About Blank And Notepad

About a week ago I got the about blank virus It is the first virus I experienced I am new to this site and have run hijackthis I have noticed notepad.exe tends to close ALL BY ITSELF Would the virus close NOTEPAD in case people use NOTEPAD in combination with Hijackthis to solve problems. Is hijackthis a target for the virus? I still have the virus and I take little swipes at it with taskmgr to kill a process and uninstall some toolbars. I see the virus creating random .txt .dll files. I still need help. Thanks

I updated my Windows 2000 machine. All critical updates performed. virus is still present. I used CWShredder …. which (incorrectly) found no sign of Virus . Hijackthis shows the signs of infection. I see the newly created dlls with random names. (Searching for files created recently in the Windows Directory) I still need help thanks.

We need a Hijack This log file to be able to analyze what is happening on your computer. If you do not have a copy of Hijack This please follow the instructions in order: (if you have HJT version 1.98.2 please follow instructions 4 to 6)

First go to merijn.org choose 'Windows Files' from the menu on the left side of the page, when the page loads you will see a group of windows files for download, notepad being one of them. In XP notepad is in C:\Windows , as well as C:\Windows\System32 - I am not sure where it is in Win 2000 but would think it would be the same. Download the notepad file and extract it to both locations and then immediately run HJT to get a log. It will not last, as the infection will likely kill notepad again before your computer is clean but we can replace once you are clean. In the meantime you can use WordPad to copy any information you need.


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' and name the folder 'Hijack This'.

2. Download Hijackthis to the new folder from this website: http://www.downloads.subratam.org/hijackthis.zip

3. Double Click on 'HijackThis.zip' to extract and install HijackThis.exe to the new folder.

4. Close ALL windows except HJT

5. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

6. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

I am not surprised that you are infected with malware, spyware, virus and trojan as you are not running any Antivirus Software or a Firewall. These are essential for surfing the internet for security. You must replace notepad as it is infected with spyware and will not function until you replace it with a new copy. Please follow the instructions given above and replace your notepad file as you will need notepad to clean up your PC.

Step#1

You do not appear to have a firewall running and there are a few available for free that have excellent reputations:

Please download and install the following two free products to add some protection to your PC while we are cleaning it.

Zone ALarm Free Firewall

AVG Free AntiVirus


Step#2

Please download and open the following zip file. Double-click on the file inside the zip and when it asks you if you would like to merge the file into your registry, please answer yes. This will make sure all files are visible on your computer.
http://www.davehigham.zen.co.uk/downloads/xphidden.zip



Step#3

Now you need to download the following file from here and post the :

Getservice.zip

Extract the file to the c:\ drive. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up. Please paste the contents of that notepad as a reply to this post.



Step#4

You have one of the most severe types of infections we are seeing these days and it will take a bit of time to solve your problems. This infection continues to reinstall itself through a hidden dll in most cases which we have to find and remove. The following program will find the hidden dll if there is one.

1. Please download DllCompare
( The Screenshot will show you how the program will look when it starts.)

2. Start the Program with its default settings and put a check mark in the include subdirectories. Click the Run Locate.com and wait until the scan says complete.

3. Click the Compare button to start the next process.

4. Files in the upper portion have been verified to "exist", Files in the bottom section were not able to be accessed. Very few files should be listed in the bottom section when the Compare scan is complete.

5. Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan screenshot.

6. This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files) screenshot

7. Click the Make a Log of what was found button, and post the log here in this thread using Add Reply to receive further instructions.


Step#5

1. Please scan again with HijackThis reply back with

2. POST a new log file here in this thread using ADD REPLY


Please include in this post the log file from getservice, log file from dllcompare and the log file from HijackThis

I have guarded optimism … but I see NO direct signs of the problem Problem Appears Gone THANKS TO THIS WEBSITE TOMCOYOTE!! I received your email I read some other email here at TOMCOYOTE (I apologize if this complicates the picture) I followed various techniques listed HERE at TOMCOOTE and used SOME combination of the tools ( I did not audit myself) 1. Hijackthis 2. miniremoval_coolwebsearch_smartkiller.exe 3. CWShredder.exe Yet since I do not know what deleterious affects may STILL be present I followed more of your instructions +++++++++++++++++++++++++++++++++++++++++++++++++ Alarm Clock … The version you suggested and my copies were the same I compared with NT-Command Line Zone ALarm Free Firewall I had a successful installation with Zone Alart My slow replay was due to the fact that the email was sitting in my junk email. Even though the website warned me specify their email as good email. AVG Free AntiVirus My installation was

The correct spelling for the file in the previoius email in dialog box is D:\winnt\system32\autoexec.nt

we have been seeing this error recently quite frequently with the about blank infections. Please post a new HijackThis log so I can see what is going on. That avg file name appears odd to me. Please go to the website grisoft.com and double check the name of their compressed file. I suggest that you re-download it and use 'open' instead of 'save to disk' to have it install from the site if possible.

Hi nyc_2005

It is rare that HJT can remove this infection as it does not show a lot of the files for this infection. You definitely had about blank of the type with an added service and possible hidden dll as well. These keep the infection going and will reinstall it until you remove the offending entries. You did not use any tools that would have removed the infection from my instructions as they are only diagnostic tools. This MsDos error also may continue until you remove the infection. Is your copy of notepad functional now?

This program will tell us which service has been added in Win2K that will continue to reinstall the other files even though you may have removed some of them.

Getservice.zip

Extract the file to the c:\ drive. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up. Please paste the contents of that notepad as a reply to this post.

I would also like to know if you have a hidden dll in the registry. The program that failed to run should have shown this. If you would do the following instead:

Following these steps will produce a file in notepad that appears to contain gibberish. Please post it all back here.

1. Please Copy the contents of the quote box to Notepad.

Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
ren windows1.hiv windows.txt

2. Save the notepad file as *All Files* with the name the file Appinit.bat
on the Desktop.

3. Double-click on Appinit.bat

4. This will create a file on the desktop named windows.txt

5. Please post the entire contents of Windows.txt to this thread using 'Add Reply'.

Here is the info of course this looks bad +++++++++ SERVICE_NAME: O?’ŽrtñåȲ$Ó BINARY_PATH_NAME : D:\WINNT\ieba.exe /s ++++++++++++++++ PsService v1.1 - local and remote services viewer/controller Copyright © 2001-2003 Mark Russinovich Sysinternals - www.sysinternals.com SERVICE_NAME: Alerter Notifies selected users and computers of administrative alerts. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Alerter DEPENDENCIES : LanmanWorkstation SERVICE_START_NAME: LocalSystem SERVICE_NAME: AppMgmt Provides software installation services such as Assign, Publish, and Remove. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Application Management DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: BITS Transfers files in the background using idle network bandwidth. If the service is disabled, then any functions that depend on BITS, such as Windows Update or MSN Explorer will be unable to automatically download programs and other information. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k BITSgroup LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Background Intelligent Transfer Service DEPENDENCIES : LanmanWorkstation : Rpcss : SENS : Wmi SERVICE_START_NAME: LocalSystem SERVICE_NAME: Browser Maintains an up-to-date list of computers on your network and supplies the list to programs that request it. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Computer Browser DEPENDENCIES : LanmanWorkstation : LanmanServer SERVICE_START_NAME: LocalSystem SERVICE_NAME: cisvc (null) TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\cisvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Indexing Service DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: ClipSrv Supports ClipBook Viewer, which allows pages to be seen by remote ClipBooks. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\clipsrv.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : ClipBook DEPENDENCIES : NetDDE SERVICE_START_NAME: LocalSystem SERVICE_NAME: Creative Service for CDROM Access (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\CTSVCCDA.EXE LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Creative Service for CDROM Access DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: Dhcp Manages network configuration by registering and updating IP addresses and DNS names. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : DHCP Client DEPENDENCIES : Tcpip : Afd : NetBT SERVICE_START_NAME: LocalSystem SERVICE_NAME: dmadmin Administrative service for disk management requests TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\dmadmin.exe /com LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Logical Disk Manager Administrative Service DEPENDENCIES : RpcSs : PlugPlay : DmServer SERVICE_START_NAME: LocalSystem SERVICE_NAME: dmserver Logical Disk Manager Watchdog Service TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Logical Disk Manager DEPENDENCIES : RpcSs : PlugPlay SERVICE_START_NAME: LocalSystem SERVICE_NAME: Dnscache Resolves and caches Domain Name System (DNS) names. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : DNS Client DEPENDENCIES : Tcpip SERVICE_START_NAME: LocalSystem SERVICE_NAME: Eventlog Logs event messages issued by programs and Windows. Event Log reports contain information that can be useful in diagnosing problems. Reports are viewed in Event Viewer. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\services.exe LOAD_ORDER_GROUP : Event log TAG : 0 DISPLAY_NAME : Event Log DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: EventSystem Provides automatic distribution of events to subscribing COM components. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : Network TAG : 0 DISPLAY_NAME : COM+ Event System DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: Fax Helps you send and receive faxes TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\faxsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Fax Service DEPENDENCIES : TapiSrv : RpcSs : PlugPlay : Spooler SERVICE_START_NAME: LocalSystem SERVICE_NAME: HidServ (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\hidserv.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : HID Input Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: lanmanserver Provides RPC support and file, print, and named pipe sharing. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Server DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: lanmanworkstation Provides network connections and communications. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : NetworkProvider TAG : 0 DISPLAY_NAME : Workstation DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: LmHosts Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : TCP/IP NetBIOS Helper Service DEPENDENCIES : NetBT : Afd SERVICE_START_NAME: LocalSystem SERVICE_NAME: Messenger Sends and receives messages transmitted by administrators or by the Alerter service. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Messenger DEPENDENCIES : LanmanWorkstation : NetBIOS : RpcSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: mnmsrvc Allows authorized people to remotely access your Windows desktop using NetMeeting. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\mnmsrvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : NetMeeting Remote Desktop Sharing DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: MSDTC Coordinates transactions that are distributed across two or more databases, message queues, file systems, or other transaction protected resource managers. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\msdtc.exe LOAD_ORDER_GROUP : MS Transactions TAG : 0 DISPLAY_NAME : Distributed Transaction Coordinator DEPENDENCIES : RPCSS : SamSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: MSIServer Installs, repairs and removes software according to instructions contained in .MSI files. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\MsiExec.exe /V LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Installer DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: NetDDE Provides network transport and security for dynamic data exchange (DDE). TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\netdde.exe LOAD_ORDER_GROUP : NetDDEGroup TAG : 0 DISPLAY_NAME : Network DDE DEPENDENCIES : NetDDEDSDM SERVICE_START_NAME: LocalSystem SERVICE_NAME: NetDDEdsdm Manages shared dynamic data exchange and is used by Network DDE TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\netdde.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Network DDE DSDM DEPENDENCIES : : EGrLocalSystem : Network DDE DSDM : etwork DDE : ted Transaction Coordinator : trative Service : † :  SERVICE_START_NAME: LocalSystem SERVICE_NAME: Netlogon Supports pass-through authentication of account logon events for computers in a domain. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\lsass.exe LOAD_ORDER_GROUP : RemoteValidation TAG : 0 DISPLAY_NAME : Net Logon DEPENDENCIES : LanmanWorkstation SERVICE_START_NAME: LocalSystem SERVICE_NAME: Netman Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Network Connections DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: NtLmSsp Provides security to remote procedure call (RPC) programs that use transports other than named pipes. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\lsass.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : NT LM Security Support Provider DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: NtmsSvc Manages removable media, drives, and libraries. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Removable Storage DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: O?’ŽrtñåȲ$Ó (null) TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : D:\WINNT\ieba.exe /s LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Procedure Call (RPC) Helper DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: PlugPlay Manages device installation and configuration and notifies programs of device changes. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\services.exe LOAD_ORDER_GROUP : PlugPlay TAG : 0 DISPLAY_NAME : Plug and Play DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: PolicyAgent Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\lsass.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : IPSEC Policy Agent DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: ProtectedStorage Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Protected Storage DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: RasAuto Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Access Auto Connection Manager DEPENDENCIES : RasMan : Tapisrv SERVICE_START_NAME: LocalSystem SERVICE_NAME: RasMan Creates a network connection. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Access Connection Manager DEPENDENCIES : Tapisrv SERVICE_START_NAME: LocalSystem SERVICE_NAME: RemoteAccess Offers routing services to businesses in local area and wide area network environments. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 4 DISABLED ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Routing and Remote Access DEPENDENCIES : RpcSS : +NetBIOSGroup SERVICE_START_NAME: LocalSystem SERVICE_NAME: RemoteRegistry Allows remote registry manipulation. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\regsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Registry Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem FAIL_RESET_PERIOD : 0 seconds FAILURE_ACTIONS : Restart DELAY: 1000 seconds SERVICE_NAME: RpcLocator Manages the RPC name service database. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\locator.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Procedure Call (RPC) Locator DEPENDENCIES : LanmanWorkstation SERVICE_START_NAME: LocalSystem SERVICE_NAME: RpcSs Provides the endpoint mapper and other miscellaneous RPC services. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\svchost -k rpcss LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Procedure Call (RPC) DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: RSVP Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\rsvp.exe -s LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : QoS RSVP DEPENDENCIES : TcpIp : Afd SERVICE_START_NAME: LocalSystem SERVICE_NAME: SamSs Stores security information for local user accounts. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\lsass.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Security Accounts Manager DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: SCardDrv Provides support for legacy smart card readers attached to the computer. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : D:\WINNT\System32\SCardSvr.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Smart Card Helper DEPENDENCIES : +Smart Card Reader SERVICE_START_NAME: LocalSystem SERVICE_NAME: SCardSvr Manages and controls access to a smart card inserted into a smart card reader attached to the computer. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : D:\WINNT\System32\SCardSvr.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Smart Card DEPENDENCIES : PlugPlay SERVICE_START_NAME: LocalSystem SERVICE_NAME: Schedule Enables a program to run at a designated time. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\MSTask.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Task Scheduler DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: seclogon Enables starting processes under alternate credentials TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : D:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : RunAs Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: SENS Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : Network TAG : 0 DISPLAY_NAME : System Event Notification DEPENDENCIES : EventSystem SERVICE_START_NAME: LocalSystem SERVICE_NAME: SharedAccess Provides network address translation, addressing, and name resolution services for all computers on your home network through a dial-up connection. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Internet Connection Sharing DEPENDENCIES : RasMan SERVICE_START_NAME: LocalSystem SERVICE_NAME: Spooler Loads files to memory for later printing. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\spoolsv.exe LOAD_ORDER_GROUP : SpoolerGroup TAG : 0 DISPLAY_NAME : Print Spooler DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: SysmonLog Configures performance logs and alerts. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\smlogsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Performance Logs and Alerts DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: TapiSrv Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Telephony DEPENDENCIES : PlugPlay : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: TlntSvr Allows a remote user to log on to the system and run console programs using the command line. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\tlntsvr.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Telnet DEPENDENCIES : RpcSs : TcpIp SERVICE_START_NAME: LocalSystem SERVICE_NAME: TrkWks Sends notifications of files moving between NTFS volumes in a network domain. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Distributed Link Tracking Client DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: UPS Manages an uninterruptible power supply (UPS) connected to the computer. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\ups.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Uninterruptible Power Supply DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: UtilMan Starts and configures accessibility tools from one window TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\UtilMan.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Utility Manager DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: vsmon Monitors internet traffic and generates alerts for disallowed access. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\ZONELABS\vsmon.exe -service LOAD_ORDER_GROUP : TrueVector Group TAG : 0 DISPLAY_NAME : TrueVector Internet Monitor DEPENDENCIES : Afd : RpcSs : vsdatant SERVICE_START_NAME: LocalSystem SERVICE_NAME: W32Time Sets the computer clock. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Time DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WinMgmt Provides system management information. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : D:\WINNT\System32\WBEM\WinMgmt.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Management Instrumentation DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem FAIL_RESET_PERIOD : 86400 seconds FAILURE_ACTIONS : Restart DELAY: 60000 seconds : Restart DELAY: 60000 seconds SERVICE_NAME: WMDM PMSP Service (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\mspmspsv.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : WMDM PMSP Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WmdmPmSN Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Portable Media Serial Number Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: Wmi Provides systems management information to and from drivers. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\Services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Management Instrumentation Driver Extensions DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: wuauserv Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\system32\svchost.exe -k wugroup LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Automatic Updates DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WZCSVC Provides authenticated network access control using IEEE 802.1x for wired and wireless Ethernet networks. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : D:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : Wireless Configuration DEPENDENCIES : RpcSs : Ndisuio : ProtectedStorage : WMI SERVICE_START_NAME: LocalSystem +++++++++++++++++ I tried to follow your instructions does not appear to be a command on my machine Did you mean to type program name? +++++++++++++++++++++++++ As a substitue I exported from regedit … I am not sure if this is equivalent to what you want. Does it show items?? ++++++++++++++++++++++++++++++++++ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710

I will give you instructions on how to remove that service found in the last log after you post the results of the following.

1. Attached to this post is a file called AppInit.Bat. Please save it to your desktop.

2. Please Double-Click on AppInit. Bat

3. A new file named Windows.txt should appear on your desktop

4. Open Windows.txt and click so your cursor is in the window of that file and from the top menu use Edit > Select All. Then choose Edit > Copy

5. Open your browser and navigate to this post

6. Using Add Reply, right click in the window and paste. That will post the contents of the Windows Text file.

7. Post this to this thread and I will be able to then give you the instructions to remove these pests.

Unsucessful I tried to explain this same failure before Output of Windows2000 command window ++++++++++++++++++++++++++++++ D:\download>appinit.bat D:\download>Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv 'Reg' is not recognized as an internal or external command, operable program or batch file. D:\download>ren windows1.hiv windows.txt The system cannot find the file specified. +++++++++++++++++++++++++++++++++++++++++

ok I think you have more system files that have been damaged like notepad was, by the infection. Do you have your Windows Installation CD?

Please close all windows including your browser and insert it in your CDRom and go to Start>Run and in the run box type sfc /all and allow it to run and repair any files that it finds are damaged.

Once it is complete try the instructions to make Windows.txt above and post the log file from it.

SCF ALL DOES NOT WORK E:\>sfc /all Microsoft® Windows 2000 Windows File Checker Version 5.00 © 1999 Microsoft Corp. All rights reserved Scans all protected system files and replaces incorrect versions wi crosoft versions. SFC [/SCANNOW] [/SCANONCE] [/SCANBOOT] [/CANCEL] [/ENABLE] [/PURGEC SIZE=x] [/QUIET] /SCANNOW Scans all protected system files immediately. /SCANONCE Scans all protected system files once at the next b /SCANBOOT Scans all protected system files at every boot. /CANCEL Cancels all pending scans of protected system files /QUIET Replaces all incorrect file versions without prompt /ENABLE Enables Windows File Protection for normal operatio /PURGECACHE Purges the file cache and scans all protected syste iately. /CACHESIZE=x Sets the file cache size SO I TRIED E:\>sfc /scannow AND D:\>sfc /scannow A dialog with progress bar came up both times … I was NOT asked to replace any files MY OS AGAIN D:\>ver Microsoft Windows 2000 [Version 5.00.2195] D:\Documents and Settings\anonymous>reg 'reg' is not recognized as an internal or external command, operable program or batch file. ????? Is REG the correct name for the program ????????? THANK YOU