U had this a while ago

I notice there is a lot of ppl with same problems here
and i understand it takes time while some threads do get missed out on

So with that i also notice there is a section to add message when yuo dont get a responce in 5 days or more
but

what happens when its been over a year
and still no replies?

heres my most recent one
http://forums.tomcoyote.org/index.php?act=ST&f;=27&t;=45476

i have already hit the (no replies in 5 days thread) as well

its been over a year so my other thread has already been "pruned" out of existance.

You have an About:Blank infection on your computer. It may morph each time the computer is rebooted and Internet Explorer or Outlook Express is used.

To replace Internet Explorer until the computer is clean, please use Internet Explorer once to download and install FireFox, after which do not use Internet Explorer again until instructed. We will use Firefox as an alternate browser during the fix.

Now reply to this topic with a fresh HijackThis log. After replying, do not reboot the computer if possible.

I'll receive an email notification of your reply and will reply as soon as possible.

thanks alsocom
i had firefox installed here sometime ago so that part is already done

here my a LOG that i took just this moment but
so
my spysweeper keeps notifying me of these two .exe files that keep coming up


they are
WINHV.eve (located at C/WINDOWS/SYSTEM

and
WINXM.exe (Located at C/WINDOWS)
heres the HJT LOG
————————–
ogfile of HijackThis v1.99.1
Scan saved at 9:21:53 AM, on 9/9/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\WINHV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\WINXM.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\MY DOCUMENTS\SPY TOOLS\HIJACKTHIS_1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wearesp.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wearesp.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\vutop.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.search-msn.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.65.1:80
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {3CA6D317-D4A9-BECE-C0E5-0F8E92A748A8} - C:\WINDOWS\SYSTEM\D3IP32.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton AntiVirus\POPROXY.EXE
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [WINHV.EXE] C:\WINDOWS\SYSTEM\WINHV.EXE /s
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/214a5f268dc1b2…ip/RdxIE601.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

——————–



ill make sure to leave this system running so we can continue

thanks

I need you to disable SpySweeper until after the computer is clean as it will interfere with the registry changes we will need to do.

• Open SpySweeper click > Options over to the left then > program options > Uncheck "load at windows startup".
• Over to the left click "shields" and uncheck all there.
• Uncheck "home page shield".
• Uncheck 'automatically restore default without notification".

I need you to disable SpywareGuard as it will interfere with the registry changes we will need to do.

• Right click the running icon of Spywareguard, it will open the program.
• Then go to Menu, file, exit.
• Then confirm the program is closed.

You may want to print out these instructions or save them to your desktop as a text file with Notepad because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet.

• Prepare CWShredder for use:
  • Download CWShredder.
  • Save CWShredder.exe to a convenient location.
  • Please do not do anything with it yet.
• Prepare AboutBuster for use:
  • Download AboutBuster.
  • Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
  • Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
  • Click "Update" to begin the update process.
  • If any updates exist please install them.
  • You should not run the program yet so click the "X" to exit the program.
• Prepare Ad-Aware SE Personal for use:
  • Download Adaware SE.
  • Double click on aawsepersonal.exe to install the program.
  • Click on "check for updates now" to make sure you have the latest reference file.
  • You should not run the program yet so click the "X" to Exit.

Boot into Safe Mode:
Restart your computer and immediately begin tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.

• End Bad Process:
  • Press Control-Alt-Del to enter the Task Manager.
  • Click on the Processes tab and end the following processes if listed:
    
    WINHV.EXE
    WINXM.EXE
  • Exit the Task Manager when finished
• Fix with Hijackthis:
  • Open Hijackthis, Run a scan and check the following:
    
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\vutop.dll/sp.html#12047
    R3 - Default URLSearchHook is missing
    
    O2 - BHO: Class - {3CA6D317-D4A9-BECE-C0E5-0F8E92A748A8} - C:\WINDOWS\SYSTEM\D3IP32.DLL
    O4 - HKLM\..\RunServices: [WINHV.EXE] C:\WINDOWS\SYSTEM\WINHV.EXE /s
    
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/214a5f268dc1b2…ip/RdxIE601.cab
  • With all other programs and browsers closed, click fix checked.
• Delete the following files:C:\WINDOWS\WINXM.EXE
  C:\WINDOWS\SYSTEM\WINHV.EXE
  C:\WINDOWS\SYSTEM\D3IP32.DLL
  C:\WINDOWS\system\vutop.dll
• Run AboutBuster and save the logs:
  • Browse to where you saved AboutBuster and run AboutBuster.exe.
  • Click "Begin Removal" to start the scan.
  • When it has finished, AboutBuster will open a 'Scan Completed' window. Click OK.
  • Another information window will open. Click on Exit.
  • AboutBuster will inform you that a log has been created. Click OK.
• Scan with AdAware SE:
  • Open AdAware SE.
  • Click "Start"
  • Select "Perform Full System scan"
  • Click "Next" to start the scan.
  • When the scan is finished, the screen will tell you if anything has been found, click "Next".
  • The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed.
  • Click Continue?".
• Run CWShredder:
  • Double-click on CWShredder.exe.
  • Click "Fix ->" and click "OK" at the prompt.
  • CWShredder will scan and clean your system of CWS files.
  • Click "Next->" and then "Exit".
• Clean out temporary files:
  • Start | Run | type cleanmgr | OK
  • Let it scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
  • Click "OK" to remove them.
  • Click "Yes" to confirm the deletion.
• Restart your computer normally to return to normal mode.
• Restore Hosts Files:
  • Download the Hoster from here.
  • Unzip the contents of hoster.zip.
  • Double click on hoster.exe to run the program.
  • Press "Restore Original Hosts" and press "OK".
  • Exit Program.
• Free TrendMicro Housecall scan:
  • You'll need to use Internet Explorer or Netscape browsers to run this scan.
  • Vist the TrendMicro Housecall website.
  • Select your country from the drop-down list and click "Go".
  • Choose "Yes" at the ActiveX Security Warning prompt.
  • Please wait while the Housecall engine is updated.
  • Select the drives to be scanned by placing a check in their respective boxes.
  • Check the "Auto Clean" box.
  • Click "SCAN" in order to begin scanning your system.
  • Please be patient while Housecall scans your system for malicious files.
  • If not auto-cleaned, remove anything it finds.
  • Click "Close" to exit the Housecall scanner.
  • Choose "Yes" at the HouseCall message prompt.
• Prepare your reply:
  • Please post a fresh HijackThis log as a reply to this thread.
  • Please post the AboutBuster log.
  • Please note any complications you had.

Step 1
Open Hijackthis, Run a scan and check the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)

With all other programs and browsers closed, click fix checked.


Step 2
Download: DelDomains.inf
http://mvps.org/winhelp2002/DelDomains.inf

To use: Close all open browsers
Right-click DelDomains.inf and select: Install

Note: this will remove all entries in the Trusted Zone and Restricted Zone. You will need to immunize again with Spybot S&D, and re-install Ie-Spyad if you use these programs.


Step 3
This infection has been known to remove certain system files. Make sure the following files are present:

control.exe
rundll32.exe
wmplayer.exe
msconfig.exe
notepad.exe
shell.dll
SDHelper.dll

Check this link for the proper location for those files. If any are missing you can download them from there as well.
http://www.richardthelionhearted.com/?url=…lionhearted.com


Step 4
Please run this online virus scan:
ActiveScan

Copy the results of the ActiveScan and paste them here.


Step 5
Reboot, then post a new HijackThis log and let us know how things are running, we still have a bit to do.

heres the active scan i will now reboot and paste a HJT log Incident Status Location Spyware:spyware/petro-line No disinfected C:\WINDOWS\FAVORITES\SITES ABOUT\Credit counseling.url Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\sdkug.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\d3ju32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\apivh32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\mswt32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\d3tf.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\netnx32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\iexm32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\javajk.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\SYSTEM\uiaa.dll Adware:Adware/WinAD No disinfected C:\WINDOWS\Downloaded Program Files\MediaAccX.dll Adware:Adware/SaveNow No disinfected C:\WINDOWS\iixnzw.dat Adware:Adware/SaveNow No disinfected C:\WINDOWS\jtkhjz.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\pwvpsn.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\rdvmme.dat Virus:Trj/Downloader.BSU Disinfected C:\WINDOWS\crsq.exe Adware:Adware/SearchAid No disinfected C:\WINDOWS\zohkjb.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\vwgcpi.dat Adware:Adware/SaveNow No disinfected C:\WINDOWS\hixxsu.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\sdkhj32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\apicr.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\javado32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\appbh.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\javazg32.dll Adware:Adware/SearchAid No disinfected C:\WINDOWS\xusqgw.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\izucwz.dat Adware:Adware/SaveNow No disinfected C:\WINDOWS\bwogtx.dat Adware:Adware/SaveNow No disinfected C:\WINDOWS\snnspr.dat Adware:Adware/SaveNow No disinfected C:\WINDOWS\tyyoky.dat Adware:Adware/SaveNow No disinfected C:\WINDOWS\kjdbuu.dat Adware:Adware/SearchAid No disinfected C:\My Documents\spy tools\backups\backup-20050404-140731-740.dll Adware:Adware/SearchAid No disinfected C:\ms32.tmp

Step 1
Delete the following files:

C:\ms32.tmp
C:\WINDOWS\SYSTEM\sdkug.dll
C:\WINDOWS\SYSTEM\d3ju32.dll
C:\WINDOWS\SYSTEM\apivh32.dll
C:\WINDOWS\SYSTEM\mswt32.dll
C:\WINDOWS\SYSTEM\d3tf.dll
C:\WINDOWS\SYSTEM\netnx32.dll
C:\WINDOWS\SYSTEM\iexm32.dll
C:\WINDOWS\SYSTEM\javajk.dll
C:\WINDOWS\SYSTEM\uiaa.dll
C:\WINDOWS\iixnzw.dat
C:\WINDOWS\jtkhjz.dat
C:\WINDOWS\pwvpsn.dat
C:\WINDOWS\rdvmme.dat
C:\WINDOWS\zohkjb.dat
C:\WINDOWS\vwgcpi.dat
C:\WINDOWS\hixxsu.dat
C:\WINDOWS\sdkhj32.dll
C:\WINDOWS\apicr.dll
C:\WINDOWS\javado32.dll
C:\WINDOWS\appbh.dll
C:\WINDOWS\javazg32.dll
C:\WINDOWS\xusqgw.dat
C:\WINDOWS\izucwz.dat
C:\WINDOWS\bwogtx.dat
C:\WINDOWS\snnspr.dat
C:\WINDOWS\tyyoky.dat
C:\WINDOWS\kjdbuu.dat
C:\WINDOWS\Downloaded Program Files\MediaAccX.dll
C:\WINDOWS\FAVORITES\SITES ABOUT\Credit counseling.url


Step 2
Reboot, then post a new HijackThis log and let us know how things are running.

jsut wanted to add that before i post the new HJT log any popups im getting here (from internal or external) only happen when using IE for looking at this website and others however i have the boss using FIREFOX . im sorry to say that she doenst listen when i tell her DO NOT REBOOT THE PC ill post a log shortly

Your HijackThis log appears clean now. Are you still having any problem with pop-ups in Internet Explorer?

Step 1
Scan with HijackThis and click config than on the misc tools tab, select delete a file on reboot. Paste the bold text into the file name box and click open.

C:\WINDOWS\Downloaded Program Files\MediaAccX.dll

When it asks you to reboot, choose yes.


If everything is working well now, I'll give you some recommendations to better secure the computer.

it should eb working well know but yes ill take the recomendations as this is the most important terminal in the office. so thanks i have just gone through the steps above and am about to reboot also my HOMEPAGE is set to aboutblank: is this normal after all this ? and do i need to set it to what i would prefer it to be?