What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack Problem -need Help!

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
:o Oh no! Wow, I did another scan with Ad-Aware SE and this is what came up!! : This never showed up before … ArchiveData(auto-quarantine- 2004-12-24 04-03-34.bckp) Referencefile : SE1R23 16.12.2004 ====================================================== COOLWEBSEARCH »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[0]=Process : C:\WINNT\system32\ezepep.dll obj[1]=Process : C:\WINNT\system32\ezepep.dll obj[2]=Process : C:\WINNT\system32\ezepep.dll obj[3]=Process : C:\WINNT\system32\ezepep.dll obj[4]=Process : C:\WINNT\system32\ezepep.dll obj[5]=Process : C:\WINNT\system32\ezepep.dll obj[7]=Process : C:\WINNT\adsbpthugx.exe obj[8]=Process : C:\WINNT\system32\ezepep.dll obj[9]=Process : C:\WINNT\syst em32\ezepep.dll obj[10]=Process : C:\WINNT\system32\ezepep.dll obj[11]=Process : C:\WINNT\system32\ezepep.dll obj[12]=Process : C:\WINNT\system32\ezepep.dll obj[13]=Process : C:\WINNT\system32\ezepep.dll obj[14]=Process : C:\WINNT\system32\ezepep.dll obj[15]=RegValue : Software\Microsoft\Windows\CurrentVersion\Run "C:\WINNT\adsbpthugx.exe" obj[25]=File : c:\winnt\adsbpthugx.exe VX2 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[6]=Process : C:\WINNT\system32\wywuwu.exe obj[23]=RegValue : software\microsoft\internet explorer\toolbar\webbrowser "{0E5CBF21-D15F-11D0-8301-00AA005B4383}" obj[24]=RegValue : software\microsoft\windows\currentversion\run "Narrator" REDIRECTED HOSTFILE ENTRY »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[16]=Hosts file : 69.20.16.183 ieautosearch obj[17]=Hosts file : 69.20.16.183 auto.search.msn.com obj[18]=Hosts file : 69.20.16.183 search.netscape.com obj[19]=Hosts file : 69.20.16.183 ieautosearch obj[20]=Hosts file : 69.20.16.183 ieautosearch obj[21]=Hosts file : 69.20.16.183 ieautosearch obj[22]=Hosts file : 69.20.16.183 ieautosearch I then did a remove , rebooted , ran Ad-Aware again and still : ArchiveData(auto-quarantine- 2004-12-24 04-15-54.bckp) Referencefile : SE1R23 16.12.2004 ====================================================== COOLWEBSEARCH »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[0]=Process : C:\WINNT\system32\ezepep.dll obj[1]=Process : C:\WINNT\system32\ezepep.dll obj[2]=Process : C:\WINNT\system32\ezepep.dll obj[3]=Process : C:\WINNT\system32\ezepep.dll obj[4]=Process : C:\WINNT\system32\ezepep.dll obj[5]=Process : C:\WINNT\system32\ezepep.dll obj[6]=Process : C:\WINNT\system32\ezepep.dll obj[8]=Process : C:\WINNT\system32\ezepep.dll obj[9]=Process : C:\WINNT\system32\ezepep.dll obj[10]=Process : C:\WINNT\system32\ezepep.dll obj[11]=Process : C:\WINNT\system32\ezepep.dll obj[12]=Process : C:\WINNT\system32\ezepep.dll VX2 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» obj[7]=Process : C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhghg.exe obj[13]=RegValue : software\microsoft\windows\currentversion\run "Narrator" :scratch: What should I do? It seems like some are gone but not all….should I keep cleaning with Ad-Aware? Is it helping or not really? LorJJan4 :(
Post #17 last edited
hello LorJJan4, there are some more files in the new output.txt we will have to get rid of. same as before, use pocketkill box: also print this out or copy to a text file so you can get to it, do it disconected from the internet. 1-Click "Replace on Reboot" and check the "2-Use Dummy" box. Paste this file into the top "Full Path of File to Delete" box. C:\WINNT\system32\cgcucu.dll 3-Click the "Delete File" button which looks like a stop sign. 4-Click "Yes" at the Replace on Reboot prompt. 5-Click "No" at the Pending Operations prompt. Repeat steps 1-5 above for these files: C:\WINNT\system32\wywuwu.exe C:\WINNT\system32\ezepep.dll C:\WINNT\system32\hphuhu.exe C:\WINNT\system32\pqpupu.dat C:\WINNT\adsbpthugx.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhghg.exe C:\WINNT\System32\guard.tmp when all done; Click "Yes" at the Replace on Reboot prompt. Click "Yes" at the Pending Operations prompt to restart your computer. after restart, run HJT: Run HJT and check the following items: Close all open windows except HiJackThis and press 'Fix Checked': (select all 01 entries, iam going by your older HJT log) O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch —————————————————————- ok now reboot computer into SAFE MODE by tapping F8 key at startup, chose safe mode from the options, once in safe mode: Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove: Temporary Files Temporary Internet Files Recycle Bin Click Start>Run then type %temp% Hit OK. Delete all the files you can, some wont delete. using explorer(right click on start>explore) drill down to these >>> you want to delete whats >inside< the folder, not the folder itself<< C:\Windows\Temp\ C:\Documents and Settings\-Your Profile-\Local Settings\Temporary Internet Files\ (will dump all your cached internet content including cookies) C:\Documents and Settings\-Your Profile-\Local Settings\Temp\ C:\Documents and Settings\-Any other users Profile-\Local Settings\Temporary Internet Files\ C:\Documents and Settings\-Any other users Profile-\Local Settings\Temp\ ————————————————– reboot normally, post a new HJT log and another log from Findit i think we are making progress, is your recycle bin functioning ok?
Post #18
Whew! Okay here I go….

Here's what's happening:

IN KILLBOX:

from the list of latest ones to get rid of…some were there, and some weren't .. these weren't there:
C:\WINNT\system32\wywuwu.exe
" " \ezepep.dll
" " \hphuhu.exe
C:\Documents and settings\all users\start menu\programs\startup\hyhghg.exe


AFTER DOING HJT :

No 01 items came up at all.

Then, got into Safe Mode…did like you said…I have a C:\Windows\Temp\ but nothing at all is there.
BUT I do have C:\WINNT\temp and there's stuff there but not sure what to delete..
there's even folders in there, so I didn't delete yet.
Can I somehow send you a screenshot of the directory? I usually do this in PaintShopPro- capture screen.

My C:\documents and settings\ user\local settings\temporary internet files\ , has not much but there's another folder :
Content.IE5 with empty folders: named: KJLOBMN, S5Q7S5EV, and couple others like that…all empty.

All other temp folders in the documents and settings etc. are empty.

Okay… Here's the latest HJT & Output.txt : (by the way no popups from IE lately)! :D

HJT:

Logfile of HijackThis v1.99.0
Scan saved at 12:26:38 PM, on 12/24/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wywuwu.exe
C:\WINNT\system32\atiptaxx.exe
C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe
C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\Program Files\Sierra\Planner\PLNRnote.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\MSAC-FD1\MSSTAT.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\My Download Files\HijackThis.exe
C:\WINNT\system32\wuauclt.exe

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT2:" /M "Stylus C62"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [EPSON Stylus C62 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /A "C:\WINNT\system32\E_S35.tmp"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"
O4 - Startup: ccApp.lnk = C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - Global Startup: CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe
O4 - Global Startup: Event Planner Reminders.lnk = C:\Program Files\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSSTAT.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program Files\ScanSoft\Pagis\Monitor.exe
O4 - Global Startup: starter.lnk = C:\WINNT\system32\starter.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ISEXEng - Unknown - C:\WINNT\system32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINNT\wanmpsvc.exe

OUTPUT.TXT : NOTE: the strings.exe Qoologic and Aspack results show those stubborn files that "didn't" show up when I did Killbox … why?


Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Find-It\Find It NT-2K-XP

——- System Files in System32 Directory ——-
Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/23/2004 05:08p dllcache
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
1 File(s) 32 bytes
1 Dir(s) 33,657,704,448 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/23/2004 05:08p dllcache
12/18/2004 02:45a 4,212 zllictbl.dat
03/20/2004 12:38a 23,148 Atmenuxx.GID
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
02/28/2004 03:26p GroupPolicy
02/28/2004 03:16p 21,692 folder.htt
02/28/2004 03:16p 271 desktop.ini
5 File(s) 49,355 bytes
2 Dir(s) 33,657,704,448 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/24/2004 11:46a 56 guard.tmp
1 File(s) 56 bytes
0 Dir(s) 33,657,704,448 bytes free

——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/24/2004 11:46a 56 guard.tmp
12/19/2004 03:53p 59 E_S35.tmp
09/18/2004 04:26p 1,008 tmpmpt1.tmp
12/07/1999 07:00a 2,577 CONFIG.TMP
4 File(s) 3,700 bytes
0 Dir(s) 33,657,704,448 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\q6pslg7716.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


—————— Locate.com Results ——————

C:\WINNT\SYSTEM32\
zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K

1 item found: 1 file, 0 directories.
Total of file sizes: 4,212 bytes 4.11 K

———— Strings.exe Qoologic Results ————

C:\WINNT\system32\ezepep.dll: updates.qoologic.com
C:\WINNT\system32\hphuhu.exe: updates.qoologic.com

————– Strings.exe Aspack Results ————-

C:\WINNT\system32\wywuwu.exe: .aspack
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\hyhghg.exe: .aspack

—————– HKLM Run Key ——————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE"
"InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h"
"RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE"
"EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\""
"ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
"Narrator"="C:\\WINNT\\system32\\wywuwu.exe"
"CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r"



Post #19
hello again, looking better. hold off on the C:\WINNT\temp for now. stay disconnected from the internet open notepad and copy/paste these two reg entries below REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=- [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD] Save in: Desktop File Name: fixme.reg Save as Type: All files Click: Save now from the desktop, doubleclick the fixme.reg, select yes to merge. —————————— now run pocketkill box again like last time; 1-Click "Replace on Reboot" and check the "2-Use Dummy" box. Paste this file into the top "Full Path of File to Delete" box. C:\WINNT\system32\wywuwu.exe 3-Click the "Delete File" button which looks like a stop sign. 4-Click "Yes" at the Replace on Reboot prompt. 5-Click "No" at the Pending Operations prompt. Repeat steps 1-5 above for these files: C:\WINNT\system32\ezepep.dll C:\WINNT\system32\hphuhu.exe C:\WINNT\System32\guard.tmp when all done; Click "Yes" at the Replace on Reboot prompt. Click "Yes" at the Pending Operations prompt to restart your computer. ———————————————– ok just to make sure, see it you can find these 4 by looking in the dir/folder C:\WINNT\system32\wywuwu.exe C:\WINNT\system32\ezepep.dll C:\WINNT\system32\hphuhu.exe C:\WINNT\System32\guard.tmp if they are there try and delete the files themselves inside the folder, not the folder itself. if present and you cant delete them- try it in SAFE MODE(F8 key at startup) the 010 item in your HJT log will require another download, but we will come back to that. try the above for now, we are making progress. this is my "first" fix of the new vx2 so iam learning also.
Post #20
Hi Shelf,

Made the fixme.reg file like you said with those two Reg. entries, opened it, selected yes to merge.

Ran killbox again to try to get those files…found guard.tmp but not others.. got into Safe mode found them by doing "My Computer" C:\Winnt\system 32\ etc.
deleted these :

ezepep.dll
hphuhu.exe
wywuwu.exe

Restarted and ran findit.bat again and they still show up under Quoologic and Aspack? PLUS…my Recycle bin shows nothing…zilch. Are those files not deleting?

No popups anymore in IE ..we must be getting some progress though! Browser seems not sluggish anymore too.
Found a website with interesting info on VX2 not sure if you've seen it:
http://www.cexx.org/vx2.htm it has some info on fixes I think ? but I don't want to do anything crazy.

Anyway , here is my new Output.txt:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Find-It\Find It NT-2K-XP

——- System Files in System32 Directory ——-
Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/24/2004 05:15p dllcache
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
1 File(s) 32 bytes
1 Dir(s) 33,676,394,496 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/24/2004 05:15p dllcache
12/18/2004 02:45a 4,212 zllictbl.dat
03/20/2004 12:38a 23,148 Atmenuxx.GID
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
02/28/2004 03:26p GroupPolicy
02/28/2004 03:16p 21,692 folder.htt
02/28/2004 03:16p 271 desktop.ini
5 File(s) 49,355 bytes
2 Dir(s) 33,676,394,496 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32


——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/19/2004 03:53p 59 E_S35.tmp
09/18/2004 04:26p 1,008 tmpmpt1.tmp
12/07/1999 07:00a 2,577 CONFIG.TMP
3 File(s) 3,644 bytes
0 Dir(s) 33,676,394,496 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\q6pslg7716.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


—————— Locate.com Results ——————

C:\WINNT\SYSTEM32\
zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K

1 item found: 1 file, 0 directories.
Total of file sizes: 4,212 bytes 4.11 K

———— Strings.exe Qoologic Results ————

C:\WINNT\system32\ezepep.dll: updates.qoologic.com
C:\WINNT\system32\hphuhu.exe: updates.qoologic.com

————– Strings.exe Aspack Results ————-

C:\WINNT\system32\wywuwu.exe: .aspack
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\hyhghg.exe: .aspack

—————– HKLM Run Key ——————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE"
"InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h"
"RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE"
"EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\""
"ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
"Narrator"="C:\\WINNT\\system32\\wywuwu.exe"
"CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r"




We can probably give this a break for now since it's Christmas !!! I want to thank you soooo much for all your help so far! You are really good! :) I'll be back to see what other ideas you have ..I know there must be more fixes to do.

Have a Merry Christmas !
lorjjan4
Post #21
hello LorJJan4,

Merry Christmas!

Yes i have seen the cexx.org site, you have a "new version" of vx2, it can be a pain to get rid of, as you can see. Your browsing is better? no redirects/popups?

iam going to assume that you have rebooted by now, so could you post a new findit output.txt and a new HJT log. also while you are at it download, (but dont run yet) LSPfix.exe from link below: (for the 010 item in your HJT log)

http://www.cexx.org/lspfix.htm

also get:

VX2.betterinternet finder xp/2k
from here:

http://subratam.org/?page=removal

doubleclick it to run, click on >Click to Find Vx2 betterinternet<, it will scan, then select >Make log< and post that log also with the other two.
and we will go back to it!!
Post #22
Hi,
Yea, on that question of the popups, they don't happen like they used to. Maybe a
little bit, depends what sites I go to…but for sure not as often from these bad links
these were the annoying bad guys:
http://www.ad-w-a-r-e.com/normal/yyy12.html
http://hits.clickandtrack.net/cgi-bin/hit?…100721388301255
http://ads1.revenue.net/r?site_id=12324&pplacement_id=1

I have a question on a program that I have that I wonder if it's good or bad..
it's called My Total Search Bar… is it from IE? Should I remove it ?
Also, I used to have Incredimail but got rid of it recently… thought maybe it was a bad thing for spyware to creep in on.


Alright, here we go, here's all new log files:

Logfile of HijackThis v1.99.0
Scan saved at 11:08:38 PM, on 12/25/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\wywuwu.exe
C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe
C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\Program Files\Sierra\Planner\PLNRnote.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\MSAC-FD1\MSSTAT.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\notepad.exe
C:\My Download Files\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program

Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec

Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler]

C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series]

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series"

/O5 "LPT2:" /M "Stylus C62"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card

Factory Deluxe\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec

Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r
O4 - HKLM\..\RunServices: [RegisterDropHandler]

C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [EPSON Stylus C62 Series]

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /A

"C:\WINNT\system32\E_S35.tmp"
O4 - Startup: ccApp.lnk = C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - Global Startup: CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe

7.0\cstray.exe
O4 - Global Startup: Event Planner Reminders.lnk = C:\Program

Files\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image

Transfer\SonyTray.exe
O4 - Global Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSSTAT.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft

Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft

Office\Office\OSA.EXE
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program

Files\ScanSoft\Pagis\Monitor.exe
O4 - Global Startup: starter.lnk = C:\WINNT\system32\starter.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINNT\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) -

http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -

http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate

Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. -

C:\WINNT\System32\dmadmin.exe
O23 - Service: ISEXEng - Unknown - C:\WINNT\system32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation -

C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program

Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. -

C:\WINNT\wanmpsvc.exe



New Output.txt:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Find-It\Find It NT-2K-XP

——- System Files in System32 Directory ——-
Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/25/2004 10:04p dllcache
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
1 File(s) 32 bytes
1 Dir(s) 33,640,833,024 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/25/2004 10:04p dllcache
12/18/2004 02:45a 4,212 zllictbl.dat
03/20/2004 12:38a 23,148 Atmenuxx.GID
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
02/28/2004 03:26p GroupPolicy
02/28/2004 03:16p 21,692 folder.htt
02/28/2004 03:16p 271 desktop.ini
5 File(s) 49,355 bytes
2 Dir(s) 33,640,833,024 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32


——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/19/2004 03:53p 59 E_S35.tmp
09/18/2004 04:26p 1,008 tmpmpt1.tmp
12/07/1999 07:00a 2,577 CONFIG.TMP
3 File(s) 3,644 bytes
0 Dir(s) 33,640,833,024 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User

Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\q6pslg7716.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


—————— Locate.com Results ——————

C:\WINNT\SYSTEM32\
zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K

1 item found: 1 file, 0 directories.
Total of file sizes: 4,212 bytes 4.11 K

———— Strings.exe Qoologic Results ————

C:\WINNT\system32\ezepep.dll: updates.qoologic.com
C:\WINNT\system32\hphuhu.exe: updates.qoologic.com

————– Strings.exe Aspack Results ————-

C:\WINNT\system32\wywuwu.exe: .aspack
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\hyhghg.exe: .aspack

—————– HKLM Run Key ——————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE"
"InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h"
"RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE"
"EPSON Stylus C62

Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON

Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\""
"ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory

Deluxe\\ReminderApp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"

-osboot"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security

Center\\UsrPrmpt.exe"
"Narrator"="C:\\WINNT\\system32\\wywuwu.exe"
"WheelMouse"="C:\\PROGRA~1\\HARDWA~1\\Mouse\\Amoumain.exe"
"iKeyWorks"="C:\\PROGRA~1\\HARDWA~1\\Keyboard\\Ikeymain.exe"
"CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r"





Log for VX2.BetterInternet File Finder (ALL)

Files Found—

Additional Files—

Keys Under Notify—
crypt32chain
cryptnet
cscdll
MCD
sclgntfy
SensLogn
wzcnotif


Guardian Key— is called:

Guardian Key— :

User Agent String—
{3F2B631E-FBB7-4805-9311-395CED10EFFE}


Okay that's it!

Lorjjan4
Post #23
hello again,

ok i would print this or copy it to a txt file where you can get to it.
stay disconnected from the internet, if you have a cable/dsl modem i would pull the plug for now.
My Total Search Bar, yes get rid of it via the add/remove programs panel, if you are asked to reboot during the uninstall, chose no. (we will reboot later)
ok the log:

make sure all your files are set to show:

Double-click "My Computer".
Click the "Tools" menu and select "Options".
When the "Folder Options" multi-tabbed dialog box appears, select the "View" tab.
Uncheck "Hide protected operating system files".
Select the "Show hidden files and folders" radio button.
Press OK to close the dialog box.
———————————————————————————————–
copy the following to notepad, save to desktop as type "all files" and call it fixme.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User

Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]


doubleclick the fixme reg you saved to the desktop.

from the desktop bring up task manager by hitting ctrl-alt-delete keys– under task manager tab look for the following 3 files under the applications and processes tab if present select and end process or task;

C:\WINNT\system32\ezepep.dll
C:\WINNT\system32\wywuwu.exe
C:\WINNT\system32\angelex.exe
C:\\WINNT\\system32\q6pslg7716.dll

now browse to the C:\WINNT\system32 folder and delete the above .dll and .exe files.

if they cant be deleted open kill box and paste the full path of the file into killbox. select delete on reboot then press red x, when it says delete on next reboot, select yes, when asked to reboot now select no, after pasting in the last one select yes to reboot.
————————————————————————————
ok next:
run LSPfix.exe that you downloaded:

make sure you click the "I know what I'm doing" button. Select calsp.dll. and using the right-pointing 'arrows'– move all instances of calsp.dll- and nothing else to the Remove side but leave everything else (it might already be over there when you open LSPFix). Click the 'Finished' button (if you exit with the X at top right nothing happens).

is your recylce bin functioning ok? from the destop right click chose> new>text document>then delete it from the desktop and see if it appears in the recyle bin and that you can delete it from there.
afterwards post new output file form findit. and HJT log……………
Post #24
Okay,
Right away I printed your instructions, (been doing that everytime lately), logged off internet then unplugged modem connection.

Did the fixme.reg file with those entries… saved to Desktop..etc.

In task manager only one present was ezepep.dll.. tried to delete but it gave me an error saying cannot delete already in use by Windows…

So did Killbox with those files…put down pull path. ..after last one did reboot.

Okay, ran Lspfix added the calsp.dll to remove side and clicked finish.

I created the new text document and deleted it but it doesn't show up in my Recycle bin. Nothing does.
BUT when I use my "GenDiskCleaner" tool and tick the recycle bin …it'll ask :
"Do you want to delete (whatever number) files? It will show a number. It never shows any files when I open Recycle bin though.


Here's my latest logfiles….

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Find-It\Find It NT-2K-XP

——- System Files in System32 Directory ——-
Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/26/2004 01:44p dllcache
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
1 File(s) 32 bytes
1 Dir(s) 33,097,940,992 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/26/2004 01:44p dllcache
12/18/2004 02:45a 4,212 zllictbl.dat
03/20/2004 12:38a 23,148 Atmenuxx.GID
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
02/28/2004 03:26p GroupPolicy
02/28/2004 03:16p 21,692 folder.htt
02/28/2004 03:16p 271 desktop.ini
5 File(s) 49,355 bytes
2 Dir(s) 33,097,940,992 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32


——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/19/2004 03:53p 59 E_S35.tmp
09/18/2004 04:26p 1,008 tmpmpt1.tmp
12/07/1999 07:00a 2,577 CONFIG.TMP
3 File(s) 3,644 bytes
0 Dir(s) 33,097,940,992 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User

Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\q6pslg7716.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


—————— Locate.com Results ——————

C:\WINNT\SYSTEM32\
zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K

1 item found: 1 file, 0 directories.
Total of file sizes: 4,212 bytes 4.11 K

———— Strings.exe Qoologic Results ————

C:\WINNT\system32\ezepep.dll: updates.qoologic.com
C:\WINNT\system32\hphuhu.exe: updates.qoologic.com

————– Strings.exe Aspack Results ————-

C:\WINNT\system32\wywuwu.exe: .aspack
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\hyhghg.exe: .aspack

—————– HKLM Run Key ——————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE"
"InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h"
"RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE"
"EPSON Stylus C62

Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON

Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\""
"ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory

Deluxe\\ReminderApp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"

-osboot"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security

Center\\UsrPrmpt.exe"
"Narrator"="C:\\WINNT\\system32\\wywuwu.exe"
"WheelMouse"="C:\\PROGRA~1\\HARDWA~1\\Mouse\\Amoumain.exe"
"iKeyWorks"="C:\\PROGRA~1\\HARDWA~1\\Keyboard\\Ikeymain.exe"
"CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r"






Logfile of HijackThis v1.99.0
Scan saved at 2:11:52 PM, on 12/26/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Program Files\Sierra\Planner\PLNRnote.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hyhghg.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\MSAC-FD1\MSSTAT.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\My Download Files\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program

Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec

Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler]

C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series]

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series"

/O5 "LPT2:" /M "Stylus C62"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card

Factory Deluxe\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec

Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r
O4 - HKLM\..\RunServices: [RegisterDropHandler]

C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [EPSON Stylus C62 Series]

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /A

"C:\WINNT\system32\E_S35.tmp"
O4 - Startup: ccApp.lnk = C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - Global Startup: CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe

7.0\cstray.exe
O4 - Global Startup: Event Planner Reminders.lnk = C:\Program

Files\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image

Transfer\SonyTray.exe
O4 - Global Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSSTAT.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft

Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft

Office\Office\OSA.EXE
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program

Files\ScanSoft\Pagis\Monitor.exe
O4 - Global Startup: starter.lnk = C:\WINNT\system32\starter.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) -

http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -

http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate

Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. -

C:\WINNT\System32\dmadmin.exe
O23 - Service: ISEXEng - Unknown - C:\WINNT\system32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation -

C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program

Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. -

C:\WINNT\wanmpsvc.exe
Post #25
hello again LorJJan4,

ok, one more time:

copy the following to notepad, save to desktop as type "all files" and call it fixmeagain.reg. thendouble click it to merge:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User

Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Narrator"=-


Open Killbox

Select Option>> Replace on Reboot

Copy & paste the full path of each of the files below into the Killbox topmost box.


C:\WINNT\System32\zllictbl.dat

With the full path to the file name in the topmost textbox, click the option Use Dummy which will create a numbered dummy file.

Click the Red X …and for the confirmation message that will appear– click Yes
A second message will ask to Reboot now? you will need to click No (since you are not finished adding all related files in yet)

Do this for each file in the list

On that last file, close all programs and Reboot your computer.

C:\WINNT\system32\wywuwu.exe
C:\WINNT\system32\ezepep.dll
C:\WINNT\system32\hphuhu.exe
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\hyhghg.exe
C:\\WINNT\\system32\\q6pslg7716.dll

then post new output.txt file, we will get to the recycle bin after these #^@#$#$ are gone………….
Post #26
Hi Shelf, Wow, we got some changes happening! and I think for the better! :D Did everything you said… the last time I did the fixme.reg file it might not have worked because I added the word QUOTE in it… duh! Stupit me. <_< Okay, so got those files in Killbox and then after last file rebooted… Ok, now this is the weird part…. At windows startup I got a weird error message : It said something like this: 16 bit MS DOS Subsystem C:\WINNT\system32\wywuwu.exe NTVDM CPU has made an illegal instruction CS:053a lP: ffe2 OP: feff1e 0906 Choose close to terminate So I had choice to close or ignore, I just clicked close. Then everything acted okay afterwards and ran findit.bat and here are my results… GOOD NEWS! :) those files under quoologic/aspack are GONE! Now I hope I don't have any "other" problem files! Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Find-It\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/26/2004 01:44p dllcache 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 1 File(s) 32 bytes 1 Dir(s) 33,614,336,000 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/26/2004 01:44p dllcache 03/20/2004 12:38a 23,148 Atmenuxx.GID 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 02/28/2004 03:26p GroupPolicy 02/28/2004 03:16p 21,692 folder.htt 02/28/2004 03:16p 271 desktop.ini 4 File(s) 45,143 bytes 2 Dir(s) 33,614,336,000 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 03:53p 59 E_S35.tmp 09/18/2004 04:26p 1,008 tmpmpt1.tmp 12/07/1999 07:00a 2,577 CONFIG.TMP 3 File(s) 3,644 bytes 0 Dir(s) 33,614,336,000 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{3F2B631E-FBB7-4805-9311-395CED10EFFE}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————— Locate.com Results —————— No matches found. ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "AtiPTA"="atiptaxx.exe" "ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE" "InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h" "RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE" "EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\"" "ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "Narrator"="C:\\WINNT\\system32\\wywuwu.exe" "WheelMouse"="C:\\PROGRA~1\\HARDWA~1\\Mouse\\Amoumain.exe" "iKeyWorks"="C:\\PROGRA~1\\HARDWA~1\\Keyboard\\Ikeymain.exe" "CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r" 
Post #27
hello again,

thats good news.
lets check something, can you browse in explorer to this .exe file:

C:\WINNT\system32\wywuwu.exe

once there- right click on it and select properties then check for any info under the tabs.
sometimes this may provide a clue, then post new output.txt and HJT log,
also go to 1 or 2 of these sites, browse for the .exe above and have it checked out with a online scanner.

http://www.ravantivirus.com/scan/indexn.php
http://virusscan.jotti.dhs.org/
http://www.virustotal.com/xhtml/index_en.html
Post #28
Shelf,

I checked the properties of this wywuwu file and nothing looked strange.. just
said file type-application, 56 bytes, there's alot of tabs for different settings,
etc.
Here's the results from one of the online scan sites… The other scan-sites, one
site was down, and the other site said my file was too large. This scan shows that
the file wywuwu.exe is OK. At the bottom of my output.txt file it still pops up
under Narrator (?). Also that 023 item under HJT file -the angelex.exe , we tried to
get rid of that one I thought.


RAV AntiVirus command line for Linux i386.
Version: 8.4.3.
Copyright © since 1995 GeCAD The Software Company. All rights reserved.

Scan engine 8.11 for i386.
Last update: Sun, 26 Dec 2004 13:54:41 +0200
Scanning for 110162 malwares (viruses, trojans and worms).

Scan started on Mon Dec 27 20:16:42 2004

wywuwu.exe - OK

Scan ended on Mon Dec 27 20:16:42 2004


Scan results:
Time: 0 second(s).
Objects scanned: 1. New objects: 1
Infected: 0. Different virus bodies: 0.
Files: 1. Directories: 0. Archives: 0. Packed: 0. Mail files: 0.
Warnings: 0.
————————————————————————————-

Should I do a scan again in Ad-Aware , see if things are looking better from there
too ?

Here's my latest Output.txt file and HJT below:


Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\Find-It\Find It NT-2K-XP

——- System Files in System32 Directory ——-
Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/27/2004 10:03a dllcache
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
1 File(s) 32 bytes
1 Dir(s) 33,667,612,672 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/27/2004 10:03a dllcache
03/20/2004 12:38a 23,148 Atmenuxx.GID
03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat
02/28/2004 03:26p GroupPolicy
02/28/2004 03:16p 21,692 folder.htt
02/28/2004 03:16p 271 desktop.ini
4 File(s) 45,143 bytes
2 Dir(s) 33,667,612,672 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32


——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 00B8-A5AB

Directory of C:\WINNT\System32

12/19/2004 03:53p 59 E_S35.tmp
09/18/2004 04:26p 1,008 tmpmpt1.tmp
12/07/1999 07:00a 2,577 CONFIG.TMP
3 File(s) 3,644 bytes
0 Dir(s) 33,667,612,672 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User

Agent\Post Platform]
"{3F2B631E-FBB7-4805-9311-395CED10EFFE}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


—————— Locate.com Results ——————

No matches found.

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE"
"InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h"
"RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE"
"EPSON Stylus C62

Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON

Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\""
"ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory

Deluxe\\ReminderApp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"

-osboot"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security

Center\\UsrPrmpt.exe"
"Narrator"="C:\\WINNT\\system32\\wywuwu.exe"
"WheelMouse"="C:\\PROGRA~1\\HARDWA~1\\Mouse\\Amoumain.exe"
"iKeyWorks"="C:\\PROGRA~1\\HARDWA~1\\Keyboard\\Ikeymain.exe"
"CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r


Latest HJT file:

Logfile of HijackThis v1.99.0
Scan saved at 1:40:28 PM, on 12/27/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe
C:\Program Files\Sierra\Planner\PLNRnote.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\MSAC-FD1\MSSTAT.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\ntvdm.exe
C:\My Download Files\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program

Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec

Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler]

C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [EPSON Stylus C62 Series]

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series"

/O5 "LPT2:" /M "Stylus C62"
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card

Factory Deluxe\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec

Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wywuwu.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\HARDWA~1\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\HARDWA~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r
O4 - HKLM\..\RunServices: [RegisterDropHandler]

C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [EPSON Stylus C62 Series]

C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /A

"C:\WINNT\system32\E_S35.tmp"
O4 - Startup: ccApp.lnk = C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - Global Startup: CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe

7.0\cstray.exe
O4 - Global Startup: Event Planner Reminders.lnk = C:\Program

Files\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: hyhghg.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image

Transfer\SonyTray.exe
O4 - Global Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSSTAT.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft

Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft

Office\Office\OSA.EXE
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program

Files\ScanSoft\Pagis\Monitor.exe
O4 - Global Startup: starter.lnk = C:\WINNT\system32\starter.exe
O8 - Extra context menu item: &Copy Location - C:\WINNT\WEB\graburl.htm
O9 - Extra button: (no name) - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} -

C:\WINNT\system32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone -

{B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINNT\system32\webzone.dll
O9 - Extra button: (no name) - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} -

C:\WINNT\system32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone -

{BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINNT\system32\webzone.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Offline - {FC09D8A3-C85A-11d2-92D0-0000F87A4A55} -

C:\WINNT\system32\oline.dll
O15 - Trusted Zone: *.amazon.com
O15 - Trusted Zone: *.breasthealthonline.org
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) -

http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -

http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate

Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. -

C:\WINNT\System32\dmadmin.exe
O23 - Service: ISEXEng - Unknown - C:\WINNT\system32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation -

C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program

Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. -

C:\WINNT\wanmpsvc.exe
Post #29
hello LorJJan4, good work. i cant find any reference to wywuwu.exe, thats why i think it needs to go. scan with HJT, put a checkmark beside the items below, close all windows and click fix checked. if you dont see these options:click on the None of the above, just start the program button. Close all open windows except HiJackThis and press 'Fix Checked' O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wywuwu.exe O4 - Global Startup: hyhghg.exe O23 - Service: ISEXEng - Unknown - C:\WINNT\system32\angelex.exe ———————————————————– ok now boot into SAFE MODE by tapping F8 key at restart, chose safe mode. once in safe mode find and delete wywuwu.exe located>>C:\WINNT\system32 you can check again for this one>> C:\WINNT\system32\angelex.exe but it looks like its gone. reboot normally and yes run ad aware again. also there is a newer version of IE out now v6.0
Post #30
Okay. I'll get right to those, I want to you to see what came up today when I ran this other program I have -(Spybot -search & destroy)….you might find it interesting… eXact Advertising.BargainsBuddy: Executable (File, nothing done) C:\WINNT\system32\instsrv.exe eXact Advertising.BargainsBuddy: Executable (File, nothing done) C:\WINNT\bbchk.exe eXact Advertising.BargainsBuddy: <$REG_SERVICE> (Registry key, nothing done) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ISEXEng eXact Advertising.BargainsBuddy: <$REG_SERVICE> (Registry key, nothing done) HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ISEXEng DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-21-220523388-2111687655-839522115-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 eAcceleration: Program group (Directory, nothing done) C:\Documents and Settings\user\Start Menu\Programs\filesubmit\ — Spybot - Search && Destroy version: 1.3 — 2004-11-29 Includes\Cookies.sbi 2004-12-15 Includes\Dialer.sbi 2004-12-16 Includes\Hijackers.sbi 2004-12-15 Includes\Keyloggers.sbi 2004-05-12 Includes\LSP.sbi 2004-12-15 Includes\Malware.sbi 2004-11-29 Includes\Revision.sbi 2004-11-29 Includes\Security.sbi 2004-12-16 Includes\Spybots.sbi 2004-11-29 Includes\Tracks.uti 2004-12-15 Includes\Trojans.sbi I checked them all hit remove , then rebooted. At Startup I've gotten that error message again.. 16-bit MS DOS Subsystem ..etc. for the C:/Winnt/system32/wywuwu.exe. Ok, I'll do your latest instructions and BRB.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI