Cws About:blank? My Hijackthis Log

Completely disable any antivirus software you have running from this point on until we have finished.

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the D3DAGN.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

ok, turned off norton antivirus. norton icon appears with an X in system tray. Found and double-clicked Fix.bat. Alert dialogue: You must be member of Administrators group to continue! Clicked Ok. New window: The system cannot find the file specified. Window closes. New dialogue: System shutdown in 10 seconds 9..8..7..6..0. Reboot. Navigated to C:\Windows\System32 folder Did not find the D3DAGN.DLL. pls advise.

Complete the rest of the instructions

Sat 18 Dec 04 07:08:48 »»»»»»»»»»»»»»»»»»***LOG2!(*updated *9/1*)***»»»»»»»»»»»»»»»» *System: Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600) *IE version: 6.0.2900.2180 SP2 The type of the file system is NTFS. ___________________________________________ !!Restoring backups!! Error: Access is denied. 7:08:35.55 Sat 12/18/2004 ___________________________________________ *Local time: Saturday, December 18, 2004 (12/18/2004) 7:08 AM, Pacific Standard Time *Uptime: 7:08:51 up 0 days, 13:45:11 *path: C:\FINDnFIX Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINDOWS Logon Domain is PITCHER Administrator's Name is Edward Computer Name is PITCHER LOGON SERVER is \\PITCHER —————————————— This log will confirm if the file was successfully moved, and/or the right file was selected… Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» \\?\C:\WINDOWS\SYSTEM32\D3DAGN.DLL +++ File read error C:\WINDOWS\System32\D3DAGN.DLL +++ File read error »»»»»»» (2) »»»»»»» D3DAGN.DLL Can't Open! »»»»»»» (3) »»»»»»» No matches found. Unknown/hidden files… No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(5)»»»»» ¯ Access denied ® ………………… D3DAGN.DLL …..57344 08.05.2004 »»»»»(6)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\D3DAGN.DLL »»»»»»» Search by size And Date… *List of files specs according to size: *Note: Not all files listed here are infected! ____________________________________________________________________________ Path: C:\WINDOWS\SYSTEM32 Including: *.DLL 157. D3dagn Dll 57,344 . . R . A 5-08-04 8:40 pm 243. Dpwsockx Dll 57,344 . . . . A 8-03-04 11:56 pm 657. Msasn1 Dll 57,344 . . . . A 8-03-04 11:56 pm 1307. Wnaspint Dll 57,344 . . . . A 5-13-04 8:04 pm 214. Dmloader Dll 35,840 . . . . A 8-03-04 11:56 pm 375. Imgutil Dll 35,840 . . . . A 8-03-04 11:56 pm 1159. Umandlg Dll 35,840 . . . . A 8-03-04 11:56 pm 239. Dpvacm Dll 21,504 . . . . A 8-03-04 11:56 pm 298. Feclient Dll 21,504 . . . . A 8-03-04 11:56 pm ____________________________________________________________________________ C:\WINDOWS\SYSTEM32\ dpwsockx.dll Tue Aug 3 2004 11:56:42p A…. 57,344 56.00 K msasn1.dll Tue Aug 3 2004 11:56:42p A…. 57,344 56.00 K 2 items found: 2 files, 0 directories. Total of file sizes: 114,688 bytes 112.00 K C:\WINDOWS\SYSTEM32\ dmloader.dll Tue Aug 3 2004 11:56:42p A…. 35,840 35.00 K imgutil.dll Tue Aug 3 2004 11:56:42p A…. 35,840 35.00 K umandlg.dll Tue Aug 3 2004 11:56:46p A…. 35,840 35.00 K 3 items found: 3 files, 0 directories. Total of file sizes: 107,520 bytes 105.00 K C:\WINDOWS\SYSTEM32\ dpvacm.dll Tue Aug 3 2004 11:56:42p A…. 21,504 21.00 K feclient.dll Tue Aug 3 2004 11:56:42p A…. 21,504 21.00 K 2 items found: 2 files, 0 directories. Total of file sizes: 43,008 bytes 42.00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 114688 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\UMANDLG.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 107520 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 43008 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search and other files… fgrep: can't open input C:\WINDOWS\SYSTEM32\D3DAGN.DLL No matches found. No matches found. No matches found. –*sp.html in temp folder was NOT FOUND!– *Filter keys search… REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2) –(*text/html Subkey was NOT FOUND!)– REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2) –(*text/plain Subkey was NOT FOUND!)– »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»*»»» Scanning for moved file… »»»*»»» No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.* fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.* Analyzer v1.36 by Boogie Copyright © 1997 ESP Team Files: C:\FINDNFIX\JUNKXXX\*.* Ä














































































Ä














































































Volume: None * DDIR * 7:12 am | Sat, 12-18-04 Ser #: D456-A8AF DOS Ver. 5.00 0% Used space Path: C:\FINDNFIX\JUNKXXX All files selected No files found. No. of files: 0 | List size: 0 Disk size: 976.5 M | Actual spc: 0 Bytes free: 976.5 M | Conserved space: 0 File not found - C:\FINDnFIX\junkxxx\*.* CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock. MD5 Message Digest Algorithm by RSA Data Security, Inc. File name Size Date Time MD5 Hash ________________________________________________________________________ CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk C:\FINDNFIX\JUNKXXX No files found ####################################################### *Known files are… ——————– File: ((56k; (57,344 bytes) CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 ——————– File: ((35k; (35,840 bytes) CRC-32 : 33081C8B MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE ——————– File: ((21k; (21,504 bytes) CRC-32 : 2258F59E MD5 : EFEE2CB3 B342A351 51802356 9637F8E6 ####################################################### »»Permissions: ERROR: There are no more files. Directory "C:\FINDnFIX\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000002 tc– 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000009 –o- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000002 tc– 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000009 –o- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 0000001B -co- 10000000 —A —- —- BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x PITCHER\Edward Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Allow 0000001B -co- A0000000 R-X- —- —- BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: PITCHER\Edward Primary Group: PITCHER\None Directory "C:\FINDnFIX\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 0000001B -co- 10000000 —A —- —- BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x PITCHER\Edward Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Allow 0000001B -co- A0000000 R-X- —- —- BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: PITCHER\Edward Primary Group: PITCHER\None »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value does not match ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) ERROR 2, unable to open file Keys1\winkey.reg »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM 00001150: vk > f AppInit_DLLs G 00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ d 3 d a g n . d l l 000011D0: v j h vk UDeviceNotSelectedTimeout 00001210: 1 5 P 9 0 vk ' zGDIProce 00001250:ssHandleQuota" vk Spooler2 y e s _ 00001290: h 0 ` vk 5swapdisk vk 000012D0: . TransmissionRetryTimeout h 0 ` 00001310: vk ' M USERProcessHandleQuotaB 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: ———- NEWWIN.TXT fùAppInit_DLLs֍æG¸ÿÿÿC ————– ————– $01180: AppInit_DLLs $011F7: UDeviceNotSelectedTimeout $01247: zGDIProcessHandleQuota $012E0: TransmissionRetryTimeout $01330: USERProcessHandleQuotaB ————– ————– C:\WINDOWS\System32\d3dagn.dll ————– ————– d…. 0 Dec 16 18:08 . d…. 0 Dec 16 18:08 .. 2 files found occupying -1024 bytes =============================================================================== 0 bytes 0 cps Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01 VDIR v1.00 Path: C:\FINDNFIX\JUNKXXX\*.* —————————————+————————————— . 12-16-:4 18:08|.. 12-16-:4 18:08 —————————————+————————————— 2 files totaling 0 bytes consuming 0 bytes of disk space. 17299968 bytes available on Drive C: No volume label …File dump… Detecting… C:\FINDnFIX\junkxxx Finished Detecting… ========================================= 0 C:\FINDnFIX\junkxxx (DIR Total) Owner No. Files Total Size ========================================= ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»» Sat 18 Dec 04 07:12:24 —–END—– 

Awkward isn't it? OK, let's try a different approach.

Click here to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel and confirm that C:\WINDOWS\SYSTEM32\D3DAGN.DLL appears in the 'Value' field. If it does, continue with the next steps otherwise stop and get back to me.

Using Windows Explorer, go to your root drive: C:\ and create a new folder called 'Hijack' and within that folder, create two new folders, one called 'Backups' and one called 'Junk'.

Use the Registrar Lite program. Copy and paste the key below into reglite's address bar and hit 'Go':

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

Click on the Windows key to highlight it, and use the top menu File>Export and save as (in the C:\Hijack\Backups folder):

1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)

Navigate to C:\Hijack\Backups and confirm both files have been successfully saved.

Use the Registrar Lite program again. Copy and paste the key below into reglite's address bar and hit 'Go':

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Right-click on the Windows key in the left pane and rename it to something else - for example:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotWindows

DoubleClick "Appinit_Dlls" value on right pane and erase the data in the 'Value' box at the the bottom of the new pane. The data to remove will be:

"C:\WINDOWS\System32\D3DAGN.DLL", hit 'Apply' and 'Ok' to set.

Rename 'NotWindows' back to 'Windows' in the left pane, close Registrar Lite and reboot the computer. If all goes well the hidden process will not run at startup and you should now be able to find and *see* the D3DAGN.DLL in C:\WINDOWS\System32.

Unzip and run Winfile from here. Open it up, click File>Move…

Copy and paste this into the 'From' box: C:\WINDOWS\System32\D3DAGN.DLL
Copy and paste this into the 'To' box: C:\Hijack\Junk\D3DAGN.DLL

Hit OK. Close Winfile and check in C:\Hijack\Junk for that file - let me know what's there.

ok, thanks again for your guidance. C:\Hijack\Junk\D3DAGN.DLL is visible and there now.

Navigate to C:\Hijack\Backups and double-click on the "Winkey.reg" file. Answer yes to the prompt. Run reglite again, copy and paste the key below into reglite's address bar and hit 'Go':

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

Click on the Windows key to highlight it, and use the top menu File>Import browse to and select the "Winkey.hiv" you saved earlier. Hit 'open', merge and 'ok' it. When both are set DoubleClick on the AppInit value again and erase the data in the value field if there. (C:\WINDOWS\System32\D3DAGN.DLL).

Check CWShredder for an update and run it, hit 'fix' as opposed to 'scan only'. Reboot when done. Run HJT and post a new log.

Also try to delete the D3DAGN.DLL file in the junk folder.

Try this - boot into Safe Mode by tapping F8 after the BIOS has loaded. Right-click on the C:\Junk\D3DAGN.DLL go to the Security tab>advanced and take ownership giving yourself 'Full control' (preferably to Administrators 'group'). Right-click the C:\Junk folder and hit properties. Click on security tab then the advanced button. Check the box that says reset permissions on all child objects. Hit apply. You should now be able to delete the file and folder. Let me know how you get on and post a new HJT log in this thread and let me know how it is running now.

OK good. With only HJT running have it fix:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: (no name) - {3BF96C72-BC3D-2DE3-835F-66550FD12C1E} - C:\WINDOWS\System32\hito.dll (disabled by BHODemon)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)

Reboot and you should be good to go. Let me know if everything is OK and I'll close the topic.

Everything is fine. No pop-ups, no about:blank redirect. phew. Thank you!

You're welcome - glad to help

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.