stimpy2020
i did everything you said and i made sure everything looked right…does this mean i am done??
b
Spyware / Malware / Virus Removal
A Friend In Need...db105 In The House
10 min read
Micah_6:8
We're getting there.
You're doing a great job.
I'll let you know when we're finished (or at least when I think we are)
Please use windows explorer to navigate to C:\Hijack\Backups and double click on the winkey.reg file and merge the information into the registry. It will prompt you for conformation. Please click "Yes".
Run RegLite and go to File > import and import Winkey.hiv.
"Copy/paste" the following next line into the address bar of Reglite
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Delete the entry in the AppInit_DLLs Value key which will look like: C:\Windows\System32\kbde.dll and then close RegLite.
Now, please Download the most recent version of CWShredder.exe
Download into it's own folder. Click "Check for Updates", then click "Fix", and let it anything that it finds.
Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.
Get Spybot - Search & Destroy from http://security.kolla.de (This is the NEW Version 1.3)
Get AdAware SE Personal from http://www.lavasoft.de/support/download
Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:
http://www.cjwd.demon.co.uk/spybot-adaware.html
Reboot after running each program.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {04225BF1-0FD7-46ED-BC65-0DEE8A55A2E8} - C:\WINDOWS\system32\pip.dll
O18 - Filter: text/html - {537E60A9-4DD0-4A6B-AED4-11E88F7B5589} - C:\WINDOWS\system32\pip.dll
O18 - Filter: text/plain - {537E60A9-4DD0-4A6B-AED4-11E88F7B5589} - C:\WINDOWS\system32\pip.dll
Then click "Fix checked".
Reboot in "safe" mode.
Find and delete:
c:\windows\system32\pip.dll <— file
(may already be deleted - be sure!)
Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).
Reboot in normal mode and "copy/paste" a new log file into this thread.
You're doing a great job.
I'll let you know when we're finished (or at least when I think we are)
Please use windows explorer to navigate to C:\Hijack\Backups and double click on the winkey.reg file and merge the information into the registry. It will prompt you for conformation. Please click "Yes".
Run RegLite and go to File > import and import Winkey.hiv.
"Copy/paste" the following next line into the address bar of Reglite
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Delete the entry in the AppInit_DLLs Value key which will look like: C:\Windows\System32\kbde.dll and then close RegLite.
Now, please Download the most recent version of CWShredder.exe
Download into it's own folder. Click "Check for Updates", then click "Fix", and let it anything that it finds.
Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.
Get Spybot - Search & Destroy from http://security.kolla.de (This is the NEW Version 1.3)
Get AdAware SE Personal from http://www.lavasoft.de/support/download
Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:
http://www.cjwd.demon.co.uk/spybot-adaware.html
Reboot after running each program.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {04225BF1-0FD7-46ED-BC65-0DEE8A55A2E8} - C:\WINDOWS\system32\pip.dll
O18 - Filter: text/html - {537E60A9-4DD0-4A6B-AED4-11E88F7B5589} - C:\WINDOWS\system32\pip.dll
O18 - Filter: text/plain - {537E60A9-4DD0-4A6B-AED4-11E88F7B5589} - C:\WINDOWS\system32\pip.dll
Then click "Fix checked".
Reboot in "safe" mode.
Find and delete:
c:\windows\system32\pip.dll <— file
(may already be deleted - be sure!)
Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).
Reboot in normal mode and "copy/paste" a new log file into this thread.
stimpy2020
let me do this and see what happens…thanks again
Micah_6:8
There will be more to do (but not much 
)
)
stimpy2020
Logfile of HijackThis v1.98.2
Scan saved at 9:07:35 PM, on 10/18/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Advisor - {B3413D98-5C41-44AC-BB8D-6C346B24CDD5} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
Scan saved at 9:07:35 PM, on 10/18/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Advisor - {B3413D98-5C41-44AC-BB8D-6C346B24CDD5} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
Micah_6:8
Boot in "safe" mode.
Right-click on the file "C:\Junk\kbde.dll", go to the Security tab > Advanced and take ownership giving yourself 'Full control' (preferably to Administrators 'group').
Right-click the C:\Junk folder and hit properties. Click on Security tab then the Advanced button. Check the box that says Reset permissions on all child objects. Hit Apply.
You should now be able to delete the file and folder. Then also remove them from your recycle bin
Please post back to let me know you deleted the folder successfully.
Right-click on the file "C:\Junk\kbde.dll", go to the Security tab > Advanced and take ownership giving yourself 'Full control' (preferably to Administrators 'group').
Right-click the C:\Junk folder and hit properties. Click on Security tab then the Advanced button. Check the box that says Reset permissions on all child objects. Hit Apply.
You should now be able to delete the file and folder. Then also remove them from your recycle bin
Please post back to let me know you deleted the folder successfully.
stimpy2020
i successfully deleted the junk folder. i am ready when you are…thanks again.
Micah_6:8
That's it….
How's the machine running now? 
How's the machine running now?
stimpy2020
it appears to be working great except for the no background on my desktop problem. i dont know what the deal is, but now i can only get a gray background. i found and deleted the html file that someone had saved as my background. when i did that my screen grayed out. now, no matter what i do, i am not able to get that thing down and get a regular background back up.
also…did you notice up in my last log that i posted that there was a section that said missing file….is that ok?
Micah_6:8
You mean this?
O9 - Extra button: Advisor - {B3413D98-5C41-44AC-BB8D-6C346B24CDD5} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
That's a known "bug" in Hijack This!
It only happens with "O9" entries. Chances are the file is really there.
I'll have to do some investigating about your desktop problem. I've not heard of that before.
O9 - Extra button: Advisor - {B3413D98-5C41-44AC-BB8D-6C346B24CDD5} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
That's a known "bug" in Hijack This!
It only happens with "O9" entries. Chances are the file is really there.
I'll have to do some investigating about your desktop problem. I've not heard of that before.
stimpy2020
well thanks for all of your time…you have really been a big help. i appreciate all that you have done, in this instance and in the past. let me know if you find anything out and i will do the same.
sincerely,
brian
Micah_6:8
stimpy2020
and thus ends our saga. everything worked out perfectly. i got it all clean and my desktop is back. thanks for all of your help. i really really appreciate it.
take care man
b
Micah_6:8
Great!!!
Helping is what we are here for.
GOD bless!!!
M68
Helping is what we are here for.
GOD bless!!!
M68
Items you may wish to consider to harden your defenses against future infections:
Read "How did I get infected in the first place?" here:
http://boards.cexx.org/viewtopic.php?t=957
Download IE-Spyad here:
https://netfiles.uiuc.edu/ehowes/www/resource.htm
IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.
Check your browser settings here:
http://browsercheck.qualys.com/index.php
A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.
Follow safe Internet practices:
1. Keep your virus definitions up to date, and scan your system regularly.
2. Don't open email, or download attachments from unrecognized email addresses.
3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.
4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.
5. Keep your Windows and IE current with all the latest patches and updates.
Micah_6:8
This topic is now closed.
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI