Help With Log

Hi and welcome to the forum.

First click here>>> http://cexx.org/lspfix.htm to download LSPFix. Extract the program from the zip file and run it, make sure you click the "I know what I'm doing" button. Select aklsp.dll
and calsp.dll
using the right-pointing 'arrows' and move all instances of aklsp.dll
and calsp.dll[/B it mentions to the Remove (RHS) side but leave everything else (it might already be over there when you open LSPFix). Click the 'Finished' button (if you exit with the X at top right nothing happens).


REBOOT to complete the task.

First, enable the viewing of Hidden Files and Folders as follows:
-At your Desktop, go to Start>My Computer
-Select the Tools menu and then Folder Options
-After the new window appears select the View tab
-Select: Display the contents of system folders
-Under the Hidden files and folders section select: Show hidden files and folders
-Remove the checkmark from Hide file extensions for known file types
-Remove the checkmark from Hide protected operating system files (Recommended)
-Press the Apply button
Click OK



NEXT

Please download Vx2 Finder and safe it to its own folder. http://downloads.subratam.org/VX2Finder(126).exe
Run VX2Finder(126).exe
Select: Click to Find VX2.Betterinternet
When the scan is done, select the Make Log
Copy the log and post it.

NEXT

Download Find_It.zip:
http://computercops.biz/zx/Zupe/Find%20It%20NT-2K-XP.zip
Unzip its contents to its own folder
Open the folder and double click on Find.bat (File with a gear symbol)
Ignore any File not found messages
It runs for a minute, and produces a log
Please copy and paste the log on your next response.

NEXT

Also, download KillBox.zip from the link below.
http://www.subratam.org/?page=removal
Place it in a folder on your Desktop.
Do not run it yet.

NEXT

Please look in your sytem32 folder and let me know if the below file is preset.

C:\Windows\system32\guard.tmp

NEXT

Post all the logs and DO NOT REBOOT or Shutdown please.

THanks for the help. Here is my VX2 log. Log for VX2.BetterInternet File Finder (msg126) Files Found— Additional Files— Keys Under Notify— crypt32chain cryptnet cscdll igfxcui Installer ScCertProp Schedule sclgntfy SensLogn termsrv wlballoon Guardian Key— is called: User Agent String— {0F34C91C-904E-436F-A518-A1D52A47968C}

FindIt.zip log Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Documents and Settings\[removed]\Desktop\Find It NT-2K-XP\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 01/01/2005 04:02 PM 223,203 fbntsub.dll 01/01/2005 04:01 PM 223,112 gp4ol3h31.dll 01/01/2005 03:08 PM 223,203 dnr0019me.dll 01/01/2005 03:00 PM 224,657 ir4ql5h51.dll 01/01/2005 02:53 PM 224,924 l2j8lc1u1f.dll 01/01/2005 02:46 PM 224,486 m4pole731h.dll 12/30/2004 04:57 PM DLLCACHE 12/29/2004 12:02 AM 224,611 mvr4l99q1.dll 12/10/2004 12:53 AM 56,320 pjxhz.dll 11/29/2004 09:28 PM 224,803 lvj8091ue.dll 11/29/2004 09:27 PM 223,984 nNrrhook.dll 11/29/2004 11:21 AM 223,984 alivtmxx.dll 11/29/2004 04:41 AM 224,205 fppu0379e.dll 11/29/2004 04:38 AM 224,017 hr8s05l7e.dll 11/28/2004 08:08 PM 224,767 hrn8055ue.dll 12/04/2003 12:26 PM Microsoft 14 File(s) 2,970,276 bytes 2 Dir(s) 29,579,640,832 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 12/30/2004 04:57 PM DLLCACHE 12/10/2004 12:53 AM 56,320 pjxhz.dll 11/15/2004 03:41 PM 488 logonui.exe.manifest 11/15/2004 03:41 PM 488 WindowsLogon.manifest 11/15/2004 03:41 PM 749 nwc.cpl.manifest 11/15/2004 03:41 PM 749 sapi.cpl.manifest 11/15/2004 03:41 PM 749 ncpa.cpl.manifest 11/15/2004 03:41 PM 749 cdplayer.exe.manifest 11/15/2004 03:41 PM 749 wuaucpl.cpl.manifest 8 File(s) 61,041 bytes 1 Dir(s) 29,579,640,832 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 07/16/2003 12:25 PM 2,577 CONFIG.TMP 06/19/2002 05:39 PM 384 ~GLH001a.TMP 06/19/2002 03:39 PM 25,088 ~GLH001b.TMP 3 File(s) 28,049 bytes 0 Dir(s) 29,579,632,640 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{0F34C91C-904E-436F-A518-A1D52A47968C}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Installer] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\dnr0019me.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————— Locate.com Results —————— C:\WINDOWS\SYSTEM32\ alivtmxx.dll Mon Nov 29 2004 11:21:48a ..S.R 223,984 218.73 K cdplay~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K dnr001~1.dll Sat Jan 1 2005 3:08:04p ..S.R 223,203 217.97 K fbntsub.dll Sat Jan 1 2005 4:02:02p ..S.R 223,203 217.97 K fppu03~1.dll Mon Nov 29 2004 4:41:50a ..S.R 224,205 218.95 K gp4ol3~1.dll Sat Jan 1 2005 4:01:04p ..S.R 223,112 217.88 K hr8s05~1.dll Mon Nov 29 2004 4:38:34a ..S.R 224,017 218.77 K hrn805~1.dll Sun Nov 28 2004 8:08:06p ..S.R 224,767 219.50 K ir4ql5~1.dll Sat Jan 1 2005 3:00:16p ..S.R 224,657 219.39 K l2j8lc~1.dll Sat Jan 1 2005 2:53:04p ..S.R 224,924 219.65 K logonu~1.man Mon Nov 15 2004 3:41:42p A..HR 488 0.48 K lvj809~1.dll Mon Nov 29 2004 9:28:18p ..S.R 224,803 219.53 K m4pole~1.dll Sat Jan 1 2005 2:46:02p ..S.R 224,486 219.22 K mvr4l9~1.dll Wed Dec 29 2004 12:02:06a ..S.R 224,611 219.34 K ncpacp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K nnrrhook.dll Mon Nov 29 2004 9:27:04p ..S.R 223,984 218.73 K nwccpl~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K pjxhz.dll Fri Dec 10 2004 12:53:08a A.SH. 56,320 55.00 K sapicp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K window~1.man Mon Nov 15 2004 3:41:42p A..HR 488 0.48 K wuaucp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K 21 items found: 21 files, 0 directories. Total of file sizes: 2,974,997 bytes 2.84 M ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe" "Logitech Utility"="Logi_MwX.Exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "VSOCheckTask"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcmnhdlr.exe\" /checktask" "VirusScan Online"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe\"" "MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe" "MCUpdateExe"="C:\\PROGRA~1\\McAfee.com\\Agent\\mcupdate.exe" "ss8Q3sg"="makkeng.exe" "UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\ 6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" 

The file C:\Windows\system32\guard.tmp is not on my computer.

First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)

Next, launch Notepad, and copy/paste all the blue REGEDIT below to it
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{0F34C91C-904E-436F-A518-A1D52A47968C}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Installer]

• Download the Pocket Killbox.
• Unzip the contents of KillBox.zip to a convenient location.
• Double-click on KillBox.exe.
• Click "Replace on Reboot" and check the "Use Dummy" box.
• Paste this file into the top "Full Path of File to Delete" box.
  • C:\\WINDOWS\\system32\\dnr0019me.dll
• Click the "Delete File" button which looks like a stop sign.
• Click "Yes" at the Replace on Reboot prompt.
• Click "No" at the Pending Operations prompt.
• Repeat steps 4-8 above for these files:
  • C:\WINDOWS\System32\fbntsub.dll
  • C:\WINDOWS\System32\gp4ol3h31.dll
  • C:\WINDOWS\System32\dnr0019me.dll
  • C:\WINDOWS\System32\ir4ql5h51.dll
  • C:\WINDOWS\System32\l2j8lc1u1f.dll
  • C:\WINDOWS\System32\m4pole731h.dll
  • C:\WINDOWS\System32\mvr4l99q1.dll
  • C:\WINDOWS\System32\pjxhz.dll
  • C:\WINDOWS\System32\lvj8091ue.dll
  • C:\WINDOWS\System32\nNrrhook.dll
  • C:\WINDOWS\System32\alivtmxx.dll
  • C:\WINDOWS\System32\fppu0379e.dll
  • C:\WINDOWS\System32\hr8s05l7e.dll
  • C:\WINDOWS\System32\hrn8055ue.dll
• Click "Replace on Reboot" and check the "Use Dummy" box.
• Paste this file into the top "Full Path of File to Delete" box.
  • C:\WINDOWS\System32\Guard.tmp
• Click the "Delete File" button which looks like a stop sign.
• Click "Yes" at the Replace on Reboot prompt.
• Click "Yes" at the Pending Operations prompt to restart your computer.
• Double-click on find.bat and post the new output.txt.

NEXT

Since this intruder may alter the Hosts file, download the Hoster to restore the file:
http://members.aol.com/toadbee/hoster.zip
Select: Restore Original Hosts
Click OK and exit Hoster.

Download AdAware SE from the following link:
http://www.majorgeeks.com/download506.html
-Use the: 'Check for Updates Now' option and download the latest reference files
-Use the Start button, and on the next window, select: Perform Full System Scan
-Press Next, and let Ad-aware scan the hard drive
-When finished, right-click the window with the entries, choose: Select All from the menu, and click Next.
-Once AdAware has removed the entries, close the program
Restart the computer

Also, check the Recycle Bin to see if it works properly. A side effect of VX2 is to sometimes damage the Recycle Bin operation.
Create an blank Notepad file on the Desktop: right click the Desktop, select New>Text Document
Right click the text document and delete it.
When a file is deleted, it should ask if you want to send it to Recycle Bin.
Does it ask if you want to send the file to the Recycle Bin, or, does the file just get deleted?
Post back what it does.

When done with all of the above, close all windows and browsers, run HijackThis, Scan, post a new HijackThis log, and a new Find_It log.

If you encounter any problems with the steps above, please describe them.

New log from running find.bat Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Documents and Settings\[removed]\Desktop\Find It NT-2K-XP\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 12/30/2004 04:57 PM DLLCACHE 12/04/2003 12:26 PM Microsoft 0 File(s) 0 bytes 2 Dir(s) 29,598,875,648 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 12/30/2004 04:57 PM DLLCACHE 11/15/2004 03:41 PM 488 logonui.exe.manifest 11/15/2004 03:41 PM 488 WindowsLogon.manifest 11/15/2004 03:41 PM 749 nwc.cpl.manifest 11/15/2004 03:41 PM 749 sapi.cpl.manifest 11/15/2004 03:41 PM 749 ncpa.cpl.manifest 11/15/2004 03:41 PM 749 wuaucpl.cpl.manifest 11/15/2004 03:41 PM 749 cdplayer.exe.manifest 7 File(s) 4,721 bytes 1 Dir(s) 29,598,875,648 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 01/01/2005 06:07 PM 223,203 guard.tmp 1 File(s) 223,203 bytes 0 Dir(s) 29,598,875,648 bytes free ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 01/01/2005 06:07 PM 223,203 guard.tmp 07/16/2003 12:25 PM 2,577 CONFIG.TMP 06/19/2002 05:39 PM 384 ~GLH001a.TMP 06/19/2002 03:39 PM 25,088 ~GLH001b.TMP 4 File(s) 251,252 bytes 0 Dir(s) 29,598,871,552 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{0F34C91C-904E-436F-A518-A1D52A47968C}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsUpdate] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\gp4ol3h31.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————— Locate.com Results —————— C:\WINDOWS\SYSTEM32\ cdplay~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K logonu~1.man Mon Nov 15 2004 3:41:42p A..HR 488 0.48 K ncpacp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K nwccpl~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K sapicp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K window~1.man Mon Nov 15 2004 3:41:42p A..HR 488 0.48 K wuaucp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K 7 items found: 7 files, 0 directories. Total of file sizes: 4,721 bytes 4.61 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe" "Logitech Utility"="Logi_MwX.Exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "VSOCheckTask"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcmnhdlr.exe\" /checktask" "VirusScan Online"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe\"" "MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe" "MCUpdateExe"="C:\\PROGRA~1\\McAfee.com\\Agent\\mcupdate.exe" "ss8Q3sg"="makkeng.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1"

Can i see a new hijackthis log please.

I wanted to make sure I had didn't need to post another Find_It log.

Please boot to safe mode (tap f8 while bios loads) then scan with hijackthis and put a check beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [ss8Q3sg] makkeng.exe
O4 - HKCU\..\Run: [dBr4RiM8i] lz3usx.exe

O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)

Then while still in safe mode delete these files

makkeng.exe
lz3usx.exe

Reboot

Now for the recycle bin.

• Download VX2Finder.
• Double-click on VX2Finder.exe.
• Click "Restore Policy".
• In the File menu click "Exit".
• Double-click on KillBox.exe.
• In the File menu click "Delete all Dummy files".
• In the Tools menu click "Delete Temp Files".
• Choose "Standard File Kill" if not already selected.
• Paste these files one by one into the top "Full Path of File to Delete" box.
  • C:\RECYCLER\desktop.ini
  • C:\WINDOWS\System32\drivers\etc\HOSTS
• Click the "Delete File" button which looks like a stop sign.
• Click "Yes" at the Confirm Delete prompt.
• It should give you a successful "File was deleted" prompt for each one.

Then reboot and post a new hijackthis log, should be the last.

when i'm on anything with a scrollbar the page sometimes still has a mind of its own scrolling up and down. i'm not sure if that relates to any of the problems we're trying to fix, but thought i'd mention it if it might. thanks again.

WEll lets do an old fashion scan now that the worst are gone.

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/downloadget.php?…7fd6b3ff02edc90

REBOOT

Step #2

Please download and run Spybot & AdAware SE Then follow the instructions in the link below to run.

Spybot & Adaware Tutorial

REBOOT

Step # 3

Then do a virus scan here >>> Trend Micro

Reboot and post a new HiJackThis log.