Backdoor-bdi, Help Please

Still not looking any better.


Download the trial version of TDS-3
Install it, but do not launch it yet

Update it hereright click, select "save as"

Save it to the directory where you installed TDS-3, overwriting the previous radius.td3.

Then launch TDS-3. in the top bar of tds window click system testing> full system scan.
detections will appear in the lower pane of tds window. after the scan is finished ( it'll take a while )
right click the list> select save as txt. save it and post the contents of the scandump.txt here.

After posting the scandump go ahead and right click the list of detections again. this time select delete!
Only delete those with positive identification.

little eagle, Here is the TS scan dump. I was unable to delete the file c:\windows\system32\dolsp.dll. It was identified as a Trojan downloader. Is there a next step? Again, many thanks for your help on this. Thanks, Gloria Scan Control Dumped @ 13:06:30 13-02-05 (DELETED) Positive identification: Adware.Broadcap.a File: c:\program files\bpt\bpt.exe (DELETED) Positive identification: Adware.DealHelper.v File: c:\windows\system32\secure.exe (DELETED) Positive identification: Adware.DealHelper.t File: c:\documents and settings\gloria admin\local settings\temp\13a.tmp (DELETED) Positive identification: Adware.DealHelper.t File: c:\documents and settings\gloria admin\local settings\temp\15.tmp (DELETED) Positive identification: Adware.DealHelper.t File: c:\documents and settings\gloria admin\local settings\temp\1a.tmp (DELETED) Positive identification: Adware.DealHelper.t File: c:\documents and settings\gloria admin\local settings\temp\1c.tmp (DELETED) Positive identification: Adware.DealHelper.t File: c:\documents and settings\gloria admin\local settings\temp\47.tmp (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glf1b9glf1b9.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glf1c9glf1c9.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glf2fglf2f.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glf42glf42.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glf4eglf4e.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glf9dglf9d.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glfd2glfd2.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\documents and settings\gloria admin\local settings\temp\glfe2glfe2.exe (DELETED) Positive identification: Adware.BetterInternet File: c:\documents and settings\gloria admin\local settings\temp\drtemp\thnall1b.exe.tcf Suspicious Filename: Dual extensions File: c:\documents and settings\gloria admin\my documents\art project ideas\collage ninabagleydesign.com.doc Suspicious Filename: Dual extensions File: c:\documents and settings\gloria admin\my documents\art project ideas\www.cafeshops.com.doc Suspicious Filename: Dual extensions File: c:\documents and settings\gloria admin\my documents\stuff for sean\document scrap 'all_ double_ dou…'.shs (DELETED) Positive identification: Adware.Broadcap.a File: c:\program files\bpt\bpt.exe (DELETED) Positive identification: Adware.Broadcap.a Dropper.a File: c:\program files\bpt\bptre_inst.exe (DELETED) Positive identification: Adware.Broadcap.a File: c:\program files\common files\java\bpt.cfg (DELETED) Positive identification: Riskware.ProcessRestart File: c:\program files\logitech\desktop messenger\8876480\6.1.4.36-8876480l\program\restart.exe (DELETED) Positive identification : Possible WebDownloader File: c:\program files\online services\msn50\msnboot.exe (DELETED) Positive identification: Riskware.Proxy.Hltv File: c:\sierra\half-life\hltv.exe (DELETED) Positive identification (DLL): Adware.BiSpy.t (dll) File: c:\windows\btgrab.dll.tcf (DELETED) Positive identification (DLL): Adware.BiSpy.t (dll) File: c:\windows\btgrab.dll7620.tcf (DELETED) Positive identification: TrojanDropper.Win32.Small.mr File: c:\windows\bundles\saie1101.exe.tcf (DELETED) Positive identification: TrojanDownloader.Win32.Small.wj File: c:\windows\bundles\shopinst.exe (DELETED) Positive identification: TrojanDropper.Win32.SurfSide.a File: c:\windows\bundles\ssk_b5.exe (DELETED) Positive identification: Adware.BetterInternet File: c:\windows\bundles\thin-8-1-x-x.exe.tcf (DELETED) Positive identification: TrojanDownloader.Win32.Small.wj File: c:\windows\bundles\videoinst.exe (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\aspartners.dll (DELETED) Positive identification: Adware.BetterInternet File: c:\windows\system32\betterinternet1.exe.tcf (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\c8002idmg80a2.dll (DELETED) Positive identification: TrojanDownloader.Win32.Agent.hc File: c:\windows\system32\crysrcwp.exe.tcf Positive identification (DLL): TrojanDownloader.Win32.Agent.br2 (dll) File: c:\windows\system32\dolsp.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\en00l1dm1.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\en6sl1j71.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\fbtlib.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\fp6003jme.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\guard.tmp (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\hrpm0571e.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\l60ulgd9160.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\m4460ehseh460.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\m4nq0e55eh.dll (DELETED) Positive identification: Trojan.Win32.Agent.ay File: c:\windows\system32\mzajyvol.exe.tcf (DELETED) Positive identification: Trojan.Win32.Agent.ay File: c:\windows\system32\mzajyvol.exe6626.tcf (DELETED) Positive identification: Adware.Adstart.c2 File: c:\windows\system32\rerrsd.exe (DELETED) Positive identification (DLL): Adware.Adstart.c2 (dll) File: c:\windows\system32\rjcyp.dll (DELETED) Positive identification: Adware.Adstart.c2 File: c:\windows\system32\rjcypd.exe (DELETED) Positive identification: Adware.Adstart.b2 File: c:\windows\system32\rjcypf.exe (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\sci_ci.dll (DELETED) Positive identification: Adware.DealHelper.v File: c:\windows\system32\secure.exe (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\windows\system32\targetsavers.exe (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\vjgaview.dll (DELETED) Positive identification (DLL): Adware.Look2Me.u (dll) File: c:\windows\system32\wnnmm.dll (DELETED) Positive identification: TrojanDownloader.Win32.TSUpdate.f Dropper.b File: c:\windows\system32\mssysapps\targetsavers.exe (DELETED) Positive identification: Adware.DelphinMediaViewer.c File: c:\windows\system32\vmss\vmss.exe.tcf (DELETED) Positive identification (DLL): Adware.DelfinMediaViewer (dll) File: c:\windows\system32\wsxsvc\wsx.ocx (DELETED) Positive identification: Adware.DelphinMediaViewer.c1 File: c:\windows\system32\wsxsvc\wsxsvc.exe.tcf (DELETED) Positive identification: Adware.BetterInternet File: c:\windows\temp\drtemp\mm_reco.exe.tcf (DELETED) Positive identification: Adware.BetterInternet File: c:\windows\temp\drtemp\wupdsnff.exe.tcf Suspicious Filename: Dual extensions File: d:\c\david office backup\drivers\hpdeskjetg85xi\cdimage\setup\motive\install.wse.exe Suspicious Filename: Dual extensions File: d:\c\drivers\hpdeskjetg85xi\cdimage\setup\motive\install.wse.exe Suspicious Filename: Dual extensions File: d:\c\hp\bin\python-2.2.1.exe (DELETED) Positive identification: Riskware.ProcessRestart File: d:\c\program files\backweb\backweb client\6.2.3.66\program\restart.exe (DELETED) Positive identification : Possible WebDownloader File: d:\c\program files\common files\microsoft shared\office11\msoxmled.exe Suspicious Filename: Dual extensions File: d:\c\program files\installshield installation information\pc-doctor\reln1.05.011.doc Suspicious Filename: HTA file in suspicious location File: d:\c\program files\microsoft money\system\discover.hta Suspicious Filename: HTA file in suspicious location File: d:\c\program files\microsoft money\system\lnpg.hta (DELETED) Positive identification : Possible WebDownloader File: d:\c\program files\microsoft office\office11\msohtmed.exe (DELETED) Positive identification (DLL): Adware.WebEx (dll) File: d:\c\program files\webex\ieatgpc.dll Suspicious Filename: Dual extensions File: d:\c\recycler\s-1-5-21-1643855648-901463496-641774078-1003\dc4\docuprep\readme_files\image002.jpg.vbs Suspicious Filename: Dual extensions File: d:\c\winpointinstallfolder\install\docuprep\readme_files\image002.jpg.vbs Suspicious Filename: Dual extensions File: d:\gloria's backups\(20a660f6) my documents\art project ideas\collage ninabagleydesign.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\(20a660f6) my documents\art project ideas\www.cafeshops.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\(20a660f6) my documents\art projects\collage ninabagleydesign.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\(20a660f6) my documents\art projects\www.cafeshops.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\(20a660f6) my documents\stuff for sean\document scrap 'all_ double_ dou…'.shs Suspicious Filename: Dual extensions File: d:\gloria's backups\gloria strauss\my documents\art projects\collage ninabagleydesign.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\gloria strauss\my documents\art projects\www.cafeshops.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\gloria strauss\my documents\stuff for sean\document scrap 'all_ double_ dou…'.shs Suspicious Filename: Dual extensions File: d:\gloria's backups\my documents\art project ideas\collage ninabagleydesign.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\my documents\art project ideas\www.cafeshops.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\my documents\art projects\collage ninabagleydesign.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\my documents\art projects\www.cafeshops.com.doc Suspicious Filename: Dual extensions File: d:\gloria's backups\my documents\stuff for sean\document scrap 'all_ double_ dou…'.shs

Post another HijackThis log.

Did you reboot after the scans? Reboot in safe mode and get a log from hijackthis. Save it Reboot again and save another log. Post both of them back here.

Should you need instructions for ;
Showing hidden files and folders in Windows.
Reboot in safe mode.
How to set up a HijackThis folder correctly to make backups.
Scan with Spybot S&D and Ad-Aware
How To Print Fix Instructions
Click the underlined links above.


If they are still there

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes:

C:\WINDOWS\system32\ofanqs\plkor.exe
C:\WINDOWS\system32\jyds\jgcexls.exe
C:\WINDOWS\system32\okftx\rnddh.exe

Exit the Task Manager when finished


Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll (file missing)
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [rjcypc] C:\WINDOWS\system32\rjcypc.exe
O4 - HKLM\..\Run: [rerrsc] C:\WINDOWS\system32\rerrsc.exe
O4 - HKLM\..\Run: [x77X3ni] cssvtmsg.exe
O4 - HKLM\..\Run: [bcflbm] C:\WINDOWS\system32\mxrxdjd\bcflbm.exe
O4 - HKLM\..\Run: [pjlndwcm] C:\WINDOWS\system32\pqrpxda\pjlndwcm.exe
O4 - HKLM\..\Run: [iqamv] C:\WINDOWS\system32\vkrp\iqamv.exe
O4 - HKLM\..\Run: [dwcxx] C:\WINDOWS\system32\jbaybeue\dwcxx.exe
O4 - HKLM\..\Run: [BPT] "C:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [bgpjnqd] C:\WINDOWS\system32\tpga\bgpjnqd.exe
O4 - HKLM\..\Run: [hqgrkcr] C:\WINDOWS\system32\opjh\hqgrkcr.exe
O4 - HKLM\..\Run: [yxts] C:\WINDOWS\system32\iavycl\yxts.exe
O4 - HKLM\..\Run: [sbjdn] C:\WINDOWS\system32\xrtqovbj\sbjdn.exe
O4 - HKLM\..\Run: [kdvpx] C:\WINDOWS\system32\tnfs\kdvpx.exe
O4 - HKLM\..\Run: [yvem] C:\WINDOWS\system32\wqwxltur\yvem.exe
O4 - HKLM\..\Run: [hfwje] C:\WINDOWS\system32\wxrtnw\hfwje.exe
O4 - HKLM\..\Run: [rjmttne] C:\WINDOWS\system32\ugvnajvm\rjmttne.exe
O4 - HKLM\..\Run: [Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\system32\secure.exe


The following activeX controls( Download Program Files)will reinstall when(and if) you revisit that website,
UNLESS you know they are from a safe source, check to remove.

Reboot in safe mode.
Delete the following file(s) listed.
Then click start>my computer>local disk
(then follow the path)
or useWindows Explorer, locate the following files/folders, and delete them:

C:\WINDOWS\system32\wsxsvc
C:\WINDOWS\system32\rjcypc.exe
C:\WINDOWS\system32\rerrsc.exe
cssvtmsg.exe(do a search for this one. It'll probably be in c:\windows or c:\windows\system32.)
C:\WINDOWS\system32\mxrxdjd\bcflbm.exe
C:\WINDOWS\system32\pqrpxda\pjlndwcm.exe
C:\WINDOWS\system32\vkrp\iqamv.exe
C:\WINDOWS\system32\jbaybeue\dwcxx.exe
C:\WINDOWS\system32\tpga\bgpjnqd.exe
C:\WINDOWS\system32\opjh\hqgrkcr.exe
C:\WINDOWS\system32\iavycl\yxts.exe
C:\WINDOWS\system32\xrtqovbj\sbjdn.exe
C:\WINDOWS\system32\tnfs\kdvpx.exe
C:\WINDOWS\system32\wqwxltur\yvem.exe
C:\WINDOWS\system32\wxrtnw\hfwje.exe
C:\WINDOWS\system32\ugvnajvm\rjmttne.exe
C:\WINDOWS\system32\secure.exe

Delete the folder(s) listed

C:\Program Files\Bpt
C:\PROGRA~1\COMMON~1\tsa


Still In safe mode navigate to the
C:\Windows\Temp folder. Open the Temp folder and go to
Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Do not delete the folder it self!!

Next navigate to the
C:\Documents and Settings\(EVERY USER)\Local Settings\Temp folder.
Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Again do not deleete the folder it self!!

Finally go to Control Panel > Internet Options.
On the General tab under "Temporary Internet Files" Click "Delete Files".
Put a check by "Delete Offline Content" and click OK.
Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

You may want to Download and install CCleaner
Under windows tab check internet explorer, windows explorer, and system.
then click Run Cleaner.

Reboot and Rescan with HJT and post a new log here.
Also please describe how your computer behaves now.

Download LSPfix here: http://www.cexx.org/lspfix.htm

Start the program and then check the I know what I'm doing box.

Move all instances of
dolsp.dll
(and nothing else), to the Remove pane.
Click the Finish Button and reboot.

Find and delete the file c:\windows\system32\dolsp.dll


Sorry if you fix this any other way you may not be able to access the internet .
Guess you found that out .

Then post another log.

Reboot in SAFE MODE.
Some of these files and folders might have hidden atributes.
Delete the following file(s) listed in
C:\WINDOWS\system32\ofanqs\plkor.exe
C:\WINDOWS\system32\jyds\jgcexls.exe
C:\WINDOWS\system32\wers\kbyr.exe
C:\WINDOWS\system32\okftx\rnddh.exe

Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O4 - HKLM\..\Run: [agrdyo] C:\WINDOWS\system32\bnoyqj\agrdyo.exe
O4 - HKLM\..\Run: [plkor] C:\WINDOWS\system32\ofanqs\plkor.exe
O4 - HKLM\..\Run: [jgcexls] C:\WINDOWS\system32\jyds\jgcexls.exe
O4 - HKLM\..\Run: [kbyr] C:\WINDOWS\system32\wers\kbyr.exe
O4 - HKLM\..\Run: [rnddh] C:\WINDOWS\system32\okftx\rnddh.exe

Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment

If this doesn't work will bring out another tool.

btw - do you ever sleep? I have seen your postings since early AM.

I post replies when I drink coffee. Then do new logs when I have time.
Then try to repy to new ones before I go to bed. Today I was just making changes to my PC all day.


This log looks clean. Can you boot in safe mode and get another log.
If you have teatimer running turn it off and then start it up again.