What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

About:Blank StartPage-DU.dll

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
my computer has been sacked by the good ole About:Blank virus. I attempted to fix it myself after reading up on other posts with the same problem, but the virus keeps coming back. So this is my first post with a Hijackthis log. Any help you can provide is greatly appreciated! Im done with IE, now trying FireFox and Opera.

I have the following programs installed and updated on my PC ready to go:

- CWShredder 2.15
- about:buster
- adaware SE
- Hijackthis 1.99.1
- Mcafee Virus Scan 8.0

I just need to know:

- what is the procedure (in what order) should everything be run? (should this all be done in safe mode? when to reboot? etc.)
- what files need to be deleted/fixed through hijackthis?

Logfile of HijackThis v1.99.1
Scan saved at 9:30:16 PM, on 7/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\winzx32.exe
C:\Documents and Settings\Smalls\Desktop\Fix\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {A743397C-15FF-B350-E883-BF7404029D99} - C:\WINDOWS\system32\ntuy32.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [d3qv32.exe] C:\WINDOWS\system32\d3qv32.exe
O4 - HKLM\..\Run: [winzx32.exe] C:\WINDOWS\winzx32.exe
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\RunOnce: [crtc.exe] C:\WINDOWS\crtc.exe
O4 - HKLM\..\RunOnce: [crci32.exe] C:\WINDOWS\system32\crci32.exe
O4 - HKLM\..\RunOnce: [netik.exe] C:\WINDOWS\netik.exe
O4 - HKLM\..\RunOnce: [nthq32.exe] C:\WINDOWS\system32\nthq32.exe
O4 - HKLM\..\RunOnce: [atlmm32.exe] C:\WINDOWS\system32\atlmm32.exe
O4 - HKLM\..\RunOnce: [msro32.exe] C:\WINDOWS\msro32.exe
O4 - HKLM\..\RunOnce: [sdkhy.exe] C:\WINDOWS\system32\sdkhy.exe
O4 - HKLM\..\RunOnce: [msgt32.exe] C:\WINDOWS\system32\msgt32.exe
O4 - HKLM\..\RunOnce: [ntto.exe] C:\WINDOWS\system32\ntto.exe
O4 - HKLM\..\RunOnce: [winut.exe] C:\WINDOWS\winut.exe
O4 - HKLM\..\RunOnce: [netnl32.exe] C:\WINDOWS\system32\netnl32.exe
O4 - HKLM\..\RunOnce: [iepx32.exe] C:\WINDOWS\iepx32.exe
O4 - HKLM\..\RunOnce: [javaon.exe] C:\WINDOWS\system32\javaon.exe
O4 - HKLM\..\RunOnce: [ntfb32.exe] C:\WINDOWS\ntfb32.exe
O4 - HKLM\..\RunOnce: [iebl.exe] C:\WINDOWS\iebl.exe
O4 - HKLM\..\RunOnce: [apptm32.exe] C:\WINDOWS\system32\apptm32.exe
O4 - HKLM\..\RunOnce: [appih.exe] C:\WINDOWS\appih.exe
O4 - HKLM\..\RunOnce: [netml32.exe] C:\WINDOWS\system32\netml32.exe
O4 - HKLM\..\RunOnce: [iphk32.exe] C:\WINDOWS\iphk32.exe
O4 - HKLM\..\RunOnce: [netps.exe] C:\WINDOWS\system32\netps.exe
O4 - HKLM\..\RunOnce: [sdkxo.exe] C:\WINDOWS\sdkxo.exe
O4 - HKLM\..\RunOnce: [mfcwd32.exe] C:\WINDOWS\system32\mfcwd32.exe
O4 - HKLM\..\RunOnce: [winmt32.exe] C:\WINDOWS\winmt32.exe
O4 - HKLM\..\RunOnce: [crjs32.exe] C:\WINDOWS\crjs32.exe
O4 - HKLM\..\RunOnce: [winge32.exe] C:\WINDOWS\system32\winge32.exe
O4 - HKLM\..\RunOnce: [crfr.exe] C:\WINDOWS\system32\crfr.exe
O4 - HKLM\..\RunOnce: [syssr32.exe] C:\WINDOWS\syssr32.exe
O4 - HKLM\..\RunOnce: [d3qp.exe] C:\WINDOWS\system32\d3qp.exe
O4 - HKLM\..\RunOnce: [crzp.exe] C:\WINDOWS\system32\crzp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - file://D:\GAMES\msjavx86_3805.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {F992FDC0-DAA7-4774-B01C-E9DFF19FE0FE} (Invoke Solutions MILive Participant Control(MR)) - http://online.invokesolutions.com/events/b…7203/MILive.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - file://D:\GAMES\WebDriverFullInstall.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crtc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #2
my computer automatically downloaded windows updates and rebooted, I think the virus may have changed some of its file names……so I have rescanned and reposting a new hijackthis log…………


Logfile of HijackThis v1.99.1
Scan saved at 6:58:48 PM, on 7/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\mfcpw32.exe
C:\WINDOWS\crjs32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Documents and Settings\Smalls\Desktop\Fix\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rpllx.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {0E4BFC7D-A620-1039-A544-DCBBF80CB7B5} - C:\WINDOWS\system32\ntjp32.dll
O2 - BHO: Class - {0FD58A22-5C44-FB03-1D4D-5C4F484499A9} - C:\WINDOWS\iecl32.dll
O2 - BHO: Class - {1B05716B-5FEA-54F5-0792-D4CE74369E8C} - C:\WINDOWS\mfcdd.dll
O2 - BHO: Class - {205A0C0A-D51F-CA19-32FF-69CC5F1D2AEA} - C:\WINDOWS\system32\msya32.dll
O2 - BHO: Class - {2121F517-8EB0-C7D8-66ED-2DA4574066BE} - C:\WINDOWS\msac32.dll
O2 - BHO: Class - {2ABCDE08-6852-2323-22DC-5C16F8D261E9} - C:\WINDOWS\atlwj.dll
O2 - BHO: Class - {31C94FA3-13E4-1D4B-B350-6A09F9B4EDDA} - C:\WINDOWS\sysur.dll
O2 - BHO: Class - {37156B31-6258-C5FD-0FC7-A0D84CF49A93} - C:\WINDOWS\system32\ieen32.dll
O2 - BHO: Class - {4BE23432-C392-D735-5711-ADB1E652BF8E} - C:\WINDOWS\system32\atlys.dll
O2 - BHO: Class - {58766EEB-28FF-2649-FB38-0338B821DD25} - C:\WINDOWS\system32\nthf.dll
O2 - BHO: Class - {7372E077-FC5C-0AA1-063A-909031455A18} - C:\WINDOWS\iegw.dll
O2 - BHO: Class - {770AE86A-8787-02D9-55C5-8760E1265399} - C:\WINDOWS\system32\javabu.dll
O2 - BHO: Class - {7CDC4EAB-426C-E934-1759-2CFC38EB81BE} - C:\WINDOWS\system32\mfcbc.dll
O2 - BHO: Class - {8BA7152C-FD4D-F234-1DFB-1F41A6EDABCA} - C:\WINDOWS\system32\syssh.dll
O2 - BHO: Class - {A743397C-15FF-B350-E883-BF7404029D99} - C:\WINDOWS\system32\ntuy32.dll
O2 - BHO: Class - {ABAB2F1C-D6EC-77F9-754C-2D6EC0CAEAED} - C:\WINDOWS\appky32.dll
O2 - BHO: Class - {AC092823-FD87-B7C4-DCAB-C0C0A653982E} - C:\WINDOWS\sdkty32.dll
O2 - BHO: Class - {BCCFD00A-DDB3-66B0-CF24-AB063F02A5F2} - C:\WINDOWS\ntfe.dll
O2 - BHO: Class - {F3E97395-5DF8-F801-BD53-B6C4EAAF3967} - C:\WINDOWS\system32\atlmh.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [d3qv32.exe] C:\WINDOWS\system32\d3qv32.exe
O4 - HKLM\..\Run: [winzx32.exe] C:\WINDOWS\winzx32.exe
O4 - HKLM\..\Run: [mfcpw32.exe] C:\WINDOWS\mfcpw32.exe
O4 - HKLM\..\RunOnce: [crtc.exe] C:\WINDOWS\crtc.exe
O4 - HKLM\..\RunOnce: [crci32.exe] C:\WINDOWS\system32\crci32.exe
O4 - HKLM\..\RunOnce: [netik.exe] C:\WINDOWS\netik.exe
O4 - HKLM\..\RunOnce: [nthq32.exe] C:\WINDOWS\system32\nthq32.exe
O4 - HKLM\..\RunOnce: [atlmm32.exe] C:\WINDOWS\system32\atlmm32.exe
O4 - HKLM\..\RunOnce: [sdkhy.exe] C:\WINDOWS\system32\sdkhy.exe
O4 - HKLM\..\RunOnce: [msgt32.exe] C:\WINDOWS\system32\msgt32.exe
O4 - HKLM\..\RunOnce: [ntto.exe] C:\WINDOWS\system32\ntto.exe
O4 - HKLM\..\RunOnce: [winut.exe] C:\WINDOWS\winut.exe
O4 - HKLM\..\RunOnce: [netnl32.exe] C:\WINDOWS\system32\netnl32.exe
O4 - HKLM\..\RunOnce: [iepx32.exe] C:\WINDOWS\iepx32.exe
O4 - HKLM\..\RunOnce: [javaon.exe] C:\WINDOWS\system32\javaon.exe
O4 - HKLM\..\RunOnce: [ntfb32.exe] C:\WINDOWS\ntfb32.exe
O4 - HKLM\..\RunOnce: [iebl.exe] C:\WINDOWS\iebl.exe
O4 - HKLM\..\RunOnce: [apptm32.exe] C:\WINDOWS\system32\apptm32.exe
O4 - HKLM\..\RunOnce: [appih.exe] C:\WINDOWS\appih.exe
O4 - HKLM\..\RunOnce: [netml32.exe] C:\WINDOWS\system32\netml32.exe
O4 - HKLM\..\RunOnce: [iphk32.exe] C:\WINDOWS\iphk32.exe
O4 - HKLM\..\RunOnce: [netps.exe] C:\WINDOWS\system32\netps.exe
O4 - HKLM\..\RunOnce: [sdkxo.exe] C:\WINDOWS\sdkxo.exe
O4 - HKLM\..\RunOnce: [mfcwd32.exe] C:\WINDOWS\system32\mfcwd32.exe
O4 - HKLM\..\RunOnce: [crjs32.exe] C:\WINDOWS\crjs32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - file://D:\GAMES\msjavx86_3805.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {F992FDC0-DAA7-4774-B01C-E9DFF19FE0FE} (Invoke Solutions MILive Participant Control(MR)) - http://online.invokesolutions.com/events/b…7203/MILive.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - file://D:\GAMES\WebDriverFullInstall.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crtc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #3
Hello ajsmalls and welcome to TomCoyote. :wavey: You have the newest version of About:Blank on your computer. I will need to see a fresh HijackThis log before going ahead with the fix as the file names change frequently. You do not state which version of AboutBuster you have. When I post the fix there will be a link for the newest version which was released recently. After posting the new Hijackthis log as a reply to this thread, please do not reboot the computer nor use Internet Explorer if possible. I will receive an email notification of your reply and will have a response for you as soon as possible.
Post #4
Hi Alan,

Thank you soo much for your help, this is a great site, and I will make a donation when this problem is solved.

I have AboutBuster 5.0, i believe that is the most up-to-date version.

here is a fresh log….

Logfile of HijackThis v1.99.1
Scan saved at 4:53:11 PM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\mfcpw32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Documents and Settings\Smalls\Desktop\Fix\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {0E4BFC7D-A620-1039-A544-DCBBF80CB7B5} - C:\WINDOWS\system32\ntjp32.dll
O2 - BHO: Class - {0FD58A22-5C44-FB03-1D4D-5C4F484499A9} - C:\WINDOWS\iecl32.dll
O2 - BHO: Class - {1B05716B-5FEA-54F5-0792-D4CE74369E8C} - C:\WINDOWS\mfcdd.dll
O2 - BHO: Class - {205A0C0A-D51F-CA19-32FF-69CC5F1D2AEA} - C:\WINDOWS\system32\msya32.dll
O2 - BHO: Class - {2121F517-8EB0-C7D8-66ED-2DA4574066BE} - C:\WINDOWS\msac32.dll
O2 - BHO: Class - {2ABCDE08-6852-2323-22DC-5C16F8D261E9} - C:\WINDOWS\atlwj.dll
O2 - BHO: Class - {31C94FA3-13E4-1D4B-B350-6A09F9B4EDDA} - C:\WINDOWS\sysur.dll
O2 - BHO: Class - {37156B31-6258-C5FD-0FC7-A0D84CF49A93} - C:\WINDOWS\system32\ieen32.dll
O2 - BHO: Class - {4BE23432-C392-D735-5711-ADB1E652BF8E} - C:\WINDOWS\system32\atlys.dll
O2 - BHO: Class - {58766EEB-28FF-2649-FB38-0338B821DD25} - C:\WINDOWS\system32\nthf.dll
O2 - BHO: Class - {7372E077-FC5C-0AA1-063A-909031455A18} - C:\WINDOWS\iegw.dll
O2 - BHO: Class - {770AE86A-8787-02D9-55C5-8760E1265399} - C:\WINDOWS\system32\javabu.dll
O2 - BHO: Class - {7CDC4EAB-426C-E934-1759-2CFC38EB81BE} - C:\WINDOWS\system32\mfcbc.dll
O2 - BHO: Class - {8BA7152C-FD4D-F234-1DFB-1F41A6EDABCA} - C:\WINDOWS\system32\syssh.dll
O2 - BHO: Class - {A743397C-15FF-B350-E883-BF7404029D99} - C:\WINDOWS\system32\ntuy32.dll
O2 - BHO: Class - {ABAB2F1C-D6EC-77F9-754C-2D6EC0CAEAED} - C:\WINDOWS\appky32.dll
O2 - BHO: Class - {AC092823-FD87-B7C4-DCAB-C0C0A653982E} - C:\WINDOWS\sdkty32.dll
O2 - BHO: Class - {BCCFD00A-DDB3-66B0-CF24-AB063F02A5F2} - C:\WINDOWS\ntfe.dll
O2 - BHO: Class - {F3E97395-5DF8-F801-BD53-B6C4EAAF3967} - C:\WINDOWS\system32\atlmh.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [d3qv32.exe] C:\WINDOWS\system32\d3qv32.exe
O4 - HKLM\..\Run: [winzx32.exe] C:\WINDOWS\winzx32.exe
O4 - HKLM\..\Run: [mfcpw32.exe] C:\WINDOWS\mfcpw32.exe
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKLM\..\RunOnce: [crtc.exe] C:\WINDOWS\crtc.exe
O4 - HKLM\..\RunOnce: [crci32.exe] C:\WINDOWS\system32\crci32.exe
O4 - HKLM\..\RunOnce: [netik.exe] C:\WINDOWS\netik.exe
O4 - HKLM\..\RunOnce: [nthq32.exe] C:\WINDOWS\system32\nthq32.exe
O4 - HKLM\..\RunOnce: [atlmm32.exe] C:\WINDOWS\system32\atlmm32.exe
O4 - HKLM\..\RunOnce: [sdkhy.exe] C:\WINDOWS\system32\sdkhy.exe
O4 - HKLM\..\RunOnce: [msgt32.exe] C:\WINDOWS\system32\msgt32.exe
O4 - HKLM\..\RunOnce: [ntto.exe] C:\WINDOWS\system32\ntto.exe
O4 - HKLM\..\RunOnce: [winut.exe] C:\WINDOWS\winut.exe
O4 - HKLM\..\RunOnce: [netnl32.exe] C:\WINDOWS\system32\netnl32.exe
O4 - HKLM\..\RunOnce: [iepx32.exe] C:\WINDOWS\iepx32.exe
O4 - HKLM\..\RunOnce: [javaon.exe] C:\WINDOWS\system32\javaon.exe
O4 - HKLM\..\RunOnce: [ntfb32.exe] C:\WINDOWS\ntfb32.exe
O4 - HKLM\..\RunOnce: [iebl.exe] C:\WINDOWS\iebl.exe
O4 - HKLM\..\RunOnce: [apptm32.exe] C:\WINDOWS\system32\apptm32.exe
O4 - HKLM\..\RunOnce: [appih.exe] C:\WINDOWS\appih.exe
O4 - HKLM\..\RunOnce: [netml32.exe] C:\WINDOWS\system32\netml32.exe
O4 - HKLM\..\RunOnce: [iphk32.exe] C:\WINDOWS\iphk32.exe
O4 - HKLM\..\RunOnce: [netps.exe] C:\WINDOWS\system32\netps.exe
O4 - HKLM\..\RunOnce: [sdkxo.exe] C:\WINDOWS\sdkxo.exe
O4 - HKLM\..\RunOnce: [mfcwd32.exe] C:\WINDOWS\system32\mfcwd32.exe
O4 - HKLM\..\RunOnce: [crjs32.exe] C:\WINDOWS\crjs32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - file://D:\GAMES\msjavx86_3805.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {F992FDC0-DAA7-4774-B01C-E9DFF19FE0FE} (Invoke Solutions MILive Participant Control(MR)) - http://online.invokesolutions.com/events/b…7203/MILive.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - file://D:\GAMES\WebDriverFullInstall.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crtc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #5
Step#1:Getting Ready

Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available.

After downloading the tools, you must disconnect from the internet totally, because staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening either will reinstall the infection.

To replace Internet Explorer to use during this fix, please use Internet Explorer once to download and install FireFox, to be used as your alternate browser throughout this fix.

Close Outlook Express and Internet Explorer for the duration of this fix

Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Please start by downloading the tools you will need to clean this infection with FireFox. If you have a problem or question with any please continue to follow the list step by step to the end and ask the questions when you are asked to reply. Just be sure to let us know what the problem was when you finally reply.


Step#2:Show All Hidden Files Very Important
  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Clear "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Show hidden files and folders."
  • Clear "Hide protected operating system files."
  • Click Apply, and then click OK.


Step#3:Download CWShredder Do Not Use Yet

You have this already so skip this step


Step#4:Download About Buster Do Not Use Yet

1. You have this already so skip this step

2. Once it is downloaded extract it to c:\aboutbuster.

3. Check to make sure it is up-to-date. Please Do NOT use it yet



Step#5:Download Registrar Lite Do Not Use Yet

Another program to download is Registrar Lite for use later: Please download Registrar Lite and install it to C:\Program Files\RegLite\ . This is a registry editor that is very easy to use. Caution should be exercised when editing the registry as it is very easy to render a Computer unbootable by deleting the wrong key



Step#6:Download Ewido Security Suite Do Not Use Yet
  • Download and install Ewido security suite
  • Right Click on the “E” icon in your taskbar and open Ewido Security Suite then click “update” to get the most recent definitions for it to use.
  • When it prompts you to update, click the OK button.
  • download the updates and when they are finished installing, close the window
  • Please Do Not Use It Yet

Step#7:Download A Registry File to Remove Registry Entries Do Not Use Yet
  • Please download the following zip file to your desktop:
    HSfix
  • Double Click on HSfix.zip and it will unzip to a new folder it makes on your desktop, called HSfix
  • Do Not Use It Yet


Please disconnect from the Internet




Step#8:Disable The Bad Service ** Very Important!!**
  • Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE
  • Click on start > control panel > administrative programs > services. Look for a service called Remote Procedure Call (RPC) Helper. Double click on that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.

Step#9:Stop The Running Processes

Press control-alt-delete to get into the task manager and end the following processes if they exist:

mfcpw32.exe



Step#10:Delete the Offending Files

I now need you to delete the following files:

C:\WINDOWS\mfcpw32.exe
C:\WINDOWS\crtc.exe
C:\WINDOWS\iecl32.dll
C:\WINDOWS\mfcdd.dll
C:\WINDOWS\msac32.dll
C:\WINDOWS\atlwj.dll
C:\WINDOWS\sysur.dll
C:\WINDOWS\iegw.dll
C:\WINDOWS\appky32.dll
C:\WINDOWS\sdkty32.dll
C:\WINDOWS\ntfe.dll
C:\WINDOWS\winzx32.exe
C:\WINDOWS\mfcpw32.exe
C:\WINDOWS\netik.exe
C:\WINDOWS\winut.exe
C:\WINDOWS\iepx32.exe
C:\WINDOWS\ntfb32.exe
C:\WINDOWS\iebl.exe
C:\WINDOWS\appih.exe
C:\WINDOWS\iphk32.exe
C:\WINDOWS\sdkxo.exe
C:\WINDOWS\crjs32.exe

C:\WINDOWS\system32\icwuo.dll
C:\WINDOWS\system32\ntjp32.dll
C:\WINDOWS\system32\msya32.dll
C:\WINDOWS\system32\ieen32.dll
C:\WINDOWS\system32\atlys.dll
C:\WINDOWS\system32\nthf.dll
C:\WINDOWS\system32\javabu.dll
C:\WINDOWS\system32\mfcbc.dll
C:\WINDOWS\system32\syssh.dll
C:\WINDOWS\system32\ntuy32.dll
C:\WINDOWS\system32\atlmh.dll
C:\WINDOWS\system32\d3qv32.exe
C:\WINDOWS\system32\crci32.exe
C:\WINDOWS\system32\nthq32.exe
C:\WINDOWS\system32\atlmm32.exe
C:\WINDOWS\system32\sdkhy.exe
C:\WINDOWS\system32\msgt32.exe
C:\WINDOWS\system32\ntto.exe
C:\WINDOWS\system32\netnl32.exe
C:\WINDOWS\system32\javaon.exe
C:\WINDOWS\system32\apptm32.exe
C:\WINDOWS\system32\netml32.exe
C:\WINDOWS\system32\netps.exe
C:\WINDOWS\system32\mfcwd32.exe


If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.



Step#11:Cleaning With HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R3 - Default URLSearchHook is missing

O2 - BHO: Class - {0E4BFC7D-A620-1039-A544-DCBBF80CB7B5} - C:\WINDOWS\system32\ntjp32.dll
O2 - BHO: Class - {0FD58A22-5C44-FB03-1D4D-5C4F484499A9} - C:\WINDOWS\iecl32.dll
O2 - BHO: Class - {1B05716B-5FEA-54F5-0792-D4CE74369E8C} - C:\WINDOWS\mfcdd.dll
O2 - BHO: Class - {205A0C0A-D51F-CA19-32FF-69CC5F1D2AEA} - C:\WINDOWS\system32\msya32.dll
O2 - BHO: Class - {2121F517-8EB0-C7D8-66ED-2DA4574066BE} - C:\WINDOWS\msac32.dll
O2 - BHO: Class - {2ABCDE08-6852-2323-22DC-5C16F8D261E9} - C:\WINDOWS\atlwj.dll
O2 - BHO: Class - {31C94FA3-13E4-1D4B-B350-6A09F9B4EDDA} - C:\WINDOWS\sysur.dll
O2 - BHO: Class - {37156B31-6258-C5FD-0FC7-A0D84CF49A93} - C:\WINDOWS\system32\ieen32.dll
O2 - BHO: Class - {4BE23432-C392-D735-5711-ADB1E652BF8E} - C:\WINDOWS\system32\atlys.dll
O2 - BHO: Class - {58766EEB-28FF-2649-FB38-0338B821DD25} - C:\WINDOWS\system32\nthf.dll
O2 - BHO: Class - {7372E077-FC5C-0AA1-063A-909031455A18} - C:\WINDOWS\iegw.dll
O2 - BHO: Class - {770AE86A-8787-02D9-55C5-8760E1265399} - C:\WINDOWS\system32\javabu.dll
O2 - BHO: Class - {7CDC4EAB-426C-E934-1759-2CFC38EB81BE} - C:\WINDOWS\system32\mfcbc.dll
O2 - BHO: Class - {8BA7152C-FD4D-F234-1DFB-1F41A6EDABCA} - C:\WINDOWS\system32\syssh.dll
O2 - BHO: Class - {A743397C-15FF-B350-E883-BF7404029D99} - C:\WINDOWS\system32\ntuy32.dll
O2 - BHO: Class - {ABAB2F1C-D6EC-77F9-754C-2D6EC0CAEAED} - C:\WINDOWS\appky32.dll
O2 - BHO: Class - {AC092823-FD87-B7C4-DCAB-C0C0A653982E} - C:\WINDOWS\sdkty32.dll
O2 - BHO: Class - {BCCFD00A-DDB3-66B0-CF24-AB063F02A5F2} - C:\WINDOWS\ntfe.dll
O2 - BHO: Class - {F3E97395-5DF8-F801-BD53-B6C4EAAF3967} - C:\WINDOWS\system32\atlmh.dll

O4 - HKLM\..\Run: [d3qv32.exe] C:\WINDOWS\system32\d3qv32.exe
O4 - HKLM\..\Run: [winzx32.exe] C:\WINDOWS\winzx32.exe
O4 - HKLM\..\Run: [mfcpw32.exe] C:\WINDOWS\mfcpw32.exe
O4 - HKLM\..\RunOnce: [crtc.exe] C:\WINDOWS\crtc.exe
O4 - HKLM\..\RunOnce: [crci32.exe] C:\WINDOWS\system32\crci32.exe
O4 - HKLM\..\RunOnce: [netik.exe] C:\WINDOWS\netik.exe
O4 - HKLM\..\RunOnce: [nthq32.exe] C:\WINDOWS\system32\nthq32.exe
O4 - HKLM\..\RunOnce: [atlmm32.exe] C:\WINDOWS\system32\atlmm32.exe
O4 - HKLM\..\RunOnce: [sdkhy.exe] C:\WINDOWS\system32\sdkhy.exe
O4 - HKLM\..\RunOnce: [msgt32.exe] C:\WINDOWS\system32\msgt32.exe
O4 - HKLM\..\RunOnce: [ntto.exe] C:\WINDOWS\system32\ntto.exe
O4 - HKLM\..\RunOnce: [winut.exe] C:\WINDOWS\winut.exe
O4 - HKLM\..\RunOnce: [netnl32.exe] C:\WINDOWS\system32\netnl32.exe
O4 - HKLM\..\RunOnce: [iepx32.exe] C:\WINDOWS\iepx32.exe
O4 - HKLM\..\RunOnce: [javaon.exe] C:\WINDOWS\system32\javaon.exe
O4 - HKLM\..\RunOnce: [ntfb32.exe] C:\WINDOWS\ntfb32.exe
O4 - HKLM\..\RunOnce: [iebl.exe] C:\WINDOWS\iebl.exe
O4 - HKLM\..\RunOnce: [apptm32.exe] C:\WINDOWS\system32\apptm32.exe
O4 - HKLM\..\RunOnce: [appih.exe] C:\WINDOWS\appih.exe
O4 - HKLM\..\RunOnce: [netml32.exe] C:\WINDOWS\system32\netml32.exe
O4 - HKLM\..\RunOnce: [iphk32.exe] C:\WINDOWS\iphk32.exe
O4 - HKLM\..\RunOnce: [netps.exe] C:\WINDOWS\system32\netps.exe
O4 - HKLM\..\RunOnce: [sdkxo.exe] C:\WINDOWS\sdkxo.exe
O4 - HKLM\..\RunOnce: [mfcwd32.exe] C:\WINDOWS\system32\mfcwd32.exe
O4 - HKLM\..\RunOnce: [crjs32.exe] C:\WINDOWS\crjs32.exe

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crtc.exe

Click "fix checked"




Step#12: Backup The Registry

In the next step we are going to remove a service that gets installed by this malware.

1. Open Registrar Lite and run it.

2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):

1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)






Step#13: Use the HSfix.reg file
  • Navigate to the HSfix folder on your Desktop
  • Then double-click on the HSfix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.
  • if you have a popup from any of your protection programs asking if you want to make a change to the registry, say Yes or Accept it

Step#14:Fixing With CWShredder
  • CLOSE ALL WINDOWS except CWShredder
  • Run the program by clicking 'fix' and letting it fix all CWS remnants.


Step#15:Fixing With About Buster

This is the step where we will use About:Buster that you had downloaded previously.
  • Navigate to the c:\aboutbuster directory
  • double-click on aboutbuster.exe
  • When the tool opens press the OK button, then Start button, then the OK button
  • then finally the Yes button. It will start scanning your computer for files.
  • If it asks if you would like to do a second pass, allow it to do so.
  • Post the log file in your next reply


Step#16:Scan With Ewido Security Suite
  • Launch Ewido again
  • Click on Scanner>Complete System Scan.
  • Let the program scan your PC.
  • When the scan asks to clean files click OK.
  • When scan is completed, click Save report. to your desktop.
  • Post the report in your next reply.

Reboot your computer back to normal mode and

Reconnect To The Internet



Step#17:Scan and Post a New HJT log with other logs
  • Scan again with HijackThis.
  • Post your logs from HijackThis, About Buster, and Ewido Security Suite here in this thread with any questions or problems that you have run into.
  • There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.
Post #6
ok, here are my latest three logs……..

AboutBuster 5.0 reference file 30
Scan started on [7/17/2005] at [7:25:29 PM]
————————————————
Removed Stream! C:\WINDOWS\mozver.dat:jirfyf
Removed Stream! C:\WINDOWS\Rhododendron.bmp:dnkpea
————————————————
Removed File! : C:\Windows\rpkrs.dat
————————————————
Scan was COMPLETED SUCCESSFULLY at 7:26:11 PM



———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 7:47:01 PM, 7/17/2005
+ Report-Checksum: D922BDA3

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{1228458E-6B19-48F4-5449-A00AEE93F0FC} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{677E5988-9E47-B4BE-8002-B86CEAD32154} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A9629E20-9B59-1F5F-58AE-E699D9122E1F} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EAC3A0EF-0931-C087-DD54-10E2CE664097} -> Spyware.CoolWebSearch : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Addynamix : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.193:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.204:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.208:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Smalls\Application Data\Mozilla\Firefox\Profiles\npd5cmlj.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Smalls\Cookies\smalls@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc1.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc2.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc20.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc21.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc22.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc23.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc24.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc25.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc28.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc29.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc3.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc30.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc31.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc38.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc39.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc40.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc43.exe -> Trojan.Agent.bi : Cleaned with backup
C:\RECYCLER\S-1-5-21-448539723-706699826-1060284298-500\Dc44.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apijn32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3na.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iecf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipmi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipml32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaoa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaro.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfccp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcep.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mscw.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msro32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netcg.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntps.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkmg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkrs.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\setuplog.txt:pchwzt -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysgt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syssr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addnl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appcf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appgl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appkv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appxj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlua32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atluw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crfr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\criy32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crrg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crrh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crru32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crug32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crzp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3co32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3ig.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3qp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3yp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iezy32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\mfcnu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netke.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netkt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netzd32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\sdkrm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\sysjv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\sysnu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\syssx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\winge32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\winmt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:juvehq -> Trojan.Agent.bi : Cleaned with backup


::Report End


Logfile of HijackThis v1.99.1
Scan saved at 8:55:10 PM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Documents and Settings\Administrator\Desktop\Fix\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - file://D:\GAMES\msjavx86_3805.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {F992FDC0-DAA7-4774-B01C-E9DFF19FE0FE} (Invoke Solutions MILive Participant Control(MR)) - http://online.invokesolutions.com/events/b…7203/MILive.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - file://D:\GAMES\WebDriverFullInstall.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #7
Step#1:Restore Deleted System Files

Now we need to see if we need to restore some deleted files:Please check for the following files using the Windows Search Engine:
  • control.exe
  • rundll32.exe
  • wmplayer.exe
  • msconfig.exe
  • notepad.exe
  • shell.dll
  • SDHelper.dll
If any are missing or not working properly then you can download new copies from
Merijn's Files and following the instructions at that site to have them where they belong for your OS.
  • If you are having any difficulty with Notepad, please go to Merijn's Files and choose 'Windows Files' from the menu on the left hand side of the page. Then choose 'Notepad' from the list and download it to C:\Windows and C:\Windows\System32
  • Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
  • This infection often deletes some system files that need to be replaced. The most frequent one it deletes is shell.dll in Win2K or XP. In XP there are two copies of this file, one in Windows (WINNT) and one in Windows\System32. It does not delete the one in Windows\System so it does not affect Win9x/ME. If you find it missing, please copy the shell.dll from c:\windows\system32\dllcache into both \Windows (WINNT) and Windows\System32 .
  • The other system file which is most frequently deleted is control.exe. Please check to make sure that you have this file and it is the correct size. If not Please check for the existence of this file by going to to Merijn's Files (sdhelper) and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to the information at this website. The control.exe is more often deleted in Win9x/ME.
  • If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button
Step#2:Download CCleaner
Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.



Step#3:Complete An Online AntiVirus Scan

Run an online antivirus scan at:

Trend Micro-Housecall Online AV

Reboot



Step#4:Find the Infected Files On Your Hard Drive
  • Navigate to C:\Windows
  • look for files that were created at the approximate time and date as the infection occurred.
  • look for those that end in exe, DAT and DLL and if found, right click on the file and check properties. Legitimate files should be copyrighted by Microsoft
  • if you determine they are bad files, right click on them and choose delete
  • Navigate to C:\Windows\System or C:\Windows\System32 (depending on the OS) and repeat each of the above steps to check for those ending in exe, DAT and/or DLL
  • if the above files will not delete, then make a new folder on your desktop by right clicking on the desktop and choosing New > Folder. Name the folder CWS Files.
  • Move the files from C:\Windows or C:\Windows\System or C:\Windows\system32
    to the new folder CWS Files.
Step#5:Scan And Post a New HijackThis Log

1. Scan again with HijackThis

2. POST your log file using Add Reply to see what is left to fix.
Post #8
ok, feels like Ive gotten alot done…….

notes:

1. all of the system files that you listed in your last post were still on my computer, and dont seem to have been modified as the 'date modified' are old dates.

2. I did change the sdhelper.dll file for spybot, just for the hell of it, even though that date didnt appear to be modified either.

3. I was not sure if it was necessary to run the host.zip, as you stated, so I did not do it…….should I go ahead and do it anyway?

4. I ran Trend Micro House call, and it found alot of .exe files (so much for Mcafee Virus Scan which passed right over those files), it said it couldnt 'CLEAN' them, so I just deleted them.

5. I then rebooted, and now my screen appears to be enlarged? It looks like my display settings have been changed? I have to scroll with the mouse to move the screen to view the edges.

Here is my latest Hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 9:50:24 PM, on 7/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Smalls\Desktop\Fix\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - file://D:\GAMES\msjavx86_3805.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {F992FDC0-DAA7-4774-B01C-E9DFF19FE0FE} (Invoke Solutions MILive Participant Control(MR)) - http://online.invokesolutions.com/events/b…7203/MILive.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - file://D:\GAMES\WebDriverFullInstall.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #9
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\icwuo.dll/sp.html#55135
R3 - Default URLSearchHook is missing

With all other programs and browsers closed, click fix checked.

I was not sure if it was necessary to run the host.zip, as you stated, so I did not do it…….should I go ahead and do it anyway?

Yes, please run that program.

Are you able to change the display settings via Start < Control Panel < Display. On the Settings tab set your "Screen Resolution" to what it was set at before the infection.


Post one more Hijackthis log and let me know how the display is now.
Post #10
I fixed those 3 entries in hijackthis, and I ran host.zip and 'restored original hosts', i rebooted my computer and my display settings came back to normal


Logfile of HijackThis v1.99.1
Scan saved at 10:53:05 PM, on 7/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Smalls\Desktop\Fix\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - file://D:\GAMES\msjavx86_3805.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {F992FDC0-DAA7-4774-B01C-E9DFF19FE0FE} (Invoke Solutions MILive Participant Control(MR)) - http://online.invokesolutions.com/events/b…7203/MILive.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - file://D:\GAMES\WebDriverFullInstall.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #11
Your new log appears clean. :)
Great work on the cleanup of this tough infection. :thumbup:

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #12
WHEW!! What a process! all looks good on my PC. Thank you very much for your time and help! I will spread the word about your organization and though I dont have much money I will make a donation to you guys, for without this site my pc would be dead in the water. Just curious though….do you know exactly what the vunerabities to my system were from that virus I had? (did it allow access to my computer/personal info to an outside source, or did it just hijack my browser?) Thanks again for you help! Im done with Internet Exploiter, im now an enthusiastic user of firefox! - Anthony
Post #13
This new variant has been known to add a file that will steal password information on your computer. It would be a good idea to change all logins and passwords on your computer. The donation will be much appreciated by Tom to help keep the website online. :)
Post #14
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI