Hijack This Log

Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

Daemon,

Thank you for your response.

Dllcompare did not result in any finds, nothing happened after clicking runlocate.com or compare.

Anything, else I can try? Why did Dllcompare not work? I turned off all firewalls and security features prior, help!

Thanks,

GT

Not sure why it didn't work - try this. Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Daemon, Thanks for quick response. I see progress, yipee! Below is file you asked for: Sat 13 Nov 04 14:57:43 »»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»» *System: Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600) *IE version: 6.0.2900.2180 SP2 The type of the file system is NTFS. MS-DOS Version 5.00.500 *command.com test passed! __________________________________ !!*Creating backups…!! (*Backup already exist!) 14:57:43.14 Sat 11/13/2004 __________________________________ *Local time: Saturday, November 13, 2004 (11/13/2004) 2:57 PM, Central Standard Time *Uptime: 14:57:44 up 0 days, 0:05:08 *Path: C:\FINDnFIX —————————————————- »»Member of…: ("ADMIN" logon + group match required!) User is a member of group HENRY\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. User is a member of group \LOCAL. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Group BUILTIN\Administrators matches list. Group BUILTIN\Users matches list. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User: [HENRY\Lori], is a member of: BUILTIN\Administrators \Everyone Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINDOWS Logon Domain is HENRY Administrator's Name is Lori Computer Name is HENRY LOGON SERVER is \\HENRY »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. Ex: read only files, s/h files, last modified date. size, etc. The filters provided and registry scan should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder ______________________________________________________________________________ ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!*** ______________________________________________________________________________ ……Scanning for file(s)… *Note! The list(s) may include legitimate files! »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Read access error(s)… C:\WINDOWS\SYSTEM32\COMANB.DLL +++ File read error \\?\C:\WINDOWS\System32\COMANB.DLL +++ File read error »»»»» (*2*) »»»»»…….. COMANB.DLL Can't Open! »»»»» (*3*) »»»»»…….. No matches found. unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» ¯ Access denied ® ………………… COMANB.DLL …..57344 02.05.2004 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\COMANB.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… *List of files and specs according to 'size' : *Note: Not all files listed here are infected, but *may include* the name and spces of the offending file… ___________________________________________________________________________ Path: C:\WINDOWS\SYSTEM32 Including: *.DLL 104. Comanb Dll 57,344 . . R . A 5-02-04 5:50 pm 220. Dpwsockx Dll 57,344 . . . . A 8-04-04 1:56 am 620. Msasn1 Dll 57,344 . . . . A 8-04-04 1:56 am 192. Dmloader Dll 35,840 . . . . A 8-04-04 1:56 am 367. Imgutil Dll 35,840 . . . . A 8-04-04 1:56 am 1063. Umandlg Dll 35,840 . . . . A 8-04-04 1:56 am 216. Dpvacm Dll 21,504 . . . . A 8-04-04 1:56 am 264. Feclient Dll 21,504 . . . . A 8-04-04 1:56 am 290. Hidserv Dll 21,504 . . . . A 8-04-04 1:56 am ____________________________________________________________________________ *By size and date… C:\WINDOWS\SYSTEM32\ dpwsockx.dll Wed Aug 4 2004 1:56:42a A…. 57,344 56.00 K msasn1.dll Wed Aug 4 2004 1:56:42a A…. 57,344 56.00 K 2 items found: 2 files, 0 directories. Total of file sizes: 114,688 bytes 112.00 K C:\WINDOWS\SYSTEM32\ dmloader.dll Wed Aug 4 2004 1:56:42a A…. 35,840 35.00 K imgutil.dll Wed Aug 4 2004 1:56:42a A…. 35,840 35.00 K umandlg.dll Wed Aug 4 2004 1:56:46a A…. 35,840 35.00 K 3 items found: 3 files, 0 directories. Total of file sizes: 107,520 bytes 105.00 K C:\WINDOWS\SYSTEM32\ dpvacm.dll Wed Aug 4 2004 1:56:42a A…. 21,504 21.00 K feclient.dll Wed Aug 4 2004 1:56:42a A…. 21,504 21.00 K hidserv.dll Wed Aug 4 2004 1:56:42a A…. 21,504 21.00 K 3 items found: 3 files, 0 directories. Total of file sizes: 64,512 bytes 63.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 114688 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\UMANDLG.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 107520 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\HIDSERV.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 64512 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search and other files… fgrep: can't open input C:\WINDOWS\SYSTEM32\COMANB.DLL **File C:\WINDOWS\SYSTEM32\NGJHFAA.DLL 00004BD8: 2D 26 14 E7 0F 64 8A 00 . 00 00 00 00 C0 82 05 B3 -&.ç.dŠ. ….À‚.³ "C:\WINDOWS\system32\" ngjhfaa.dll Nov 7 2004 30720 "ngjhfaa.dll" 1 item found: 1 file, 0 directories. Total of file sizes: 30,720 bytes 30.00 K No matches found. *sp.html found in temp folder: –a– - - - - - 7,976 11-13-2004 sp.html File: CRC-32 : 93866C48 MD5 : CE5B5B5B DFD4A959 9F4A95C7 6FA46BD2 *Filter keys search… HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html CLSID = {AA59D589-3C64-453E-9371-D716AD028BF4} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain CLSID = {AA59D589-3C64-453E-9371-D716AD028BF4} »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value does not match ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows). Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 31) »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Performing string scan…. 00001150: vk > f AppInit_DLLs G 00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ c o m a n b . d l l 000011D0: h vk UDeviceNotSelectedTimeout 00001210: 1 5 x 9 0 =t vk ' zGDIProce 00001250:ssHandleQuota" vk Spooler2 y e s _ 00001290: h 0 ` vk 5swapdisk vk 000012D0: . TransmissionRetryTimeout h 0 ` 00001310: vk ' 0 USERProcessHandleQuota0 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT fùAppInit_DLLs֍æG¸ÿÿÿC ————– ————– $01180: AppInit_DLLs $011F7: UDeviceNotSelectedTimeout $01247: zGDIProcessHandleQuota $012E0: TransmissionRetryTimeout $01330: USERProcessHandleQuota0 ————– ————– C:\WINDOWS\System32\comanb.dll ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 …………. A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 62 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINDOWS\System32\comanb.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O. 0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e. 0020 6d 00 33 00 32 00 5c 00 63 00 6f 00 6d 00 61 00 | m.3.2.\.c.o.m.a. 0030 6e 00 62 00 2e 00 64 00 6c 00 6c 00 00 00 | n.b…d.l.l… ———————– »»»»»»Backups list…»»»»»» 14:59:30 up 0 days, 0:06:54 ———————– Sat 13 Nov 04 14:59:30 C:\FINDNFIX\ keyback.hiv Sat Nov 13 2004 2:46:04p A…. 8,192 8.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 8,192 bytes 8.00 K C:\FINDNFIX\KEYS1\ winkey.reg Sat Nov 13 2004 2:46:06p A…. 287 0.28 K 1 item found: 1 file, 0 directories. Total of file sizes: 287 bytes 0.28 K *Temp backups… "C:\Documents and Settings\Lori\Local Settings\Temp\Backs2\" keyback2.hi_ Nov 13 2004 8192 "keyback2.hi_" winkey2.re_ Nov 13 2004 287 "winkey2.re_" 2 items found: 2 files, 0 directories. Total of file sizes: 8,479 bytes 8.28 K -D—- JUNKXXX 00000000 14:46.04 13/11/2004 A—– STARTIT .BAT 00000060 14:57.44 13/11/2004 ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»» —–END—— Sat 13 Nov 04 14:59:35 

Completely disable any antivirus software you have running from this point on until we have finished.

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the COMANB.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

Daemon, Here it is, but it is a real b!t@h on reboot when I have to clear all the anti-stuff on the computer, I hope this is ok. Thanks, GT Sat 13 Nov 04 19:36:21 »»»»»»»»»»»»»»»»»»***LOG2!(*updated *9/1*)***»»»»»»»»»»»»»»»» *System: Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600) *IE version: 6.0.2900.2180 SP2 The type of the file system is NTFS. ___________________________________________ !!Restoring backups!! The operation completed successfully The operation completed successfully 19:36:18.06 Sat 11/13/2004 ___________________________________________ *Local time: Saturday, November 13, 2004 (11/13/2004) 7:36 PM, Central Standard Time *Uptime: 19:36:22 up 0 days, 0:09:45 *path: C:\FINDnFIX Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINDOWS Logon Domain is HENRY Administrator's Name is Lori Computer Name is HENRY LOGON SERVER is \\HENRY —————————————— This log will confirm if the file was successfully moved, and/or the right file was selected… Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» »»»»»»» (2) »»»»»»» »»»»»»» (3) »»»»»»» No matches found. Unknown/hidden files… No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(5)»»»»» »»»»»(6)»»»»» »»»»»»» Search by size And Date… *List of files specs according to size: *Note: Not all files listed here are infected! ____________________________________________________________________________ Path: C:\WINDOWS\SYSTEM32 Including: *.DLL 219. Dpwsockx Dll 57,344 . . . . A 8-04-04 1:56 am 619. Msasn1 Dll 57,344 . . . . A 8-04-04 1:56 am 191. Dmloader Dll 35,840 . . . . A 8-04-04 1:56 am 366. Imgutil Dll 35,840 . . . . A 8-04-04 1:56 am 1061. Umandlg Dll 35,840 . . . . A 8-04-04 1:56 am 215. Dpvacm Dll 21,504 . . . . A 8-04-04 1:56 am 263. Feclient Dll 21,504 . . . . A 8-04-04 1:56 am 289. Hidserv Dll 21,504 . . . . A 8-04-04 1:56 am ____________________________________________________________________________ C:\WINDOWS\SYSTEM32\ dpwsockx.dll Wed Aug 4 2004 1:56:42a A…. 57,344 56.00 K msasn1.dll Wed Aug 4 2004 1:56:42a A…. 57,344 56.00 K 2 items found: 2 files, 0 directories. Total of file sizes: 114,688 bytes 112.00 K C:\WINDOWS\SYSTEM32\ dmloader.dll Wed Aug 4 2004 1:56:42a A…. 35,840 35.00 K imgutil.dll Wed Aug 4 2004 1:56:42a A…. 35,840 35.00 K umandlg.dll Wed Aug 4 2004 1:56:46a A…. 35,840 35.00 K 3 items found: 3 files, 0 directories. Total of file sizes: 107,520 bytes 105.00 K C:\WINDOWS\SYSTEM32\ dpvacm.dll Wed Aug 4 2004 1:56:42a A…. 21,504 21.00 K feclient.dll Wed Aug 4 2004 1:56:42a A…. 21,504 21.00 K hidserv.dll Wed Aug 4 2004 1:56:42a A…. 21,504 21.00 K 3 items found: 3 files, 0 directories. Total of file sizes: 64,512 bytes 63.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 114688 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\UMANDLG.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 107520 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\HIDSERV.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 64512 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search and other files… No matches found. No matches found. No matches found. –*sp.html in temp folder was NOT FOUND!– *Filter keys search… REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2) –(*text/html Subkey was NOT FOUND!)– REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2) –(*text/plain Subkey was NOT FOUND!)– »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»*»»» Scanning for moved file… »»»*»»» No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.* fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.* Analyzer v1.36 by Boogie Copyright © 1997 ESP Team Files: C:\FINDNFIX\JUNKXXX\*.* Ä














































































Ä














































































Volume: None * DDIR * 7:37 pm | Sat, 11-13-04 Ser #: 4CCA-5E2E DOS Ver. 5.00 0% Used space Path: C:\FINDNFIX\JUNKXXX All files selected No files found. No. of files: 0 | List size: 0 Disk size: 976.5 M | Actual spc: 0 Bytes free: 976.5 M | Conserved space: 0 File not found - C:\FINDnFIX\junkxxx\*.* CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock. MD5 Message Digest Algorithm by RSA Data Security, Inc. File name Size Date Time MD5 Hash ________________________________________________________________________ CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk C:\FINDNFIX\JUNKXXX No files found ####################################################### *Known files are… ——————– File: ((56k; (57,344 bytes) CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 ——————– File: ((35k; (35,840 bytes) CRC-32 : 33081C8B MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE ——————– File: ((21k; (21,504 bytes) CRC-32 : 2258F59E MD5 : EFEE2CB3 B342A351 51802356 9637F8E6 ####################################################### »»Permissions: ERROR: There are no more files. Directory "C:\FINDnFIX\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000002 tc– 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000009 –o- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000002 tc– 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000009 –o- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000013 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000013 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x HENRY\Lori Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000013 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: HENRY\Lori Primary Group: HENRY\None Directory "C:\FINDnFIX\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000000 t— 001F01FF —- DSPO rw+x HENRY\Lori Allow 0000000B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000003 tco- 001200A9 —- -S– r–x BUILTIN\Users Allow 00000002 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000002 tc– 00000002 —- —- -w– BUILTIN\Users Owner: HENRY\Lori Primary Group: HENRY\None »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value Matches ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows). No differences found. »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM 00001150: vk UDeviceNotSelecte 00001190:dTimeout 1 5 x h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 =t vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' 0 USERProcessHandleQuota0 h X 000012D0: vk S AppInit_DLLsm 3 00001310: 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: ———- NEWWIN.TXT AppInit_DLLsm ————– ————– $0117F: UDeviceNotSelectedTimeout $011C7: zGDIProcessHandleQuota $01270: TransmissionRetryTimeout $012A0: USERProcessHandleQuota0 $012F0: AppInit_DLLsm ————– ————– No strings found. ————– ————– d…. 0 Nov 13 14:46 . d…. 0 Nov 13 14:46 .. 2 files found occupying -1024 bytes =============================================================================== 0 bytes 0 cps Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01 VDIR v1.00 Path: C:\FINDNFIX\JUNKXXX\*.* —————————————+————————————— . 11-13-:4 14:46|.. 11-13-:4 14:46 —————————————+————————————— 2 files totaling 0 bytes consuming 0 bytes of disk space. 17299968 bytes available on Drive C: No volume label …File dump… Detecting… C:\FINDnFIX\junkxxx Finished Detecting… ========================================= 0 C:\FINDnFIX\junkxxx (DIR Total) Owner No. Files Total Size ========================================= ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»» Sat 13 Nov 04 19:37:50 —–END—– 

Looks like your AV nailed it. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

It's gone - just a few things to finish off.

Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the red 'Delete File' button after pasting each one:

C:\WINDOWS\System32\wsys.exe
C:\Program Files\CasinoOnline\CsRemnd.exe

Click 'Exit' when done.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

Make sure that you have no other browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entry by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [windll] "C:\WINDOWS\System32\wsys.exe"

Reboot, rescan with HJT and post a new log for a final check over.

Oops, joyful too soon, I see something new in the scan , hijacked by new.net. ARGHHHHHHHHHHHHHH. GT

A few new baddies in there. First of all could you click Start>Settings>Control Panel>Add or Remove Programs and uninstall New.Net.

Click here to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and post a new log here so that any remnants can be removed manually.

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes:

C:\windows\system32\rk.exe

Exit the Task Manager when finished then find and delete that file.

Close all programs down, leaving only HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [Remndr] "C:\Program Files\CasinoOnline\CsRemnd.exe"
O4 - HKLM\..\Run: [OSS] c:\windows\system32\rk.exe -boot

Click on Fix Checked and exit HijackThis.

Post back a fresh HijackThis log and we'll take another look.