Spyware Help Please

Move Hijackthis off your desktop (extract from zip)into a permanent folder. Example:
c:\program files\hijackthis\hijackthis.exe

This will allow backups to be made and saved By hijackthis in case something goes wrong.

Place a check next to the following entries, then close all open windows except hijackthis and click fix.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {881F90B9-7D7E-476F-9DF9-79281D361734} - C:\WINDOWS\system32\bkddnb.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {430F89FC-2A4C-45F0-982D-40ADCAF332CD} - C:\WINDOWS\system32\bkddnb.dll
O18 - Filter: text/plain - {430F89FC-2A4C-45F0-982D-40ADCAF332CD} - C:\WINDOWS\system32\bkddnb.dll

Then reboot into safe mode and delete these files.
C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll

You may have to enable hidden files to find all the files.

Then reboot and run another hijackthis and post your new log here.

Move Hijackthis off your desktop (extract from zip)into a permanent folder. Example:
c:\program files\hijackthis\hijackthis.exe

This will allow backups to be made and saved By hijackthis in case something goes wrong.

Place a check next to the following entries, then close all open windows except hijackthis and click fix.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {1C0F7FFA-EACD-421E-B5B4-E224FCD8BF8B} - C:\WINDOWS\system32\bkddnb.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {864E7CB1-5EDB-42CA-8DBA-7107F451245D} - C:\WINDOWS\system32\bkddnb.dll
O18 - Filter: text/plain - {864E7CB1-5EDB-42CA-8DBA-7107F451245D} - C:\WINDOWS\system32\bkddnb.dll

Then reboot into safe mode and delete these files.
C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll

You may have to enable hidden files to find all the files.

Then reboot and run another hijackthis and post your new log here.

Looks like you might have one that has a hidden component running that reinstalls the problem. So lets have a look.

Copy the following bold text into Notepad.
Name the file Appinit.bat
Save as type All Files
Save on the Desktop.

Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
ren windows1.hiv windows.txt


Double click on Appinit.bat
This will create a file on the desktop named windows.txt
(the text in the file will look strange, don't worry about it, just make sure you copy the whole thing)

Then download this program.

http://downloads.subratam.org/DllCompare.exe

Open the program and click the "Run Locate.com" button.
Then click the "Compare" button (this will take a few minutes)
When it finishes click the "Make Log…." button.

Copy and paste the log along with the contents of windows.txt to your next post.

I think you may have found it, here is the dll compare log * DLLCompare Log version() Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\d3dheb.dll Wed Feb 18 2004 8:22:04p A…. 21,504 21.00 K ________________________________________________ 1,323 items found: 1,323 files, 0 directories. Total of file sizes: 278,310,688 bytes 265.41 M Administrator Account = True ——————–End log——————— And this is the windows.txt that was created regf




Pugf hbin  ¨ÿÿÿnk, ‚^ȆöÃ
ÿÿÿÿ ÿÿÿÿÿÿÿÿ @ x ÿÿÿÿ 0 > i m  Windows Èþÿÿsk x x


”

  ì   
  !  €
  !   
  #  €
  #  ? 
    
    ? 

  

  ? 
    


  

 Øÿÿÿvk > Ø


fùAppInit_DLLs֍æG¸ÿÿÿc : \ w i n d o w s \ s y s t e m 3 2 \ d 3 d h e b . d l l  °
Ðÿÿÿvk  X

ÀUDeviceNotSelectedTimeoutðÿÿÿ1 5  @ ðÿÿÿ9 0  ¸| Ðÿÿÿvk  €' 
zGDIProcessHandleQuota"þàÿÿÿvk  È

°ºSpooler2ðÿÿÿy e s Èn  °
( x ¨ ð àÿÿÿvk  €

=pswapdiskÐÿÿÿvk  h

R¿TransmissionRetryTimeoutàÿÿÿ°
( x ¨ ð  ` Ðÿÿÿvk  €' 
i USERProcessHandleQuotai p Thanks again.

I will want samples of the files that we have found on your computer so, I want you to create a folder on your desktop that we can put copies of the files in and you can send to me later.

Right click in an open area on your desktop and select new then folder. Name the folder submit. Locate these two files.

C:\WINDOWS\system32\bkddnb.dll
C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll

Right click on them one at a time and select copy. Then open your submit folder and right click in it and select paste.

I will ask for a third file in a little bit.

Download this batch file inside a zip.
After you have downloaded the file, immediately sign off the internet and stay off until all steps are finished.

http://computercops.biz/modules.php?name=F…ownload&id=1183

Extract the batch file (hiving.bat) and run it. If you have script blocking enabled you will get a warning. Please allow this to run. The script is just producing a message box. Double click on the batch to run it. After a reboot the super hidden nasty file will no longer be loaded and will be visible. This will end the constant reinstall of about:Blank.

You run XP Home and so you will restart into safe mode .

Restart into Safe mode and find this file:
C:\WINDOWS\System32\d3dheb.dll

Make a copy of it and add it to your submit folder the same way you did the other two.

Then right click on the file and select properties.
Use the security tab to take ownership.
Change the 'everyone special' to
'you> with Admin rights-> FULL control
Then try to delete it, if that fails try to rename
it first to different name+ext.
Example:
log.dll>bleh.txt
bleh.txt > badfile.111

Once you have successfully deleted the file restart into Regular Windows mode.

Run another hijackthis scan. Place a check next to the following entries, then close all other windows and click the fix button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll/p.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {170065FE-D717-4F3D-BB35-3B08C2B375F2} - C:\WINDOWS\system32\bkddnb.dll
O18 - Filter: text/plain - {170065FE-D717-4F3D-BB35-3B08C2B375F2} - C:\WINDOWS\system32\bkddnb.dll

Then locate these files and delete them;
C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll
C:\WINDOWS\system32\bkddnb.dll

You may have to enable hidden files to find all the files.

Then reboot and run another hijackthis scan and post your new log here.

Zip the submit folder and email it to me at racktrackerATnet-integration.net
Note you will have to change the AT to @ for the address to work.

Thanks for the help Racktracker Unfortunately I couldn't follow the first step as I could not locate C:\WINDOWS\system32\bkddnb.dll on my computer. I found C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll no problem. Also, I am not sure if it matters or not, but I'm running XP Pro. In the meantime I am going to restart in safe mode and see if I can locate bkddnb.dll

Racktracker I ran through the instructions, even though I could not find C:\WINDOWS\system32\bkddnb.dll. After I restarted in safe mode I could not locate the file c:\WINDOWS|System32\d3dheb.dll either. I continued on though and everything went fine until the end. I could not delete C:\DOCUME~1\Eric\LOCALS~1\Temp\se.dll, and I could not find C:\WINDOWS\system32\bkddnb.dll

Post a new hijackthis log and a dll compare log so I can see what needs to be done.

Did you download and run hiving.bat from the link I posted?

Yes, I did and if it helps I made a log before it closed. Here it is. Working ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Appinit_Dlls REG_SZ The operation completed successfully The operation completed successfully The operation completed successfully ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotWindows The operation completed successfully ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotWindows Appinit_Dlls REG_SZ The operation completed successfully ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotWindows Error: The system was unable to find the specified registry key or value The operation completed successfully The operation completed successfully The operation completed successfully ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs REG_SZ The operation completed successfully ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows USERProcessHandleQuota REG_DWORD 0x2710

Normally the file can be seen after running hiving.bat, so I just wanted to check.

Lets give this a try.

Download SpSeHjfix from this link.

http://www.derbilk.de/SpSeHjfix110.zip

Extract the file from zip to your desktop.

Open the program and click start disinfection.

The program will reboot your computer to complete the process.

When it has finished a log report will be created on your desktop. Post the log along with a new hijackthis log.