Cws About:blank? My Hijackthis Log

Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

Thank you for the reply. I clicked to download DllCompare to the desktop. Started the Program and clicked the Run Locate.com - with the \Windows\System32 directory in the box. Error dialogue appears: 16 bit MS_DOS Subsystem C:\DOCUME~1\Edward\Desktop\locate.com C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. The system file is not suitable for running MS-DOS and Microsoft Windows applications. Choose 'Close' to terminate the application. Close | Ignore. pls advise.

Get your XP CD and follow the instructions below (put your actual CD-ROM drive letter where I have indicated)

1. Insert the CD into the CD drive or DVD drive.
2. Click Start, and then click Run.
3. In the Open box, type cmd, and then click OK.
4. At the command prompt, type the following commands, pressing ENTER after each command:

expand CD-ROM Drive Letter:\i386\autoexec.nt_ c:\windows\system32\autoexec.nt

exit

5. Start or install the program.

hm, the original XP CD is not available, can't find it. It's a 2-yr old Dell laptop. However, I do have an XP Home Edition Update CD. So, inserted this one instead and followed instructions… C:\Documents and Settings\Edward>expand D:\i386\autoexec.nt_ c:\windows\system32\autoexec.nt Microsoft ® File Expansion Utility Version 5.1.2600.0 Copyright © Microsoft Corp 1990-1999. All rights reserved. Expanding d:\i386\autoexec.nt_ to c:\windows\system32\autoexec.nt. d:\i386\autoexec.nt_: 860 bytes expanded to 1688 bytes, 96% increase. C:\Documents and Settings\Edward> pls advise.

Try DllCompare again now.

Ok, DllCompare worked this time. 2 files found in the lower pane. Rescan did not find anything. * DLLCompare Log version(1.0.0.125) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\archlib.dll Sat Sep 20 2003 12:26:04p A.S.. 200,704 196.00 K C:\WINDOWS\SYSTEM32\d3dagn.dll Sat May 8 2004 8:40:18p A…R 57,344 56.00 K ________________________________________________ 1,354 items found: 1,354 files (1 H/S), 0 directories. Total of file sizes: 290,740,809 bytes 277.27 M Administrator Account = True ——————–End log———————

Download FxAgentB.exe from here and save it to your desktop. After downloading, double-click the FxAgentB file to run it and the program will scan your entire hard drive - this may take a while. When it is done, it will generate a log file called FxAgentB.log - save that information as you will need to paste it here later. Reboot when done.

Next click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1. Reboot when done.

Then click here to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done, rescan with HijackThis and post a new log here, together with the FxAgentB log and a new DllCompare log.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [Microsoft Update] wudmate.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wudmate.exe
O4 - HKCU\..\Run: [Microsoft Update] wudmate.exe
O9 - Extra button: (no name) - {578FC4E3-151E-456c-AF8E-B63061EFE228}} - (no file)

Reboot when done, rescan with HJT and post a new log here.

hmm.. new infection.

Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

* DLLCompare Log version(1.0.0.125) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\archlib.dll Sat Sep 20 2003 12:26:04p A.S.. 200,704 196.00 K C:\WINDOWS\SYSTEM32\d3dagn.dll Sat May 8 2004 8:40:18p A…R 57,344 56.00 K ________________________________________________ 1,354 items found: 1,354 files (1 H/S), 0 directories. Total of file sizes: 290,742,857 bytes 277.27 M Administrator Account = True ——————–End log———————

Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Thu 16 Dec 04 18:08:51 »»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»» *System: Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600) *IE version: 6.0.2900.2180 SP2 The type of the file system is NTFS. MS-DOS Version 5.00.500 *command.com test passed! __________________________________ !!*Creating backups…!! The operation completed successfully 18:08:49.30 Thu 12/16/2004 __________________________________ *Local time: Thursday, December 16, 2004 (12/16/2004) 6:08 PM, Pacific Standard Time *Uptime: 18:08:55 up 0 days, 10:58:50 *Path: C:\FINDnFIX —————————————————- »»Member of…: ("ADMIN" logon + group match required!) User is a member of group PITCHER\None. User is a member of group \Everyone. User is a member of group PITCHER\Debugger Users. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. User is a member of group \LOCAL. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Group BUILTIN\Administrators matches list. Group BUILTIN\Users matches list. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User: [PITCHER\Edward], is a member of: BUILTIN\Administrators PITCHER\Debugger Users \Everyone Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINDOWS Logon Domain is PITCHER Administrator's Name is Edward Computer Name is PITCHER LOGON SERVER is \\PITCHER »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. Ex: read only files, s/h files, last modified date. size, etc. The filters provided and registry scan should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder ______________________________________________________________________________ ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!*** ______________________________________________________________________________ ……Scanning for file(s)… *Note! The list(s) may include legitimate files! »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Read access error(s)… C:\WINDOWS\SYSTEM32\D3DAGN.DLL +++ File read error \\?\C:\WINDOWS\System32\D3DAGN.DLL +++ File read error »»»»» (*2*) »»»»»…….. D3DAGN.DLL Can't Open! »»»»» (*3*) »»»»»…….. No matches found. unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» ¯ Access denied ® ………………… D3DAGN.DLL …..57344 08.05.2004 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\D3DAGN.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… *List of files and specs according to 'size' : *Note: Not all files listed here are infected, but *may include* the name and spces of the offending file… ___________________________________________________________________________ Path: C:\WINDOWS\SYSTEM32 Including: *.DLL 157. D3dagn Dll 57,344 . . R . A 5-08-04 8:40 pm 243. Dpwsockx Dll 57,344 . . . . A 8-03-04 11:56 pm 657. Msasn1 Dll 57,344 . . . . A 8-03-04 11:56 pm 1307. Wnaspint Dll 57,344 . . . . A 5-13-04 8:04 pm 214. Dmloader Dll 35,840 . . . . A 8-03-04 11:56 pm 375. Imgutil Dll 35,840 . . . . A 8-03-04 11:56 pm 1159. Umandlg Dll 35,840 . . . . A 8-03-04 11:56 pm 239. Dpvacm Dll 21,504 . . . . A 8-03-04 11:56 pm 298. Feclient Dll 21,504 . . . . A 8-03-04 11:56 pm ____________________________________________________________________________ *By size and date… C:\WINDOWS\SYSTEM32\ dpwsockx.dll Tue Aug 3 2004 11:56:42p A…. 57,344 56.00 K msasn1.dll Tue Aug 3 2004 11:56:42p A…. 57,344 56.00 K 2 items found: 2 files, 0 directories. Total of file sizes: 114,688 bytes 112.00 K C:\WINDOWS\SYSTEM32\ dmloader.dll Tue Aug 3 2004 11:56:42p A…. 35,840 35.00 K imgutil.dll Tue Aug 3 2004 11:56:42p A…. 35,840 35.00 K umandlg.dll Tue Aug 3 2004 11:56:46p A…. 35,840 35.00 K 3 items found: 3 files, 0 directories. Total of file sizes: 107,520 bytes 105.00 K C:\WINDOWS\SYSTEM32\ dpvacm.dll Tue Aug 3 2004 11:56:42p A…. 21,504 21.00 K feclient.dll Tue Aug 3 2004 11:56:42p A…. 21,504 21.00 K 2 items found: 2 files, 0 directories. Total of file sizes: 43,008 bytes 42.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 114688 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\UMANDLG.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 107520 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 43008 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search and other files… fgrep: can't open input C:\WINDOWS\SYSTEM32\D3DAGN.DLL **File C:\WINDOWS\SYSTEM32\JDKIL.DLL 00004BE0: 2D 26 14 E7 0F 64 8A 00 . 00 00 00 00 C0 82 05 B3 -&.ç.dŠ. ….À‚.³ "C:\WINDOWS\SYSTEM32\" jdkil.dll Dec 14 2004 30720 "jdkil.dll" 1 item found: 1 file, 0 directories. Total of file sizes: 30,720 bytes 30.00 K No matches found. *sp.html found in temp folder: –a– - - - - - 8,051 12-16-2004 sp.html File: CRC-32 : 3056F558 MD5 : F4086296 7532F670 4F87BE7C 8227FEB6 *Filter keys search… HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html CLSID = {7F891F67-CCAB-44AA-8349-86CBFC1E644A} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain CLSID = {7F891F67-CCAB-44AA-8349-86CBFC1E644A} »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value does not match ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) ERROR 2, unable to open file Keys1\winkey.reg »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Performing string scan…. 00001150: vk > f AppInit_DLLs G 00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ d 3 d a g n . d l l 000011D0: v j h vk UDeviceNotSelectedTimeout 00001210: 1 5 P 9 0 vk ' zGDIProce 00001250:ssHandleQuota" vk Spooler2 y e s _ 00001290: h 0 ` vk 5swapdisk vk 000012D0: . TransmissionRetryTimeout h 0 ` 00001310: vk ' M USERProcessHandleQuotaB 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT fùAppInit_DLLs֍æG¸ÿÿÿC ————– ————– $01180: AppInit_DLLs $011F7: UDeviceNotSelectedTimeout $01247: zGDIProcessHandleQuota $012E0: TransmissionRetryTimeout $01330: USERProcessHandleQuotaB ————– ————– C:\WINDOWS\System32\d3dagn.dll ————– ————– …………. A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 62 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINDOWS\System32\d3dagn.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O. 0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e. 0020 6d 00 33 00 32 00 5c 00 64 00 33 00 64 00 61 00 | m.3.2.\.d.3.d.a. 0030 67 00 6e 00 2e 00 64 00 6c 00 6c 00 00 00 | g.n…d.l.l… ———————– »»»»»»Backups list…»»»»»» 18:11:54 up 0 days, 11:01:49 ———————– Thu 16 Dec 04 18:11:54 C:\FINDNFIX\ keyback.hiv Thu Dec 16 2004 6:08:50p A…. 8,192 8.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 8,192 bytes 8.00 K No matches found. *Temp backups… "C:\Documents and Settings\Edward\Local Settings\Temp\Backs2\" keyback2.hi_ Dec 16 2004 8192 "keyback2.hi_" 1 item found: 1 file, 0 directories. Total of file sizes: 8,192 bytes 8.00 K -D—- JUNKXXX 00000000 18:08.50 16/12/2004 A—– STARTIT .BAT 00000060 18:08.50 16/12/2004 ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»» —–END—— Thu 16 Dec 04 18:11:57