What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

About:blank Keeps On Comin'

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Greetings. Unable to shed 'about:blank' and re-loading (and unwanted) favorites on IE 6.0. Previous attempts to clean up with AdAware and Spybot S&D have failed.

HijackThis Log as follows. Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 12:09:00 AM, on 3/25/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Comcast\Security Manager\app\Prism.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\crcg.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\system32\TridTray.Exe
C:\WINNT\ieyk32.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Mark VanWagner\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\diuyl.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\AUserInit.exe
O2 - BHO: (no name) - {BD24D4EE-A788-D059-D3EB-03A230A03688} - C:\WINNT\adddm32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PBReboot] c:\windows\rundll.exe c:\windows\system\setupx.dll,InstallHinfSection DefaultInstall 2 c:\windows\reboot.inf
O4 - HKLM\..\Run: [TridTray] TridTray.Exe
O4 - HKLM\..\Run: [ieyk32.exe] C:\WINNT\ieyk32.exe
O4 - Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: ComcastHSI - {55115FE6-33AE-4F7D-A2D2-162E1C6AA4F5} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Support - {876E60E4-B886-4E2D-A2A8-99BB468BA4BD} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: Help - {CF855F93-166F-45E4-8FFF-E6692C62B738} - http://online.comcast.net/help/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O15 - Trusted Zone: my.monster.com
O15 - Trusted Zone: www.monster.com
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Post #2
Please read through the instructions before you start (you may want to print this out).

Please download and install these programs - don't run them yet!!

Please download and unzip
AboutBuster to a folder. Inside the folder is a readme file that has instructions on the use of the program.
AboutBuster MUST be updated before you use it.
Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box . Don't run it yet.

Download and unzip cwsserviceremove to your desktop. use link below:
http://lineofire.geekstogo.com/cwsserviceremove.zip

Download CW-Shredder at the link below:
http://cwshredder.net/bin/CWShredder.exe

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Reboot into SafeMode. <—MAKE SURE YOU KNOW HOW TO DO THIS!!

+++++++++++++++++++++++++++++++++++++++++++++++++

Here's the fix:

Important Step
1. Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
Remote Procedure Call (RPC) Helper

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

2. Reboot into Safe Mode

3. Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:

crcg.exe
ieyk32.exe


If you find the files, click on them, and then click End Process => Exit the Task Manager.

4. CLOSE ALL WINDOWS AND BROWSERS Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\diuyl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\diuyl.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\diuyl.dll/sp.html#28129
O2 - BHO: (no name) - {BD24D4EE-A788-D059-D3EB-03A230A03688} - C:\WINNT\adddm32.dll
O4 - HKLM\..\Run: [ieyk32.exe] C:\WINNT\ieyk32.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted Zone: my.monster.com
O15 - Trusted Zone: www.monster.com
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)

Click on Fix Checked and exit HijackThis.

5. Delete the following files if present:

C:\WINNT\atlnr.exe
C:\WINNT\diuyl.dll
C:\WINNT\adddm32.dll
C:\WINNT\ieyk32.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.

6. Run AboutBuster . This will scan your computer for the bad files and delete them. It will ask to scan the system again, let it. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

7. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

8. Double click on the cwsserviceremove and when asked to merge say yes.

9. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

10. Reboot into normal mode.

11. Download and run this online virus scan:
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you check "AutoClean"

12. Reboot and post a fresh HJT log back here by using the add reply button below, and lets see how we did, MrC
Post #3
Thank you for the post. I have followed this complete set of instructions, and have the following notes. (Not entirely sure what is relevant, but here we go….)

Double-clicking on Remote Procedure Call (RPC) Helper resulted in a "Configuration Manager: General Internal Error Occured" message, but was still able to disable.

crcg.exe and ieyk32.exe were not present in task manager / processes

O23 - Service: Remote Procedure Call (RPC) Helper…. was absent upon running HJT (?)

c:/winnt/atlnr.exe and …adddm32.dll were not found; other 2 files were, and deleted

CW Shredder showed "Cool Web Search not found on system"

Was unable to download and run the virus scan at the trendmicro.com site; system kept closing Internet Explorer each time I would attempt to visit

IE defaulted to google.com on initial reboot, but has since returned to about:blank; the bookmarks are still there, but I have not attempted to remove them yet.

I have pasted the AboutBuster and final HJT logs below.

Thanks for your continued help,
Mark


++++++++++


Scanned at: 11:42:55 AM on: 3/26/2005


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 25


ADS not scanned System(FAT)
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 25


ADS not scanned System(FAT)
Attempted Clean Of Temp folder.
Pages Reset… Done!

++++++++++

Logfile of HijackThis v1.99.1
Scan saved at 12:16:30 PM, on 3/26/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Comcast\Security Manager\app\Prism.exe
C:\WINNT\Explorer.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\system32\TridTray.Exe
C:\WINNT\system32\addxa.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINNT\netmp32.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Security Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\txavx.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\AUserInit.exe
O2 - BHO: (no name) - {3AEB5456-729E-65FE-4197-626FCC697C3C} - C:\WINNT\system32\ipsg32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PBReboot] c:\windows\rundll.exe c:\windows\system\setupx.dll,InstallHinfSection DefaultInstall 2 c:\windows\reboot.inf
O4 - HKLM\..\Run: [TridTray] TridTray.Exe
O4 - HKLM\..\Run: [addxa.exe] C:\WINNT\system32\addxa.exe
O4 - HKLM\..\RunOnce: [netmp32.exe] C:\WINNT\netmp32.exe
O4 - HKLM\..\RunOnce: [ntry.exe] C:\WINNT\ntry.exe
O4 - Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ComcastHSI - {55115FE6-33AE-4F7D-A2D2-162E1C6AA4F5} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Support - {876E60E4-B886-4E2D-A2A8-99BB468BA4BD} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: Help - {CF855F93-166F-45E4-8FFF-E6692C62B738} - http://online.comcast.net/help/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Post #4
Lets try it in normal mode:

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

addxa.exe
netmp32.exe

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\txavx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\txavx.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\txavx.dll/sp.html#28129
O2 - BHO: (no name) - {3AEB5456-729E-65FE-4197-626FCC697C3C} - C:\WINNT\system32\ipsg32.dll
O4 - HKLM\..\Run: [addxa.exe] C:\WINNT\system32\addxa.exe
O4 - HKLM\..\RunOnce: [netmp32.exe] C:\WINNT\netmp32.exe
O4 - HKLM\..\RunOnce: [ntry.exe] C:\WINNT\ntry.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)

Click on Fix Checked and exit HijackThis.

Delete these files if found:

C:\WINNT\system32\addxa.exe
C:\WINNT\system32\ipsg32.dll
C:\WINNT\netmp32.exe
C:\WINNT\atlnr.exe
C:\WINNT\txavx.dll
C:\WINNT\ntry.exe
C:\WINNT\netmp32.exe

(and any other files with the same name that end in .dll, .exe or .dat, you may find them right next to each other, example - appsw.exe, appsw.dll, appsw.dat)
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.


Now run AboutBuster again.

Then run the Shredder

Reboot and post back a fresh HijackThis log and we'll take another look, MrC
Post #5
Hello again. Successfully completed your above instructions with the following notes/exceptions. Noticed the homepage defaulted to google.com again, but I haven't done anything else but jump directly to this forum.

In HJT, this was absent (so obviously wasn't checked and fixed):
O4 - HKLM\..\RunOnce……ntry.exe

Files NOT found for deletion:
C:\WINNT\system32\ipsg32.dll
C:\WINNT\atlnr.exe

Also, no other filenames with different extensions were discovered.

Thanks again,
Mark

+++++

Logfile of HijackThis v1.99.1
Scan saved at 10:16:47 AM, on 3/28/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Comcast\Security Manager\app\Prism.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\addxe32.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\system32\TridTray.Exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Security Downloads\HijackThis.exe
C:\WINNT\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\AUserInit.exe
O2 - BHO: (no name) - {EB55178B-266F-2B2D-F74E-A0C929E3935F} - C:\WINNT\system32\crmx32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PBReboot] c:\windows\rundll.exe c:\windows\system\setupx.dll,InstallHinfSection DefaultInstall 2 c:\windows\reboot.inf
O4 - HKLM\..\Run: [TridTray] TridTray.Exe
O4 - Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ComcastHSI - {55115FE6-33AE-4F7D-A2D2-162E1C6AA4F5} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Support - {876E60E4-B886-4E2D-A2A8-99BB468BA4BD} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: Help - {CF855F93-166F-45E4-8FFF-E6692C62B738} - http://online.comcast.net/help/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

+++++

Scanned at: 10:10:37 AM on: 3/28/2005


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 25


ADS not scanned System(FAT)
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 25


ADS not scanned System(FAT)
Attempted Clean Of Temp folder.
Pages Reset… Done!
Post #7
AboutBuster isn't finding and deleting any files, that's the problem.

Download and unzip the KillBox to a folder - we'll use it later.

Reboot into safe mode.

1. Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
Remote Procedure Call (RPC) Helper

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

addxe32.exe
ntvdm.exe

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {EB55178B-266F-2B2D-F74E-A0C929E3935F} - C:\WINNT\system32\crmx32.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)

Click on Fix Checked and exit HijackThis.

Now open up the KillBox and copy and paste each one of these in and hit delete, if the file exists, it will appear in blue under the window.

C:\WINNT\system32\addxe32.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\atlnr.exe
C:\WINNT\system32\crmx32.dll

Now run AboutBuster and the Shredder.

As an alternative method to get this hijacker….

Download and run Spybot and AdAware, links below have instructions and links:

http://russelltexas.com/malware/spybot13/spybot13.htm <–Spybot
http://russelltexas.com/malware/adawarese/adawarese.htm <–AdAware

http://forum.malwareremoval.com/viewtopic.php?t=13 <—Both


Reboot and post a fresh HijackThis log and we'll take another look. MrC
Post #8
OK, here we go…

(I already have the versions of AdAware and Spybot listed, but checked for updates, then proceeded according to the instructions on the russelltexas website.)

about:blank is still showing as of last reboot;
also, got popups indicating "C:\WINNT\ipwl32.exe" and "C:\windows\rundll.exe" were not found.

RPC Helper was disabled, but same error message was given ("Configuration Manager: General Internal Error Occured") in doing so.

addxe32.exe and ntvdm.exe NOT present under task mgr.

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
was again absent running HJT.

C:\WINNT\atlnr.exe
C:\WINNT\system32\crmx32.dll
not found through KillBox.

All other files found and fixed/deleted in HJT & KillBox.


Thanks again for your continued help,
Mark

+++++

Logfile of HijackThis v1.99.1
Scan saved at 1:48:18 PM, on 3/29/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Comcast\Security Manager\app\Prism.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\ntqk.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\system32\TridTray.Exe
C:\WINNT\system32\crpm32.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Security Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\uaoso.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\AUserInit.exe
O2 - BHO: (no name) - {AFF6C66E-EC6A-79E4-1BCD-61F49118B9CE} - C:\WINNT\system32\ipyu32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PBReboot] c:\windows\rundll.exe c:\windows\system\setupx.dll,InstallHinfSection DefaultInstall 2 c:\windows\reboot.inf
O4 - HKLM\..\Run: [TridTray] TridTray.Exe
O4 - HKLM\..\Run: [crpm32.exe] C:\WINNT\system32\crpm32.exe
O4 - Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ComcastHSI - {55115FE6-33AE-4F7D-A2D2-162E1C6AA4F5} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Support - {876E60E4-B886-4E2D-A2A8-99BB468BA4BD} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: Help - {CF855F93-166F-45E4-8FFF-E6692C62B738} - http://online.comcast.net/help/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Post #9
Hang in there for now, I'm going to contact the person who created AboutBuster and see if he can give use some advice.

The procedure we are using is correct and has worked many times but for some reason AboutBuster is not working here.

I'll get back to you asap.

Thanks, MrC
Post #10
OK I contacted Rubber Ducky the creator of AboutBuster so hopefully he'll get back to us.

Lets do this while we are waiting:

HowToShowHiddenFiles - <—enable this


Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:

ntqk.exe
crpm32.exe

If you find the files, click on them, and then click End Process => Exit the Task Manager.



Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\uaoso.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\uaoso.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\uaoso.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {AFF6C66E-EC6A-79E4-1BCD-61F49118B9CE} - C:\WINNT\system32\ipyu32.dll
O4 - HKLM\..\Run: [crpm32.exe] C:\WINNT\system32\crpm32.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)

Click on Fix Checked and exit HijackThis.

Delete these files if found:

C:\WINNT\atlnr.exe
C:\WINNT\uaoso.dll
C:\WINNT\system32\ipyu32.dll
C:\WINNT\system32\crpm32.exe

Reboot and post a fresh HijackThis log and we'll take another look. MrC
Post #11
Thanks for going the extra mile; this is certainly an annoying problem.

Hidden file instructions were already completed; those check boxes (or lack thereof) are still in place.

Prompted for rundll.exe upon reboot again, if that is relevant.

ntqk.exe and crpm32.exe were ended

all selections for HJT found and deleted

uaoso.dll and crpm32.exe found and deleted; other 2 were not found


Thanks again,
Mark

+++++

Logfile of HijackThis v1.99.1
Scan saved at 10:23:37 AM, on 3/30/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Comcast\Security Manager\app\Prism.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\ntqk.exe
C:\WINNT\mste.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\system32\TridTray.Exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Security Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\AUserInit.exe
O2 - BHO: (no name) - {9B55D29F-0137-085F-0C25-C369179408EE} - C:\WINNT\system32\atloc32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PBReboot] c:\windows\rundll.exe c:\windows\system\setupx.dll,InstallHinfSection DefaultInstall 2 c:\windows\reboot.inf
O4 - HKLM\..\Run: [TridTray] TridTray.Exe
O4 - Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ComcastHSI - {55115FE6-33AE-4F7D-A2D2-162E1C6AA4F5} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Support - {876E60E4-B886-4E2D-A2A8-99BB468BA4BD} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: Help - {CF855F93-166F-45E4-8FFF-E6692C62B738} - http://online.comcast.net/help/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Post #12
Rubber Ducky has gotten back to me and says:

There is no real way of detecting why AboutBuster isn't finding the files. Perhaps the filesizes vary. Please ask the user to zip up and submit the files that you are asking to remove manually.

Address to send it to submit at malwarebytes dot biz

Just substitute @ for at and . for dot
This is to protect the address from spammers
Include this link in the message when you send it so he know where it's from:
http://forums.tomcoyote.org/index.php?show…33&#entry146233
If you can do that it will help in the development of the program.

————————————————————————

But it looks like we are making progress.

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:



C:\WINNT\system32\ntqk.exe
C:\WINNT\mste.exe

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {9B55D29F-0137-085F-0C25-C369179408EE} - C:\WINNT\system32\atloc32.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)

Click on Fix Checked and exit HijackThis.

Delete these files if found:

C:\WINNT\system32\atloc32.dll
C:\WINNT\system32\ntqk.exe
C:\WINNT\mste.exe
C:\WINNT\atlnr.exe


Reboot and post a fresh HijackThis log and we'll take another look. MrC
Post #13
Can you let me know exactly what I should be zipping and sending to him? I know from the thread what we're attempting here, but I don't want to miss anything if it will help with AB's development. Then I'll get on your next set of instructions! Thanks, Mark
Post #14
Sorry, any of these files and of the others you deleted if they're still in the recycle bin.
If you used the KillBox to delete any files, they will be in a folder called "!submit" found in C:

Delete these files if found:

C:\WINNT\system32\atloc32.dll
C:\WINNT\system32\ntqk.exe
C:\WINNT\mste.exe
C:\WINNT\atlnr.exe


Thanks, MrC
Post #15
OK….

Have forwarded several emails.

This time around:

ntqk.exe process ended
mste.exe not found

all 3 items checked and fixed, HJT

atloc32.dll & atlnr.exe not found;
found mste.exe.bak, rather than mste.exe, did not delete, probably should have;
UNABLE to delete ntqk.exe, popup indicated it might "be running," archive attribute was checked, read-only was not checked

Thanks again,
Mark

+++++

Logfile of HijackThis v1.99.1
Scan saved at 12:06:11 PM, on 3/31/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Comcast\Security Manager\app\Prism.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\ntqk.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\WINNT\system32\TridTray.Exe
C:\WINNT\system32\atluf.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Security Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\gvagl.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\gvagl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\gvagl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\gvagl.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\gvagl.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\gvagl.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINNT\system32\AUserInit.exe
O2 - BHO: (no name) - {1DF6F759-A37F-233E-D7C5-4616756486A6} - C:\WINNT\sdkqo32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PBReboot] c:\windows\rundll.exe c:\windows\system\setupx.dll,InstallHinfSection DefaultInstall 2 c:\windows\reboot.inf
O4 - HKLM\..\Run: [TridTray] TridTray.Exe
O4 - HKLM\..\Run: [atluf.exe] C:\WINNT\system32\atluf.exe
O4 - Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ComcastHSI - {55115FE6-33AE-4F7D-A2D2-162E1C6AA4F5} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Support - {876E60E4-B886-4E2D-A2A8-99BB468BA4BD} - http://www.comcastsupport.com/ (file missing) (HKCU)
O9 - Extra button: Help - {CF855F93-166F-45E4-8FFF-E6692C62B738} - http://online.comcast.net/help/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\atlnr.exe (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI