What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Rtazown

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I can't get rid of this one line in the HKLM\..\Run key. I delete it and it comes back. The pathname is mangled, and the file doesn't exist on the computer.

The problem is in the following line:
O4 - HKLM\..\Run: [rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1

I've included the entire log below.

Logfile of HijackThis v1.97.7
Scan saved at 4:33:06 PM, on 12/17/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CA\eTrust\InoculateIT\realmon.exe
X:\Support\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myfunstart.com/index.cfm?pc=bwhp5
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hiltonnet.hilton.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Hilton Hotels Corporation
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://enet.hilton.com/autocfg/ie6/HOTEL.INS
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\InoculateIT\realmon.exe"
O4 - HKLM\..\Run: [rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msmc] C:\WINNT\System32\msmc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://hiltonnet.hilton.com
O15 - Trusted Zone: http://*.americanexpress.com
O15 - Trusted Zone: http://*.BPSNet
O15 - Trusted Zone: http://www.bristolonline.com
O15 - Trusted Zone: http://support.ca.com
O15 - Trusted Zone: http://support.cai.com
O15 - Trusted Zone: http://*.cbpssrv1
O15 - Trusted Zone: http://www.cheyenne.com
O15 - Trusted Zone: http://*.cisdev
O15 - Trusted Zone: http://www.clubhotels.com
O15 - Trusted Zone: http://*.cntsdms1
O15 - Trusted Zone: http://www.compaq.com
O15 - Trusted Zone: http://*.corp_install01
O15 - Trusted Zone: http://*.criticalpath.net
O15 - Trusted Zone: http://www.dimdev.com
O15 - Trusted Zone: http://*.doubletree.com
O15 - Trusted Zone: http://www.doubletreehotels.com
O15 - Trusted Zone: http://www.embassy-suites.com
O15 - Trusted Zone: http://www.embassyvacationresorts.com
O15 - Trusted Zone: http://*.extranet
O15 - Trusted Zone: http://*.forrester.com
O15 - Trusted Zone: http://www.grandtheme.com
O15 - Trusted Zone: http://www.hampton-inn.com
O15 - Trusted Zone: http://www.hamptonvacationresorts.com
O15 - Trusted Zone: http://eis.hilton.com
O15 - Trusted Zone: http://enet.hilton.com
O15 - Trusted Zone: http://hiltonnet.hilton.com
O15 - Trusted Zone: http://*.hiltoninets.com
O15 - Trusted Zone: http://www.homewood-suites.com
O15 - Trusted Zone: http://www.hoovers.com
O15 - Trusted Zone: http://*.hp.com
O15 - Trusted Zone: http://*.ibm.net
O15 - Trusted Zone: http://*.inet
O15 - Trusted Zone: http://*.intradev_temp
O15 - Trusted Zone: http://*.it
O15 - Trusted Zone: http://www.mapquest.com
O15 - Trusted Zone: http://ntbugtraq.ntadvice.com
O15 - Trusted Zone: http://www.plansoft.com
O15 - Trusted Zone: http://corp.pmhs.com
O15 - Trusted Zone: http://download.pointcast.com
O15 - Trusted Zone: http://www.pointcast.com
O15 - Trusted Zone: http://www.promus-hotels.com
O15 - Trusted Zone: http://www.promus-inc.com
O15 - Trusted Zone: http://cis.promus.com
O15 - Trusted Zone: http://eis.promus.com
O15 - Trusted Zone: http://enet.promus.com
O15 - Trusted Zone: http://inet.promus.com
O15 - Trusted Zone: http://*.PromusCore.com
O15 - Trusted Zone: http://hilton.purchasepro.com
O15 - Trusted Zone: http://rl2k.rci.com
O15 - Trusted Zone: http://www.rfpexpress.com
O15 - Trusted Zone: http://www.rfsmgmt.com
O15 - Trusted Zone: http://*.techsmith.com
O15 - Trusted Zone: http://www.tharaldson.com
O15 - Trusted Zone: http://www.w3.org
O15 - Trusted Zone: http://la.xceed.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mdthh.local
O17 - HKLM\Software\..\Telephony: DomainName = mdthh.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mdthh.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mdthh.local

Edit:
O4 - HKCU\..\Run: [msmc] C:\WINNT\System32\msmc.exe
has been removed, but keeps coming back. The file referred to has been deleted.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myfunstart.com/index.cfm?pc=bwhp5
has been removed, too.
Post #2
Could you find, zip and submit this file:

C:\WINNT\System32:rtazown.dll

for examination to this e-mail address including a link to this thread in the body of the email.

Then, if you've already tried this in normal mode, boot into safe mode to see if we can clear it that way. When carrying out the instructions below, make sure that you have no other browsers or windows open as this could compromise the action. Open HJT, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myfunstart.com/index.cfm?pc=bwhp5
O4 - HKLM\..\Run: [rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1
O4 - HKCU\..\Run: [msmc] C:\WINNT\System32\msmc.exe

These also unless you set th restrictions:

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Make sure you have enabled show hidden files and folders, find and delete the following:

C:\WINNT\System32:rtazown.dll
C:\WINNT\System32\msmc.exe

Rescan with HJT and post a new log here for a final check over.
Post #3 last edited
Sorry I wasn't more clear. The file C:\WINNT\System32:rtazown.dll doesn't exist. I do have "show hidden files and folders" checked.

The "Restriction" and "Control Panel" lines were set by us.
Edit: But just to make sure, I removed those lines. No effect.

Booting into Safe mode really isn't an option. I'm not at the computer in question, and the idea of having the user edit the registry in safe mode terrifies me.

I've cleared the rtazown lines several times with HJT (making sure that all browser and Explorer windows were closed) and with regedit. The lines just keep coming back. Just as a test, I changed the "Init 1" portion of the line to "Init 0." When I refreshed the screen, it had changed back to "Init 1."

All the other problems have been taken care of.

Here's a fresh copy of the HJT log:
Logfile of HijackThis v1.97.7
Scan saved at 5:32:57 PM, on 12/17/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CA\eTrust\InoculateIT\realmon.exe
X:\Support\HijackThis.exe
C:\WINNT\regedit.exe
C:\WINNT\system32\logon.scr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hiltonnet.hilton.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hiltonnet.hilton.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Hilton Hotels Corporation
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://enet.hilton.com/autocfg/ie6/HOTEL.INS
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\InoculateIT\realmon.exe"
O4 - HKLM\..\Run: [rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKLM\..\RunOnce: [*rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://hiltonnet.hilton.com
O15 - Trusted Zone: http://*.americanexpress.com
O15 - Trusted Zone: http://*.BPSNet
O15 - Trusted Zone: http://www.bristolonline.com
O15 - Trusted Zone: http://support.ca.com
O15 - Trusted Zone: http://support.cai.com
O15 - Trusted Zone: http://*.cbpssrv1
O15 - Trusted Zone: http://www.cheyenne.com
O15 - Trusted Zone: http://*.cisdev
O15 - Trusted Zone: http://www.clubhotels.com
O15 - Trusted Zone: http://*.cntsdms1
O15 - Trusted Zone: http://www.compaq.com
O15 - Trusted Zone: http://*.corp_install01
O15 - Trusted Zone: http://*.criticalpath.net
O15 - Trusted Zone: http://www.dimdev.com
O15 - Trusted Zone: http://*.doubletree.com
O15 - Trusted Zone: http://www.doubletreehotels.com
O15 - Trusted Zone: http://www.embassy-suites.com
O15 - Trusted Zone: http://www.embassyvacationresorts.com
O15 - Trusted Zone: http://*.extranet
O15 - Trusted Zone: http://*.forrester.com
O15 - Trusted Zone: http://www.grandtheme.com
O15 - Trusted Zone: http://www.hampton-inn.com
O15 - Trusted Zone: http://www.hamptonvacationresorts.com
O15 - Trusted Zone: http://eis.hilton.com
O15 - Trusted Zone: http://enet.hilton.com
O15 - Trusted Zone: http://hiltonnet.hilton.com
O15 - Trusted Zone: http://*.hiltoninets.com
O15 - Trusted Zone: http://www.homewood-suites.com
O15 - Trusted Zone: http://www.hoovers.com
O15 - Trusted Zone: http://*.hp.com
O15 - Trusted Zone: http://*.ibm.net
O15 - Trusted Zone: http://*.inet
O15 - Trusted Zone: http://*.intradev_temp
O15 - Trusted Zone: http://*.it
O15 - Trusted Zone: http://www.mapquest.com
O15 - Trusted Zone: http://ntbugtraq.ntadvice.com
O15 - Trusted Zone: http://www.plansoft.com
O15 - Trusted Zone: http://corp.pmhs.com
O15 - Trusted Zone: http://download.pointcast.com
O15 - Trusted Zone: http://www.pointcast.com
O15 - Trusted Zone: http://www.promus-hotels.com
O15 - Trusted Zone: http://www.promus-inc.com
O15 - Trusted Zone: http://cis.promus.com
O15 - Trusted Zone: http://eis.promus.com
O15 - Trusted Zone: http://enet.promus.com
O15 - Trusted Zone: http://inet.promus.com
O15 - Trusted Zone: http://*.PromusCore.com
O15 - Trusted Zone: http://hilton.purchasepro.com
O15 - Trusted Zone: http://rl2k.rci.com
O15 - Trusted Zone: http://www.rfpexpress.com
O15 - Trusted Zone: http://www.rfsmgmt.com
O15 - Trusted Zone: http://*.techsmith.com
O15 - Trusted Zone: http://www.tharaldson.com
O15 - Trusted Zone: http://www.w3.org
O15 - Trusted Zone: http://la.xceed.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mdthh.local
O17 - HKLM\Software\..\Telephony: DomainName = mdthh.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mdthh.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mdthh.local
Post #4 last edited
This entry indicates AFlooder virus.
O4 - HKLM\..\RunOnce: [*rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1

The file is actually hidden in the directory System32 structure.

Do Start->Run and paste this:
rundll32 C:\Windows\system32:rtazown.dll,Uninstall
Click OK.

Then in HijackThis,
Tick the boxes next to these, click Fix checked, and reboot.
O4 - HKLM\..\Run: [rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1
O4 - HKLM\..\RunOnce: [*rtazown] rundll32 C:\WINNT\System32:rtazown.dll,Init 1

You should also fix as many as possible of the O15s. Putting things in Trusted Zone can be asking for trouble. Even if a site itself is safe, it can be hosting spyware/adware that would be able to install itself on your PC. Most sites don't need more permissions than they are given in your Internet Zone.

I am assuming that the O17s are legitimate (Domain = mdthh.local). Related to your http://hiltonnet.hilton.com start page?
Post #5
Thanks, cnm. As soon as I get access to that computer again, I'll try your fix. The O15 entries are beyond my control. I've tried to get that changed, but had no luck. The O17 entries are legitimate.
Post #7
Glad we could help. :)

If you need this topic reopened, please request this by sending
Email to Zero or
Email to cnm or
Email to Coyote
Choose only one of the above
Include your post user name and detail why you need it reopened with a valid link to your post, any bad links or emails that are not from the original poster will be deleted without response.

Others please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI