Searchx

Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

»»»»»»»»»»»»»»»»»»***LOG!***(*updated *8/22*)»»»»»»»»»»»»»»»» *System: Microsoft Windows 2000 Professional 5.0 (Build 2195) *IE version: 6.0.2800.1106 SP1-Q330994 The type of the file system is NTFS. __________________________________ !!*Creating backups…!! The operation completed successfully __________________________________ *Local time: Saturday, August 21, 2004 (8/21/2004) 4:19 PM, Central Daylight Time *Uptime: 16:19:02 up 0 days, 0:43:54 *Path: C:\FINDnFIX —————————————————- »»Member of…: ("ADMIN" logon + group match required!) User is a member of group ROCKANATOR1\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Group BUILTIN\Administrators matches list. Group BUILTIN\Users matches list. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User: [ROCKANATOR1\matt rock], is a member of: BUILTIN\Administrators \Everyone Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINNT Logon Domain is ROCKANATOR1 Administrator's Name is matt rock Computer Name is ROCKANATOR1 LOGON SERVER is \\ROCKANATOR1 »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. Ex: read only files, s/h files, last modified date. size, etc. The filters provided and registry scan should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder ______________________________________________________________________________ ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!*** ______________________________________________________________________________ ……Scanning for file(s)… *Note! The list(s) may include legitimate files! »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Read access error(s)… C:\WINNT\SYSTEM32\COMN.DLL +++ File read error \\?\C:\WINNT\System32\COMN.DLL +++ File read error »»»»» (*2*) »»»»»…….. COMN.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINNT\SYSTEM32\ comn.dll Tue Apr 20 2004 12:34:50a A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINNT\SYSTEM32\COMN.DLL SNiF 1.34 statistics Matching files : 1 Amount in bytes : 57344 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» ¯ Access denied ® ………………… COMN.DLL …..57344 20.04.2004 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINNT\SYSTEM32\COMN.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… *List of files and specs according to 'size' : *Note: Not all files listed here are infected, but *may include* the name and spces of the offending file… ___________________________________________________________________________ Path: C:\WINNT\SYSTEM32 Including: *.DLL 95. Comn Dll 57,344 . . R . A 4-20-04 12:34 am ____________________________________________________________________________ *By size and date… C:\WINNT\SYSTEM32\ comn.dll Tue Apr 20 2004 12:34:50a A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINNT\SYSTEM32\COMN.DLL SNiF 1.34 statistics Matching files : 1 Amount in bytes : 57344 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search… fgrep: can't open input C:\WINNT\SYSTEM32\COMN.DLL **File C:\WINNT\SYSTEM32\KHHK.DLL 00002004: A4 62 2A DF D5 7E 05 00 . 00 00 00 00 B6 31 03 80 ¤b*ßÕ~.. ….¶1.€ "C:\WINNT\system32\" khhk.dll Jul 20 2004 30720 "khhk.dll" 1 item found: 1 file, 0 directories. Total of file sizes: 30,720 bytes 30.00 K »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value does not match ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows). Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 27) »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Performing string scan…. 00001150: ? 00001190: "> : 8 @ 000011D0: vk 6 AppInit_DLLsP L C : \ W I N N T \ S 00001210:y s t e m 3 2 \ c o m n . d l l vk h C 00001250:DeviceNotSelectedTimeout 1 5 ` vk ' 00001290: v GDIProcessHandleQuota U vk I Spooler 000012D0: y e s e n vk T swapdisk vk 0 00001310: D TransmissionRetryTimeout 9 0 ` vk ' 00001350: P USERProcessHandleQuotaS xx x*2 0* d*zx * 00001390:N*2::&*d n* " : >*z0><:*~0> *8::> :2 * 0:80> * Z XL X 000013D0:D *zf d*f n*~ *< : " >*z0><:*~0> *8::> :2 * 0:80 00001410:> * Z XL X D * * * ~ | * *~ *lx * ~ x~ z0* <8 " 8 00001450:8>*z08 2*~0 * N Z ^B * ~Nx | F ~~ x0*nx | *d ~*l dn " 8 00001490:8>*z08 2*~0 * N Z ^B * d d f p Z ~bD "V DD^V ~ 8V 000014D0: d$nff 0*h n*z ~b0*V DD^V ~ 8V d$nff*"zx 0* 0VN d~ 00001510: * dn* ~~ d V ~~*x V zzf ~ d*N ~ V x$ r " 8 *z08 00001550:2*~0 * N Z ^B * ~Nx | F ~~ x0*nx | *d ~*l dn " 8 *z08 00001590:2*~0 * N Z ^B * d d f p Z ~bD "V DD^V ~ 8V d$nf 000015D0:f 0*h n*z ~b0*V DD^V ~ 8V d$nff*"zx 0* 0V ———- WIN.TXT AppInit_DLLsP ————– ————– $011E8: AppInit_DLLsP $01250: DeviceNotSelectedTimeout $01298: GDIProcessHandleQuota $01318: TransmissionRetryTimeout $01358: USERProcessHandleQuotaS ————– ————– C:\WINNT\System32\comn.dll ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 ………. *Debug… ————– ————– Ntdll.DLL at 77F80000 Kernel32.DLL at 77E80000 NtQueryInformationFile (Entry at 2AE6BA80) restored to 77F8B9A0 NtQuerySystemInformation (Entry at 2AE69267) restored to 77F95BBD LdrLoadDll (Entry at 2AE66F1F) restored to 77F8B7B3 LdrUnloadDll (Entry at 2AE66289) restored to 77F8F9D1 RtlQueryProcessDebugInformation (Entry at 2AE69966) restored to 77F9E6F3 ………. A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 54 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINNT\System32\comn.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 4e 00 54 00 | C.:.\.W.I.N.N.T. 0010 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 | \.S.y.s.t.e.m.3. 0020 32 00 5c 00 63 00 6f 00 6d 00 6e 00 2e 00 64 00 | 2.\.c.o.m.n…d. 0030 6c 00 6c 00 00 00 | l.l… ———————– »»»»»»Backups list…»»»»»» 16:19:38 up 0 days, 0:44:29 ———————– Sat 21 Aug 04 16:19:38 C:\FINDNFIX\ keyback.hiv Sat Aug 21 2004 4:19:00p A…. 8,192 8.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 8,192 bytes 8.00 K C:\FINDNFIX\KEYS1\ winkey.reg Sat Aug 21 2004 4:19:00p A…. 287 0.28 K 1 item found: 1 file, 0 directories. Total of file sizes: 287 bytes 0.28 K *Temp backups… "C:\Documents and Settings\matt rock\Local Settings\Temp\Backs2\" keyback2.hi_ Aug 21 2004 8192 "keyback2.hi_" winkey2.re_ Aug 21 2004 287 "winkey2.re_" 2 items found: 2 files, 0 directories. Total of file sizes: 8,479 bytes 8.28 K -D—- JUNKXXX 00000000 16:19.00 21/08/2004 A—– STARTIT .BAT 0000005F 16:19.00 21/08/2004 ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»» —–END—— Sat 21 Aug 04 16:19:39 

Completely disable any antivirus software you have running from this point on until we have finished.

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the COMN.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

Well done. Nearly there, open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

I am having a difficult time sending the email. It is bringing up my Outlook Express which i have never used before. It is asking for my outgoing mail server and incoming mail server. I tried to send it using my Yahoo account (my regular mail account), but it will not let me attach junkxxx.zip for some reason.

Don't worry about the email - continue with the rest of the fix.

Click here to download TheKillbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Paste Full Path of File to Delete' box, copy and paste the following, clicking 'Kill File' after pasting each one:

C:\WINNT\System32\msrexe.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\documents and settings\matt rock\local settings\temp\pLVIqfT.exe
C:\WINNT\System32\msprivs.exe
C:\Documents and Settings\matt rock\Application Data\susr.exe
C:\WINNT\System32\nflovbev.exe

Click 'Exit' when done.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

Open TheKillbox again, click File, Open!Submit and you will see a folder bearing the date that you used TheKillbox - zip it up and send to [removed] including a link to this thread in the body of the email.

Then create a new folder called C:\HijackThis, extract the HijackThis.exe file from the zip file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong. Make sure that you have no other browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [System Service] C:\WINNT\System32\msrexe.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [pLVIqfT] C:\documents and settings\matt rock\local settings\temp\pLVIqfT.exe
O4 - HKCU\..\Run: [msprivs] C:\WINNT\System32\msprivs.exe
O4 - HKCU\..\Run: [Ewoe] C:\Documents and Settings\matt rock\Application Data\susr.exe
O4 - HKCU\..\Run: [Lzyqby] C:\WINNT\System32\nflovbev.exe
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - ms-its:mhtml:file://c:\nosuch.mht!http://www.n28.net/n001/mt/mt.chm::/MediaTicketsInstaller.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} (EPlugin Control) - http://66.230.146.53/EPlugin_US.cab

Reboot, rescan with HJT and post a new log for a final check over.

Looks OK now. Click here to make sure that you have the latest Critical Update patches for Windows. It's very important to keep your system up to date to avoid unnecessary security risks.

How is it running now?

Seems to be running fine now, thanks for the help it is much appreciated. Whats with thte guidelines at the top, are you not supposed to be helping me?

You're welcome - glad to help Don't think that banner applies to me

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.