approaches won't reveal that file.
Let's get the HJT update and post a new log. Click here to download the latest version of HijackThis. Doubleclick the file, click Unzip and it will save the application to C:\HijackThis. Run it from there to scan your computer and post a new log here.
Reboot when done. Open System Security Suite and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.
Okay, I've done what you said. For awhile I was okay, but my symptoms have returned, and in fact, not only is my home page forced to about:blank, but when I try to go to certain websites, I'm also force into about:blank, rendering me unable to visit certain websites. Here's my new log:
Logfile of HijackThis v1.98.2
Scan saved at 8:42:51 AM, on 8/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {0611DD1A-1E99-453D-9D7D-CA74173C39D5} - C:\WINDOWS\System32\ihfbb.dll
O2 - BHO: cardovne - {1D1BEDD0-507F-525A-E711-6D282F4AE07F} - C:\WINDOWS\System32\cardovne.dll
O2 - BHO: (no name) - {3BDA4378-E949-75BB-D705-155579AA2812} - C:\WINDOWS\System32\jdj.dll
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = E:\Apps\MSOffice\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\Apps\OfficeXP\Office10\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = aus.madisonlife.com
O17 - HKLM\Software\..\Telephony: DomainName = aus.madisonlife.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = aus.madisonlife.com
O18 - Filter: text/html - {C1ED6B00-BFD1-4194-8B48-896FAA922A84} - C:\WINDOWS\System32\ihfbb.dll
O18 - Filter: text/plain - {C1ED6B00-BFD1-4194-8B48-896FAA922A84} - C:\WINDOWS\System32\ihfbb.dll
DoubleClick "Appinit_Dlls" value on right pane and erase the data in the 'Value' box at the the bottom of the new pane. The data to remove will be:
"C:\WINDOWS\System32\KBDLEK.DLL", hit 'Apply' and 'Ok' to set.
Rename 'NotWindows' back to 'Windows' in the left pane, close Registrar Lite and reboot the computer. If all goes well the hidden process will not run at startup and you should now be able to find and *see* the KBDLEK.DLL in C:\WINDOWS\System32.
If you still can't see it reboot into Safe Mode as Administartor and have another look. Let me know.
We have to remove this to end your hijack problem.
Click on the Windows key to highlight it, and use the top menu File>Export and save as (in the C:\Hijack\Backups folder):
1.) Winkey.reg
2.) Winkey.hiv
What software am I using when I click File>Export? By Windows key, I'm assuming you mean the key near my spacebar that has a picture of the Windows logo on it.
The way this particular hijack works is that it puts a hidden file in the AppInit_dlls, we know what it is now but we have to make it stick it's head up so that we can blow it off!
Have a read through my post above. Let me know if you created those files.
Okay, I created those two files the first time you instructed me, so I infer from your last post that I don't need to recreate them, and that I can continue with your instructions involving revealing the bad DLL. I did so, running registrar lite and did everything you said. I rebooted, but still can't see the file. I even went into safe mode as Administrator, and still couldn't see it.
The way I'm looking for it is by running Windows Explorer, and navigating to the folder, and looking for it. I see from my folder options that hidden files are to be shown. I even tried telling it to show system files and folders, and this didn't reveal it either.
Am I using the correct method of looking to see of KBDLEK.DLL is visible?
Okay, I followed the automatic removal instructions, and it said it did find and remove a trojan. Then I rebooted and ran registrar lite, and the following is the value found under AppInit_dlls:
C:\WINDOWS\System32\kbdlek.dll