Browser highjack - Win2K

Sorry about the slow reply, but I had to have a night off. WinPFind log: WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows 2000 Current Build: Service Pack 4 Current Build Number: 2195 Internet Explorer Version: 6.0.2800.1106 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder… Checking %ProgramFilesDir% folder… Checking %WinDir% folder… web-nex 8/15/2005 12:13:42 PM 3951 C:\WINNT\joajo.dll PECompact2 8/22/2005 2:00:54 PM 15656561 C:\WINNT\lpt$vpn.795 qoologic 8/22/2005 2:00:54 PM 15656561 C:\WINNT\lpt$vpn.795 SAHAgent 8/22/2005 2:00:54 PM 15656561 C:\WINNT\lpt$vpn.795 UPX! 5/3/2005 11:44:44 AM 25157 C:\WINNT\RMAgentOutput.dll UPX! 1/10/2005 4:17:24 PM 170053 C:\WINNT\tsc.exe PECompact2 8/22/2005 2:00:54 PM 15656561 C:\WINNT\VPTNFILE.795 qoologic 8/22/2005 2:00:54 PM 15656561 C:\WINNT\VPTNFILE.795 SAHAgent 8/22/2005 2:00:54 PM 15656561 C:\WINNT\VPTNFILE.795 UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINNT\vsapi32.dll aspack 2/18/2005 6:40:14 PM 1044560 C:\WINNT\vsapi32.dll Checking %System% folder… 69.59.186.63 8/24/2005 12:42:14 PM 10240 C:\WINNT\SYSTEM32\jndjn.dll 209.66.67.134 8/24/2005 12:42:14 PM 10240 C:\WINNT\SYSTEM32\jndjn.dll web-nex 8/24/2005 12:42:14 PM 10240 C:\WINNT\SYSTEM32\jndjn.dll winsync 8/24/2005 12:42:14 PM 10240 C:\WINNT\SYSTEM32\jndjn.dll PTech 8/3/2005 10:33:42 AM 520456 C:\WINNT\SYSTEM32\LegitCheckControl.DLL PECompact2 8/4/2005 10:01:54 AM 1449304 C:\WINNT\SYSTEM32\MRT.exe aspack 8/4/2005 10:01:54 AM 1449304 C:\WINNT\SYSTEM32\MRT.exe Umonitor 6/20/2003 9:00:00 AM 529168 C:\WINNT\SYSTEM32\RASDLG.DLL UPX! 10/6/2004 3:33:12 PM 115712 C:\WINNT\SYSTEM32\scopenr.dll 69.59.186.63 8/24/2005 12:42:14 PM 46080 C:\WINNT\SYSTEM32\sjdsjsg.dll 209.66.67.134 8/24/2005 12:42:14 PM 46080 C:\WINNT\SYSTEM32\sjdsjsg.dll web-nex 8/24/2005 12:42:14 PM 46080 C:\WINNT\SYSTEM32\sjdsjsg.dll winsync 8/24/2005 12:42:14 PM 46080 C:\WINNT\SYSTEM32\sjdsjsg.dll winsync 6/20/2003 9:00:00 AM 1309184 C:\WINNT\SYSTEM32\WBDBASE.DEU UPX! 10/11/2004 12:11:14 PM 31232 C:\WINNT\SYSTEM32\zilla.dll Checking %System%\Drivers folder and sub-folders… Items found in C:\WINNT\SYSTEM32\drivers\ETC\HOSTS 127.0.0.1 www.shopathomeselect.com #[Adware.SAHAgent] 127.0.0.1 images2.vpptechnologies.com 127.0.0.1 main.vpptechnologies.com 127.0.0.1 msxml.vpptechnologies.com 127.0.0.1 static.vpptechnologies.com #[hotsearchbar.com] 127.0.0.1 xml.vpptechnologies.com #[BlazeFind] 127.0.0.1 qoologic.com 127.0.0.1 adsrv.qoologic.com 127.0.0.1 www.qoologic.com 127.0.0.1 abetterinternet.com #[Downloader.Stubby.A] 127.0.0.1 belt.abetterinternet.com 127.0.0.1 c.abetterinternet.com #[Adware-BetterInet application] 127.0.0.1 download.abetterinternet.com #[Adware.StopPopupAdsNow] 127.0.0.1 download2.abetterinternet.com #[Parasite.Transponder] 127.0.0.1 s.abetterinternet.com 127.0.0.1 thinstall.abetterinternet.com 127.0.0.1 www.abetterinternet.com PTech 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\HOSTS.big urllogic 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\HOSTS.big ad-beh 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\HOSTS.big abetterinternet.com 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\HOSTS.big ad-w-a-r-e.com 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\HOSTS.big PTech 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\hosts.txt urllogic 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\hosts.txt ad-beh 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\hosts.txt abetterinternet.com 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\hosts.txt ad-w-a-r-e.com 8/23/2005 7:48:02 PM 1249820 C:\WINNT\SYSTEM32\drivers\ETC\hosts.txt Checking the Windows folder and sub-folders for system and hidden files within the last 60 days… 8/24/2005 10:58:12 AM H 922096 C:\WINNT\ShellIconCache 8/18/2005 6:38:00 PM S 64 C:\WINNT\CSC\00000001 8/18/2005 5:40:42 PM S 64 C:\WINNT\CSC\00000002 8/18/2005 4:32:44 PM S 64 C:\WINNT\CSC\csc1.tmp 8/18/2005 8:52:32 AM H 65 C:\WINNT\Downloaded Program Files\DESKTOP.INI 8/21/2005 12:11:24 PM H 10820 C:\WINNT\Help\nocontnt.GID 7/25/2005 7:59:16 AM H 0 C:\WINNT\INF\oem32.inf 8/18/2005 8:52:32 AM H 65 C:\WINNT\occache\desktop.ini 8/18/2005 8:52:32 AM H 65 C:\WINNT\Offline Web Pages\DESKTOP.INI 8/8/2005 9:22:10 AM RHS 401408 C:\WINNT\SYSTEM32\r?ndll.exe 8/25/2005 3:49:24 PM H 1024 C:\WINNT\SYSTEM32\CONFIG\DEFAULT.LOG 8/25/2005 6:28:28 PM H 1024 C:\WINNT\SYSTEM32\CONFIG\SAM.LOG 8/25/2005 6:26:26 PM H 1024 C:\WINNT\SYSTEM32\CONFIG\SECURITY.LOG 8/25/2005 6:31:02 PM H 1024 C:\WINNT\SYSTEM32\CONFIG\SOFTWARE.LOG 8/15/2005 12:04:40 PM HS 336 C:\WINNT\SYSTEM32\Microsoft\Protect\S-1-5-18\User\a06eedea-1b3e-4f96-acbd-e4dea46a4d75 8/15/2005 12:04:40 PM HS 24 C:\WINNT\SYSTEM32\Microsoft\Protect\S-1-5-18\User\Preferred 8/24/2005 12:41:46 PM HS 188 C:\WINNT\Tasks\RUTASK.job 8/25/2005 6:24:40 PM H 6 C:\WINNT\Tasks\SA.DAT 8/18/2005 8:52:36 AM H 11083 C:\WINNT\Web\FTP.HTT Checking for CPL files… Microsoft Corporation 6/20/2003 9:00:00 AM 67344 C:\WINNT\SYSTEM32\ACCESS.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 301328 C:\WINNT\SYSTEM32\APPWIZ.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 237328 C:\WINNT\SYSTEM32\DESK.CPL IBPhoenix 7/14/2004 3:05:10 AM 69632 C:\WINNT\SYSTEM32\Firebird2Control.cpl Microsoft Corporation 6/20/2003 9:00:00 AM 128272 C:\WINNT\SYSTEM32\HDWWIZ.CPL Microsoft Corporation 8/29/2002 7:14:40 AM 292352 C:\WINNT\SYSTEM32\inetcpl.cpl Microsoft Corporation 2/20/2001 3:09:54 PM 109056 C:\WINNT\SYSTEM32\INPUT.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 118032 C:\WINNT\SYSTEM32\INTL.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 36112 C:\WINNT\SYSTEM32\IRPROPS.CPL Microsoft Corporation 10/30/2001 10:10:00 AM 326144 C:\WINNT\SYSTEM32\joy.cpl Sun Microsystems 3/12/2004 3:05:16 AM 53352 C:\WINNT\SYSTEM32\jpicpl32.cpl Microsoft Corporation 6/20/2003 9:00:00 AM 122128 C:\WINNT\SYSTEM32\MAIN.CPL AvantGo, Inc. 2/21/2003 4:58:26 AM 69632 C:\WINNT\SYSTEM32\mbllnk.cpl Microsoft Corporation 6/20/2003 9:00:00 AM 303888 C:\WINNT\SYSTEM32\MMSYS.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 17168 C:\WINNT\SYSTEM32\NCPA.CPL NVIDIA Corporation 10/6/2003 3:16:00 PM 73728 C:\WINNT\SYSTEM32\nvtuicpl.cpl Microsoft Corporation 6/20/2003 9:00:00 AM 41232 C:\WINNT\SYSTEM32\NWC.CPL Microsoft Corporation 2/20/2003 5:39:50 PM 32768 C:\WINNT\SYSTEM32\odbccp32.cpl Microsoft Corporation 6/20/2003 9:00:00 AM 90896 C:\WINNT\SYSTEM32\POWERCFG.CPL Intel® Corporation 3/11/2003 6:15:56 PM 77824 C:\WINNT\SYSTEM32\PRApplet.cpl Microsoft Corporation 6/20/2003 9:00:00 AM 83216 C:\WINNT\SYSTEM32\STICPL.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 125712 C:\WINNT\SYSTEM32\SYSDM.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 5904 C:\WINNT\SYSTEM32\TELEPHON.CPL Microsoft Corporation 6/20/2003 9:00:00 AM 61200 C:\WINNT\SYSTEM32\TIMEDATE.CPL Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINNT\SYSTEM32\wuaucpl.cpl Microsoft Corporation 8/29/2002 7:14:40 AM 292352 C:\WINNT\SYSTEM32\DLLCACHE\inetcpl.cpl Microsoft Corporation 2/20/2003 5:39:50 PM 32768 C:\WINNT\SYSTEM32\DLLCACHE\odbccp32.cpl Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINNT\SYSTEM32\DLLCACHE\wuaucpl.cpl NVIDIA Corporation 2/28/2003 9:13:00 PM 139264 C:\WINNT\SYSTEM32\ReinstallBackups\PCI#VEN_10DE&DEV_0181&SUBSYS_019110DE&REV_C1#4&1246FE7B&0&0008\0000\DriverFiles\nvtuicpl.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder… 9/20/2004 9:23:34 AM 1670 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk 9/20/2004 9:23:36 AM 541 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DataViz Messenger.lnk 9/20/2004 9:23:42 AM 1607 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Manager.lnk 6/7/2005 1:06:12 PM 1529 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk 8/5/2005 6:21:32 PM 1670 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk 8/5/2005 6:26:34 PM 664 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk 8/24/2005 12:42:12 PM 92160 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nkdn.exe 9/20/2004 9:23:52 AM 717 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\OKI LPR Utility.lnk 3/24/2005 10:17:24 AM 1630 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk 10/12/2004 3:33:38 PM 1444 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk Checking files in %ALLUSERSPROFILE%\Application Data folder… 8/5/2005 6:37:16 PM 31485 C:\Documents and Settings\All Users\Application Data\hpzinstall.log 3/30/2005 1:10:34 PM H 58 C:\Documents and Settings\All Users\Application Data\Ts_infos.ini Checking files in %USERPROFILE%\Startup folder… 9/20/2004 9:24:02 AM 1396 C:\Documents and Settings\Vicky DiFranco\Start Menu\Programs\Startup\HotSync Manager.lnk 3/1/2005 9:37:22 AM 1575 C:\Documents and Settings\Vicky DiFranco\Start Menu\Programs\Startup\POLAR Scheduler.lnk Checking files in %USERPROFILE%\Application Data folder… 2/1/2005 11:18:52 AM 38496 C:\Documents and Settings\Vicky DiFranco\Application Data\Comma Separated Values (Windows).ADR 1/11/2005 2:32:36 PM 13027 C:\Documents and Settings\Vicky DiFranco\Application Data\Comma Separated Values (Windows).CAL 12/6/2004 11:51:28 AM 9916 C:\Documents and Settings\Vicky DiFranco\Application Data\Microsoft Excel.CAL 12/6/2004 11:19:06 AM 9366 C:\Documents and Settings\Vicky DiFranco\Application Data\Microsoft Excel.EML 8/15/2005 3:22:08 PM 130 C:\Documents and Settings\Vicky DiFranco\Application Data\Sskdmns.dll »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] {6F9A5891-A35D-41AC-A798-5C22BDE4039C} = {4F7BCCFE-BF7A-4DB7-B048-1C047FDE110A} = C:\WINNT\system32\AVSNDS.DLL {BE5567D7-09C7-4289-8D47-E93FC2246258} = C:\WINNT\system32\IHSUTIL.DLL {14FBFD12-2E4A-47AA-B183-1D6A52662469} = C:\WINNT\system32\DZTIME.DLL [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Adobe.Acrobat.ContextMenu {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = c:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fngfnfqg {6e39fca9-ab70-4be1-93be-289f3dd8d9b6} = C:\WINNT\system32\jndjn.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Yahoo! Mail {5464D816-CF16-4784-B9F3-75C0DB52B499} = C:\PROGRA~1\Yahoo!\Common\ymmapi.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = C:\WINNT\system32\docprop2.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{7f9609be-af9a-11d1-83e0-00c04fb6e984} = %SystemRoot%\system32\faxshell.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{884EA37B-37C0-11d2-BE3F-00A0C9A83DA1} = C:\WINNT\system32\docprop2.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872} CNavExtBho Class = C:\Program Files\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{182EC0BE-5110-49C8-A062-BEB1D02A220B} Adobe PDF = c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\system32\shdocvw.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} Real.com = C:\WINNT\system32\Shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} ButtonText = Create Mobile Favorite : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} MenuText = Create Mobile Favorite… : C:\Program Files\Microsoft ActiveSync\INetRepl.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263} ButtonText = Research : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} ButtonText = Real.com : [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} Media Band = %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD} = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} File and Folders Search ActiveX Control = C:\WINNT\system32\shell32.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll {2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar2.dll {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll {EF99BD32-C1FB-11D2-892F-0090271D4F88} = &Yahoo! Companion : C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Synchronization Manager mobsync.exe /logon NvCplDaemon RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup nwiz nwiz.exe /install CreateCD50 "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r AdaptecDirectCD "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" Spam Blocker for Outlook Express TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot Logitech Utility Logi_MwX.Exe HP Software Update C:\Program Files\HP\HP Software Update\HPWuSchd2.exe QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" Picasa Media Detector C:\Program Files\Picasa2\PicasaMediaDetector.exe ntdll.dll C:\WINNT\system32\lgklgl.exe reg_run winsync C:\WINNT\system32\lgklgl.exe reg_run ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" SSC_UserPrompt C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ctfmon.exe ctfmon.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\AdminComponent HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 149 CDRAutoRun 0 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run oitvcr C:\WINNT\system32\oitvcr.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] Network.ConnectionTray {7007ACCF-3202-11D1-AAD2-00805FC1270E} = C:\WINNT\system32\NETSHELL.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINNT\system32\userinit.exe, Shell = explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.3.1 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 8/25/2005 6:35:14 PM — Track goo log: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "CreateCD50"="\"C:\\Program Files\\Common Files\\Adaptec Shared\\CreateCD\\CreateCD50.exe\" -r" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "Spam Blocker for Outlook Express"="" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "Logitech Utility"="Logi_MwX.Exe" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "Picasa Media Detector"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe" "ntdll.dll"="C:\\WINNT\\system32\\lgklgl.exe reg_run" "winsync"="C:\\WINNT\\system32\\lgklgl.exe reg_run" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" —————– HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers Subkey — Adobe.Acrobat.ContextMenu {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} c:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll Subkey — fngfnfqg {6e39fca9-ab70-4be1-93be-289f3dd8d9b6} C:\WINNT\system32\jndjn.dll Subkey — Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} cscui.dll Subkey — Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} C:\WINNT\system32\shell32.dll Subkey — Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} C:\WINNT\system32\shell32.dll Subkey — Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} C:\Program Files\Norton AntiVirus\NavShExt.dll Subkey — WinZip {E0D79304-84BE-11CE-9641-444553540000} C:\PROGRA~1\WINZIP\WZSHLSTB.DLL Subkey — Yahoo! Mail {5464D816-CF16-4784-B9F3-75C0DB52B499} C:\PROGRA~1\Yahoo!\Common\ymmapi.dll ===================== HKEY_CLASSES_ROOT\Folder\shellex\ColumnHandlers Subkey — {0D2E74C4-3C34-11d2-A27E-00C04FC30871} C:\WINNT\system32\shell32.dll Subkey — {24F14F01-7B1C-11d1-838f-0000F80461CF} C:\WINNT\system32\shell32.dll Subkey — {24F14F02-7B1C-11d1-838f-0000F80461CF} C:\WINNT\system32\shell32.dll Subkey — {66742402-F9B9-11D1-A202-0000F81FEDEE} C:\WINNT\system32\docprop2.dll Subkey — {7f9609be-af9a-11d1-83e0-00c04fb6e984} C:\WINNT\system32\faxshell.dll Subkey — {884EA37B-37C0-11d2-BE3F-00A0C9A83DA1} C:\WINNT\system32\docprop2.dll ============================== C:\Documents and Settings\All Users\Start Menu\Programs\Startup Acrobat Assistant.lnk DataViz Messenger.lnk Desktop Manager.lnk Event Reminder.lnk HP Digital Imaging Monitor.lnk HP Image Zone Fast Start.lnk OKI LPR Utility.lnk QuickBooks Update Agent.lnk WinZip Quick Pick.lnk ============================== C:\Documents and Settings\Vicky DiFranco\Start Menu\Programs\Startup Acrobat Assistant.lnk DataViz Messenger.lnk Desktop Manager.lnk Event Reminder.lnk HP Digital Imaging Monitor.lnk HP Image Zone Fast Start.lnk OKI LPR Utility.lnk QuickBooks Update Agent.lnk WinZip Quick Pick.lnk HotSync Manager.lnk POLAR Scheduler.lnk ============================== C:\WINNT\SYSTEM32 cpl files ACCESS.CPL Microsoft Corporation APPWIZ.CPL Microsoft Corporation DESK.CPL Microsoft Corporation Firebird2Control.cpl IBPhoenix HDWWIZ.CPL Microsoft Corporation inetcpl.cpl Microsoft Corporation INPUT.CPL Microsoft Corporation INTL.CPL Microsoft Corporation IRPROPS.CPL Microsoft Corporation joy.cpl Microsoft Corporation jpicpl32.cpl Sun Microsystems MAIN.CPL Microsoft Corporation mbllnk.cpl AvantGo, Inc. MMSYS.CPL Microsoft Corporation NCPA.CPL Microsoft Corporation nvtuicpl.cpl NVIDIA Corporation NWC.CPL Microsoft Corporation odbccp32.cpl Microsoft Corporation POWERCFG.CPL Microsoft Corporation PRApplet.cpl Intel® Corporation STICPL.CPL Microsoft Corporation SYSDM.CPL Microsoft Corporation TELEPHON.CPL Microsoft Corporation TIMEDATE.CPL Microsoft Corporation wuaucpl.cpl Microsoft Corporation — End of Log

hi JEberlin, iam going to have to digest this some more. are you using a custom host file? i will try to post a fix soon….. in the mean time lets try this: make sure files are set to show: Windows 2000 * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View Tab. * Under the Hidden files and folders heading select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK. ————————————— boot computer into SAFE MODE. tap the f8 key during restart, chose safe mode from the options. may take couple minutes to get to safe mode desktop. once in safe mode find a delete these files: jndjn.dll located here>>C:\WINNT\SYSTEM32 sjdsjsg.dll located here>>C:\WINNT\SYSTEM32 lgklgl.exe located here>>C:\WINNT\system32 more to come…shelf life

hi JEberlin,
i would print this out or copy it to notepad and save it somewhere so you can get to it.

one more download, killbox from here:

http://www.subratam.org/main/index.php?opt…id=19&Itemid=41

its number 17. unzip it to your desktop for later use
——————————
ok on to the log:

copy/paste whats inbetween the —–lines below. save it to your desktop as type "all files" call it fixit.reg


———————————————————————–
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"winsync"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ntdll.dll"=-

[-HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fngfnfqg]

—————————————————————————-

now open up killbox on your desktop. (red X)
copy/paste these one by one in the " Full Path of File to Delete"

C:\WINNT\system32\jndjn.dll
C:\WINNT\\system32\\lgklgl.exe

copy/paste the first one,place a check by any of these Selections available

"Delete on Reboot"
"Unregister .dll before Deleting"

Click the Red Circle with the White X in the Middle to Delete

at the delete on reboot prompt select yes. at the next prompt it will ask if you want to reboot now. select no. do the same thing for the 2nd file. after you copy/paste the 2nd file at the reboot now prompt select no again.

————————————
ok now reboot into SAFE MODE. during a restart tap the f8 key to enter safe mode, chose safe mode from the optons
once in safe mode, use killbox again and copy/paste the 2 files above like before, this time check these Selections available

"Standard File Kill"
"End Explorer Shell while Killing File"
"Unregister .dll before Deleting"

you remember the fixit.reg file you saved to your desktop? double click it, select yes so it merges to the registry.

open hjt, scan and check these:
O4 - HKLM\..\Run: [ntdll.dll] C:\WINNT\system32\lgklgl.exe reg_run
O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\lgklgl.exe reg_run

close all windows and select fix checked, reboot computer normally, rescan with hjt and post a new log….shelf life

hi JEberlin, i would print this out or copy it to a text file so you can get to it, also update Ewido, but dont run it yet. copy/paste whats inbetween the —–lines below into notepad. save it to your desktop as type "all files" call it fixit2.reg. for later use ——————————————————————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "winsync"=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] "oitvcr.exe"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{6F9A5891-A35D-41AC-A798-5C22BDE4039C}" =- "{4F7BCCFE-BF7A-4DB7-B048-1C047FDE110A}" =- [-HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fngfnfqg] [-HKEY_CLASSES_ROOT\CLSID\{6e39fca9-ab70-4be1-93be-289f3dd8d9b6}] ——————————————————————————— Open Pocket Killbox and Copy & Paste the entries below into the "Full Path of File to Delete", one at a time. C:\WINNT\joajo.dll C:\WINNT\SYSTEM32\sjdsjsg.dll C:\WINNT\SYSTEM32\WBDBASE.DEU C:\Documents and Settings\Vicky DiFranco\Application Data\Sskdmns.dll C:\WINNT\system32\jndjn.dll C:\WINNT\system32\lgklgl.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nkdn.exe C:\WINNT\system32\AVSNDS.DLL As you Paste each entry into Killbox, place a tick by any of these Selections available "Delete on Reboot" "Unregister .dll before Deleting" Click the Red Circle with the White X in the Middle to Delete! at the delete on reboot prompt select yes. at the next prompt it will ask if you want to reboot now. select no. do the same for the rest of the files. when you get to the last one at the reboot now prompt select yes. as computer reboots— tap the f8 key so you will enter in safe mode —————————————— ok once in SAFE MODE:Run those files through Killbox once more This time place a tick by any of these selections available "Standard File Kill" "End Explorer Shell while Killing File" "Unregister .dll before Deleting" ————————————– Now Locate and DoubleClick fixit2.reg on your desktop Allow it to merge into the Registry. ————————————– while still in safe mode, run Ewido again. ————————————– reboot normally, rescan with hjt and post a new log shelf life

hi JEberlin, i will soon be getting slammed by hurricane katrina, i could be offline for days. if you post and dont hear back form me hang in there….shelf life

Shelf Life; Take care of yourself. We need you out here, so whatever it takes to protect your self. I'll catch you when you are next online. JEBerlin

hi JEberlin, iam back online, had no electricity last couple days. hows your computer doing?

Hey! Good to hear from you. I've been getting some excellent help and I think I'm pretty well out of the woods now. I'll post a log sometime on Tuesday and we can go from there. I glan you weathered the storm so well.

hi JEberlin,

computer may doing better but that nasty winsync is still in the log. i see you are getting help over at bleeping computers, so as not to duplicate our efforts they can have the thread.

Because the thread at Bleeping Computer is still open, I have closed the thread