Please Have A Look At This

Click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. Reboot when done.

Click here to download Spybot Search & Destroy - install, update, scan and fix all RED items it finds. Reboot when done.

Click here to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and post a new log here so that any remnants can be removed manually.

Click here to download Shadowwar's pv application and extract it to C:\pv.

Navigate to that directory and double-click on the runme.bat file. Press the number 5 for Winlogon and when finished it will open notepad. Paste the contents of that notepad as a reply to this topic.

Hello again, Here's the contents of the notepad from Shadow pv as instructed, thanks: Module information for 'winlogon.exe' MODULE BASE SIZE PATH winlogon.exe 1000000 536576 C:\WINDOWS\system32\winlogon.exe 5.1.2600.1106 (xpsp1.020828-1920) Aplicación de inicio de sesión de Windows NT ntdll.dll 77f40000 708608 C:\WINDOWS\System32\ntdll.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL de la capa de Windows NT kernel32.dll 77e40000 995328 C:\WINDOWS\system32\kernel32.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL de cliente API BASE de Windows NT msvcrt.dll 77be0000 339968 C:\WINDOWS\system32\msvcrt.dll 7.0.2600.1106 (xpsp1.020828-1920) Windows NT CRT DLL ADVAPI32.dll 77da0000 647168 C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) API base de Windows 32 avanzado RPCRT4.dll 78000000 548864 C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.1106 (xpsp1.020828-1920) Remote Procedure Call Runtime GDI32.dll 77c40000 262144 C:\WINDOWS\system32\GDI32.dll 5.1.2600.1106 (xpsp1.020828-1920) GDI Client DLL USER32.dll 77d10000 573440 C:\WINDOWS\system32\USER32.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL de cliente USER API de Windows XP USERENV.dll 75a20000 679936 C:\WINDOWS\system32\USERENV.dll 5.1.2600.1106 (xpsp1.020828-1920) Userenv NDdeApi.dll 758f0000 28672 C:\WINDOWS\system32\NDdeApi.dll 5.1.2600.0 (xpclient.010817-1148) APIs de la administración del recurso compartido DDE de red CRYPT32.dll 76270000 573440 C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.1106 (xpsp1.020828-1920) Crypto API32 MSASN1.dll 76250000 61440 C:\WINDOWS\system32\MSASN1.dll 5.1.2600.0 (XPClient.010817-1148) ASN.1 Runtime APIs Secur32.dll 76f50000 65536 C:\WINDOWS\system32\Secur32.dll 5.1.2600.1106 (xpsp1.020828-1920) Security Support Provider Interface WINSTA.dll 76310000 61440 C:\WINDOWS\system32\WINSTA.dll 5.1.2600.1106 (xpsp1.020828-1920) Winstation Library PROFMAP.dll 758e0000 40960 C:\WINDOWS\system32\PROFMAP.dll 5.1.2600.0 (xpclient.010817-1148) Userenv NETAPI32.dll 71bc0000 319488 C:\WINDOWS\system32\NETAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) Net Win32 API DLL REGAPI.dll 76b80000 57344 C:\WINDOWS\system32\REGAPI.dll 5.1.2600.1106 (xpsp1.020828-1920) Registry Configuration APIs WS2_32.dll 71a30000 86016 C:\WINDOWS\system32\WS2_32.dll 5.1.2600.0 (xpclient.010817-1148) Windows Socket 2.0 32-Bit DLL WS2HELP.dll 71a20000 32768 C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.0 (xpclient.010817-1148) Ayuda de Windows Socket 2.0 para Windows NT AUTHZ.dll 76c80000 65536 C:\WINDOWS\system32\AUTHZ.dll 5.1.2600.0 (xpclient.010817-1148) Authorization Framework PSAPI.DLL 76bb0000 45056 C:\WINDOWS\system32\PSAPI.DLL 5.1.2600.1106 (xpsp1.020828-1920) Process Status Helper VERSION.dll 77bd0000 28672 C:\WINDOWS\system32\VERSION.dll 5.1.2600.0 (xpclient.010817-1148) Version Checking and File Installation Libraries SETUPAPI.dll 76630000 962560 C:\WINDOWS\system32\SETUPAPI.dll 5.1.2600.1106 (xpsp1.020828-1920) API de instalación de Windows MSGINA.dll 75920000 991232 C:\WINDOWS\System32\MSGINA.dll 5.1.2600.1106 (xpsp1.020828-1920) Inicio de sesión GINA DLL de Windows NT SHELL32.dll 773a0000 8392704 C:\WINDOWS\system32\SHELL32.dll 6.00.2800.1106 (xpsp1.020828-1920) DLL común del shell de Windows SHLWAPI.dll 772a0000 409600 C:\WINDOWS\system32\SHLWAPI.dll 6.00.2800.1106 (xpsp1.020828-1920) Biblioteca de utilidades de Shell COMCTL32.dll 77310000 569344 C:\WINDOWS\system32\COMCTL32.dll 5.82 (xpsp1.020828-1920) Common Controls Library ODBC32.dll 1f7b0000 200704 C:\WINDOWS\System32\ODBC32.dll 3.520.9030.0 Microsoft Data Access - ODBC Driver Manager comdlg32.dll 76360000 286720 C:\WINDOWS\system32\comdlg32.dll 6.00.2800.1106 (xpsp1.020828-1920) DLL de diálogos comunes comctl32.dll 78090000 933888 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll 6.0 (xpsp1.020828-1920) User Experience Controls Library odbcint.dll 1f850000 98304 C:\WINDOWS\System32\odbcint.dll 3.520.7713.0 Microsoft Data Access - Recursos de ODBC SHSVCS.dll 76b90000 126976 C:\WINDOWS\System32\SHSVCS.dll 6.00.2800.1106 (xpsp1.020828-1920) Biblioteca DLL de Servicios Shell de Windows sfc.dll 76b70000 16384 C:\WINDOWS\system32\sfc.dll 5.1.2600.0 (xpclient.010817-1148) Windows File Protection sfc_os.dll 76c20000 167936 C:\WINDOWS\System32\sfc_os.dll 5.1.2600.1106 (xpsp1.020828-1920) Protección de archivos de Windows WINTRUST.dll 76bf0000 176128 C:\WINDOWS\System32\WINTRUST.dll 5.131.2600.0 (xpclient.010817-1148) APIs de verificación de confianza de Microsoft ole32.dll 9a0000 1183744 C:\WINDOWS\system32\ole32.dll 5.1.2600.1106 (xpsp1.020828-1920) Microsoft OLE para Windows IMAGEHLP.dll 76c50000 139264 C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.1106 (xpsp1.020828-1920) Windows NT Image Helper WINSCARD.DLL 72370000 106496 C:\WINDOWS\System32\WINSCARD.DLL 5.1.2600.0 (xpclient.010817-1148) API de Microsoft Smart Card WTSAPI32.dll 76f10000 32768 C:\WINDOWS\System32\WTSAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) Windows Terminal Server SDK APIs sxs.dll 75e40000 688128 C:\WINDOWS\System32\sxs.dll 5.1.2600.1106 (xpsp1.020828-1920) Fusion 2.5 uxtheme.dll 5b150000 212992 C:\WINDOWS\System32\uxtheme.dll 6.00.2800.1106 (xpsp1.020828-1920) Biblioteca UxTheme de Microsoft WINMM.dll 76b00000 184320 C:\WINDOWS\System32\WINMM.dll 5.1.2600.1106 (xpsp1.020828-1920) MCI API DLL SYNCOR11.DLL 6bd00000 53248 C:\WINDOWS\System32\SYNCOR11.DLL 1.2.3 SynthCore R2.0 Midi Interface Driver cscdll.dll 765b0000 110592 C:\WINDOWS\system32\cscdll.dll 5.1.2600.0 (xpclient.010817-1148) Agente de red sin conexión WlNotify.dll 75900000 106496 C:\WINDOWS\system32\WlNotify.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL común de recepción de notificaciones Winlogon WINSPOOL.DRV 72f80000 143360 C:\WINDOWS\System32\WINSPOOL.DRV 5.1.2600.1106 (xpsp1.020828-1920) Controlador de administración de colas para Windows MPR.dll 71aa0000 69632 C:\WINDOWS\system32\MPR.dll 5.1.2600.0 (xpclient.010817-1148) DLL del enrutador de provisión múltiple rsaenh.dll ffd0000 143360 C:\WINDOWS\System32\rsaenh.dll 5.1.2600.1029 (xpsp1.020426-1800) Microsoft Base Cryptographic Provider SAMLIB.dll 71b90000 69632 C:\WINDOWS\System32\SAMLIB.dll 5.1.2600.1106 (xpsp1.020828-1920) SAM Library DLL msv1_0.dll 76cd0000 118784 C:\WINDOWS\system32\msv1_0.dll 5.1.2600.1106 (xpsp1.020828-1920) Microsoft Authentication Package v1.0 RASAPI32.dll 76ea0000 225280 C:\WINDOWS\System32\RASAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) API de acceso remoto rasman.dll 76e50000 69632 C:\WINDOWS\System32\rasman.dll 5.1.2600.1106 (xpsp1.020828-1920) Remote Access Connection Manager TAPI32.dll 76e70000 176128 C:\WINDOWS\System32\TAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL cliente de la API de telefonía de Microsoft® Windows™ rtutils.dll 76e40000 53248 C:\WINDOWS\System32\rtutils.dll 5.1.2600.0 (xpclient.010817-1148) Routing Utilities cscui.dll 765d0000 327680 C:\WINDOWS\System32\cscui.dll 5.1.2600.1106 (xpsp1.020828-1920) IU de la caché en el lado cliente wdmaud.drv 72ca0000 36864 C:\WINDOWS\System32\wdmaud.drv 5.1.2600.0 (XPClient.010817-1148) WDM Audio driver mapper msacm32.drv 72c90000 32768 C:\WINDOWS\System32\msacm32.drv 5.1.2600.0 (xpclient.010817-1148) Asignador de sonido de Microsoft MSACM32.dll 77bb0000 81920 C:\WINDOWS\System32\MSACM32.dll 5.1.2600.0 (xpclient.010817-1148) Filtro de sonido ACM de Microsoft MPRAPI.dll 76d00000 90112 C:\WINDOWS\System32\MPRAPI.dll 5.1.2600.0 (xpclient.010817-1148) Windows NT MP Router Administration DLL ACTIVEDS.dll 76e00000 192512 C:\WINDOWS\System32\ACTIVEDS.dll 5.1.2600.0 (xpclient.010817-1148) DLL de nivel de enrutado para AD adsldpc.dll 76dd0000 151552 C:\WINDOWS\System32\adsldpc.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL de proveedor LDAP de AD WLDAP32.dll 76f20000 184320 C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.1106 (xpsp1.020828-1920) DLL de API de LDAP Win32 ATL.DLL 76ae0000 86016 C:\WINDOWS\System32\ATL.DLL 3.00.9435 ATL Module for Windows NT (Unicode) OLEAUT32.dll 770f0000 569344 C:\WINDOWS\system32\OLEAUT32.dll 3.50.5016.0 Microsoft OLE 3.50 for Windows NT™ and Windows 95™ Operating Systems midimap.dll 13a0000 28672 C:\WINDOWS\System32\midimap.dll 5.1.2600.0 (xpclient.010817-1148) Mapeador Microsoft MIDI COMRes.dll 77010000 851968 C:\WINDOWS\System32\COMRes.dll 2001.12.4414.42 CLBCATQ.DLL 76f90000 491520 C:\WINDOWS\System32\CLBCATQ.DLL 2001.12.4414.42 NTMARTA.DLL 76ca0000 126976 C:\WINDOWS\System32\NTMARTA.DLL 5.1.2600.1106 (xpsp1.020828-1920) Proveedor MARTA de Windows NT

One more scan then we'll clean you up. Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

I'm having a problem with Run Lovate programme. I've downloaded it and it's showing the \Windows\System32 directory in the box. But when I click Run Locate.com the following message appears: Subsistema MS-DOS de 16 bits C:\DOCUME~1\escuela\ESCRIT~1\locate.com C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. El archivo de sistema no es apropriado para ejecutar aplicaciones de MS-DOS y Windows. Elija "Cerrar" para finalizar la aplicacion. In case you don't understand the Spanish its saying that the files are not appropriate for MS-DOS and Windows applications. Choose "close" And above that "ESCRIT" refers to escritorio = Desktop Many thanks

Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the red 'Delete File' button after pasting each one:

C:\WINDOWS\System32\Q2845828.dll
C:\Program Files\Windows AdTools\WinAdTools.exe
C:\Documents and Settings\escuela\Datos de programa\atta.exe

Click 'Exit' when done.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

Then create a new folder called C:\HijackThis, extract the HijackThis.exe file from the zip file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong. Make sure that you have no other browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find-on-the-net.com/search.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find-on-the-net.com/
F2 - REG:system.ini: UserInit=Userinit.exe,TGBRFV_
O3 - Toolbar: IE Search Toolbar - {EB381422-F797-4A98-A266-9DC490821907} - C:\Archivos de programa\IESearchToolbar\IESearchToolbar.dll
O3 - Toolbar: Richfind - {2226812A-838E-4650-B9D7-14DCC5DC707F} - C:\WINDOWS\System32\Q2845828.dll
O3 - Toolbar: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O4 - HKLM\..\Run: [Windows AdTools] C:\Program Files\Windows AdTools\WinAdTools.exe
O4 - HKCU\..\Run: [Uuph] C:\Documents and Settings\escuela\Datos de programa\atta.exe
O9 - Extra button: Richfind - {00000000-0000-0000-0000-000000000000} - (no file)
O9 - Extra button: Richfind - {2226812A-838E-4650-B9D7-14DCC5DC707F} - C:\WINDOWS\System32\Q2845828.dll
O9 - Extra button: Corel Network monitor worker - {A868160E-70B4-4714-A38A-654D6C0C9DAD} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {A868160E-70B4-4714-A38A-654D6C0C9DAD} - (no file)
O9 - Extra button: Corel Network monitor worker - {A868160E-70B4-4714-A38A-654D6C0C9DAD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {A868160E-70B4-4714-A38A-654D6C0C9DAD} - (no file) (HKCU)
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O18 - Filter: text/plain - {00000000-0000-0000-0000-000000000000} - (no file)


Reboot when done. Open TheKillbox again, click File, Open!Submit and you will see a folder bearing the date that you used TheKillbox - zip it up and send to this e-mail address including a link to this thread in the body of the email.

Rescan with HJT and post a new log for a final check over.

Thanks for the files. Little bit more to do - with only HJT running have it fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find-on-the-net.com/search.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *new-search.net*;*x-google.net*
O2 - BHO: IE Search Toolbar Helper - {2C5175A2-ADF3-4F57-AB70-BA90FD60A383} - C:\Archivos de programa\IESearchToolbar\IESearchToolbar.dll

Reboot when done and post another log.

Looks OK - how is it running?

Everything seems to be running as it should. Thanks a million and I'll be sending a donation.

You're welcome - glad to help

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.