Has anyone seen a solution for the latest annoyance where the following enteries keep adding themselves to the hosts file?:
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
Click here to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".
Reboot when done. Next, download the Lavasoft VX2 cleaner plug-in into AAW SE from here
Close Ad-Aware SE and Ad-Watch (if running). Download the file to your desktop, double-click it to run it and it will install into AAW itself. Open AAW, go to add ons and run the tool. Let me know if it removed anything.
Reboot when done, rescan with HJT and post a new log.
Click here to download the VX2Finder.exe tool. Click on the VX2Finder.exe and then click on the Click to Find VX2.Betterinternet button. It will display the files, the Guardian Key and User Agent string. Now click the Make Log button. It will open the log in notepad. Copy and paste that log here.
Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.
Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.
Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.
Log for VX2.BetterInternet File Finder (msg126)
Files Found—
Additional Files—
Keys Under Notify—
crypt32chain
cryptnet
cscdll
Explorer
PCANotify
sclgntfy
SensLogn
termsrv
wzcnotif
Guardian Key— is called:
User Agent String—
{737264BE-16FD-421F-BBEC-FDAC4F7C396B}
* DLLCompare Log version()
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________
C:\WINNT\SYSTEM32\drloader.dll Sat Nov 27 2004 11:42:36p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\gulul3~1.dll Sat Dec 4 2004 2:15:30a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\iaxmontr.dll Mon Nov 29 2004 10:49:06p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\j00sla~1.dll Tue Nov 30 2004 8:28:50p ..S.R 224,198 218.94 K
C:\WINNT\SYSTEM32\jt2007~1.dll Sat Dec 4 2004 11:00:50a ..S.R 224,353 219.09 K
C:\WINNT\SYSTEM32\jt2607~1.dll Sat Dec 4 2004 3:18:30a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\muscp.dll Sat Dec 4 2004 11:08:58a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\mzdsrv32.dll Tue Nov 30 2004 11:04:40a ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\nktapi.dll Sun Nov 28 2004 1:20:56a ..S.R 223,0
Is that the full list - looks like the end was missed off.
The files that have ~1 in the name, could you search your system and post the full name.
Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file - we will use it later.
I also need you to export a registry key for me to see. Go to Start > Run and type:
regedit
and Ok. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify and export the key to a text file and post it here. To do this, go to File and choose Export. Call it any name that you like (selected branch should be pre-selected) and then send it to your Desktop as a text file.
If you are able to keep your PC on for a while longer that would be great.
1.) oops, sorry about that. Here's the full list:
* DLLCompare Log version()
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________
C:\WINNT\SYSTEM32\drloader.dll Sat Nov 27 2004 11:42:36p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\gulul3~1.dll Sat Dec 4 2004 2:15:30a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\iaxmontr.dll Mon Nov 29 2004 10:49:06p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\j00sla~1.dll Tue Nov 30 2004 8:28:50p ..S.R 224,198 218.94 K
C:\WINNT\SYSTEM32\jt2007~1.dll Sat Dec 4 2004 11:00:50a ..S.R 224,353 219.09 K
C:\WINNT\SYSTEM32\jt2607~1.dll Sat Dec 4 2004 3:18:30a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\muscp.dll Sat Dec 4 2004 11:08:58a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\mzdsrv32.dll Tue Nov 30 2004 11:04:40a ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\nktapi.dll Sun Nov 28 2004 1:20:56a ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\ore2disp.dll Mon Nov 29 2004 6:28:00p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\q0860a~1.dll Tue Nov 30 2004 1:27:42p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\q668lg~1.dll Mon Nov 29 2004 11:14:06p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\ttpmib.dll Mon Nov 29 2004 10:34:12p ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\uziplat.dll Sun Nov 28 2004 12:58:34a ..S.R 223,071 217.84 K
C:\WINNT\SYSTEM32\viwwdm32.dll Sat Nov 27 2004 7:23:56p ..S.R 225,438 220.15 K
C:\WINNT\SYSTEM32\wrmregps.dll Fri Dec 3 2004 4:01:32a ..S.R 222,890 217.66 K
C:\WINNT\SYSTEM32\xaate.dll Mon Nov 29 2004 10:40:58p ..S.R 223,071 217.84 K
________________________________________________
1,181 items found: 1,181 files (18 H/S), 0 directories.
Total of file sizes: 206,775,688 bytes 197.20 M
Administrator Account = True
——————–End log———————
2.) full names:
gulul3391.dll
j00slad71d0.dll
jt2007fme.dll
jt2607fse.dll
q0860alsedq60.dll
q668lgju16o8.dll
3.) I downloaded Pocket Killbox by Option^Explicit
4.) Here's the exported registry key "Notify":
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\jt2607fse.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"Unlock"="WLEventUnlock"
"Lock"="WLEventLock"
"Startup"="WLEventStartup"
"DllName"="PCANotify.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000
4.) I am able to keep my PC on indefinitely
(thanks for your help so far, btw)
Please don't reboot unless I request it. Could you have a look for a file called guard.tmp on your system and post it's full path if there.
Also one final scan to confirm the extent of this pest. Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.
1.) I won't reboot unless you say
2.) guard.tmp is in C:\WINNT\system32
3.) about a minute after clicking on "!LOG!.bat", this box popped up:
RUNREAD.EXE
The instruction at "0x7c59516a" referenced memory at "0x000019f4". The memory could not be "read".
Click ok to terminate the program
I did not click ok. The cmd window behind it has this:
.. Calculating… Please wait…
..
..
.. Writing data..Preparing log…
Checking path …
Reading from drive C: …
Sorting entries …
Redirecting …
Done.
..
…Please wait for the final report…
..
I have not closed it. There is no Log.txt in C:\FINDnFIX but there is one called "win.txt". This is what in contains:
regf Pugf hbin ¨ÿÿÿnk, pK
¸ yÀ ÿÿÿÿ ÿÿÿÿÿÿÿÿ ° x ÿÿÿÿ 0 3 Windows Èþÿÿskÿÿx x ” ì
!
€ ! #
€ # ?
?
?
àÿÿÿÐ ø @ p À Øÿÿÿvk € C AppInit_DLLsV e Ðÿÿÿvk ( t DeviceNotSelectedTimeoutèÿÿÿ1 5 Èå æ Pæ Ðÿÿÿvk €' 0 GDIProcessHandleQuota
àÿÿÿvk A Spooler ðÿÿÿy e s f t àÿÿÿvk € i swapdiskÐÿÿÿvk ð y TransmissionRetryTimeoutðÿÿÿ9 0 Èè Ðÿÿÿvk €' " USERProcessHandleQuotac Ð ÿÿÿÿ
tonyB
Hmmm.. OK. I think we may have it all anyway - let's see if we can prise it from your system. There may be some trial and error with this - it is too new to have a formal fixing procedure.
Do this - stay off the Internet until complete - print these instructions.
Double-click on Killbox.exe to run it. Click on Tools>Delete Temp Files>OK. Next click on Tools>Hosts File and when the file opens in Notepad, remove the following lines:
Next, in the main Killbox pane, select the Delete on reboot option. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the 'Delete File' button (red circle with a white X) after pasting:
C:\WINNT\SYSTEM32\drloader.dll
It will prompt you to reboot, press the NO button. Instead, copy and paste the following and click the 'Delete File' button again:
C:\WINNT\SYSTEM32\gulul3391.dll
It will prompt you to reboot, press the NO button again and repeat for the following:
C:\WINNT\SYSTEM32\iaxmontr.dll
Then repeat again for all these files - make sure you get them all (check them off one by one):
Only when the last file has been entered, when it prompts you to reboot, press the YES button.
Rescan with HJT and post a new log. Also, go here and run Silent Runners.vbs (you may need to enable it with your antivirus). It generates a log, please post the information back in this thread.
Looks like it may be hanging in there. Could you post a new DllCompare log and see if guard.tmp has been restored.
Are you still getting pop-ups?
"
________________________________________________
1,170 items found: 1,170 files (7 H/S), 0 directories.
Total of file sizes: 204,324,882 bytes 194.86 M
Administrator Account = True
——————–End log———————
2.) Yep, still getting popups :-/
Logfile of HijackThis v1.98.2
Scan saved at 2:06:31 AM, on 12/6/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
c:\winnt\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINNT\System32\CTsvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Expertcity\GoToMyPC\g2svc.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Expertcity\GoToMyPC\g2comm.exe
C:\Program Files\Expertcity\GoToMyPC\g2tray.exe
c:\winnt\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wibobo.exe
C:\Program Files\Babylon\Babylon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Thanksgiving97extra\DllCompare.exe
C:\Program Files\Expertcity\GoToMyPC\g2mainh.exe
C:\Program Files\Expertcity\GoToMyPC\g2host.exe
C:\Program Files\Expertcity\GoToMyPC\g2printh.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Thanksgiving97extra\HijackThis.exe
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wibobo.exe
O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: huipip.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85