What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Logfile...Please help!

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited


"ZStart" = "c:\windows\system32\cxdxregt.exe DO0605" [empty string]


Yes this file is there…I couldn't delete it by sending it to the recycle bin. It said the file may be in use or write protected.

C:\Documents and Settings\Home User\Start Menu\Programs\Startup
"Zstart" -> shortcut to: "C:\Documents and Settings\Home User\Local Settings\Temp\zxinst12.exe DO0605" [empty string]


Yes these files likewise are present

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/html\CLSID = "{DFAA31C8-A356-4313-9D95-5EDAB46C5070}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\qlink32.dll" [empty string]


I did find a file called "qlink32.dll" in the system32 folder. I did not attempt to delete it.

"{4E7BD74F-2B8D-469E-8DBC-A42EB79CB428}" = "COMMUNICATOR" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\communicator.dll" [empty string]


I did not see this file. I think I removed communicator this morning with SpybotSD.

Can you verify that the files listed there (C:\Documents and Settings\Home User\Local Settings\Temp\zxinst12.exe, C:\WINDOWS\system32\communicator.dll) do/do not exist.


zxinst.exe does exist…I have not tried to delete it.
communicator.dll does not exist. Again, I'm pretty sure I removed Communicator this morning with SpybotSD

On the key you couldn't delete ("Access denied") can you navigate to it with Reglite, on it, and choose "Take ownership" (I think that's what it says) then delete it?


I just tried that…Access Denied. Even after "taking ownership". Should I have tried in safe mode?

I didn't try to delete those files because you didn't instruct me to. You just asked if they were present. If you think I should try let me know.
Post #32
Run Reglite.

Copy and paste the bold text below into the address bar, then hit 'Go':

HKEY_CURRENT_USER\Software

In the left hand pane. on the ISTbar key and choose Rename. Rename it to junk.

In the left hand pane. on the junk key and choose Delete.

Let me know if this was successful.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

c:\windows\system32\cxdxregt.exe
C:\Documents and Settings\Home User\Local Settings\Temp\zxinst12.exe
C:\WINDOWS\system32\qlink32.dll
C:\Documents and Settings\Home User\Start Menu\Programs\Startup\Zstart.lnk


Run Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, please give me a "status report".
:)
Post #33
Hey Micah,

I tried to do as you instructed. "ISTbar" was not present in HKEY_CURRENT_USER\Software. It was however present in HKEY_LOCAL_MACHINE\Software. I tried to change its name to "junk" but received an "error renaming" message. When I searched around in RegistrarLite and went back to that folder I found a new folder had been created called "junk". This file was deletable, but ISTbar remains undeletable.

I ran Killbox and all files you specified were deleted successfully.

This is really becoming annoying for me as I'm sure it is for you as well. I really appreciate your patience and cooperation with all this.
Post #34
Boot in "safe mode". If you have more than one account, be sure to log on to an account that has "administrator" privileges.

Go to:

Start –> Run

In the box type in regedt32 then hit (or click OK)

Navigate to the key:

HKEY_LOCAL_MACHINE\Software\ISTbar



Choose: Permissions –> Advanced –> Owner

Change the owner to the account you are currently logged on as. Click Apply –> OK

Close the windows to get back to the main "Registry Editor" window.

on:

HKEY_LOCAL_MACHINE\Software\ISTbar <– This key

And choose Delete

Boot in normal mode, and let me know how things went.
:)
Post #35 last edited
Hey Micah, I tried what you suggested. No luck. I even tried renaming the folder to "junk" and then deleting it but I got the "Error Renaming" message. When viewing the Permissions/Owner options I noticed there was two entires. One was called "Administrator" and the other was called "Administrators"(plural). I don't have a network so I thought it was strange that there might be two Administrator options. Is this standard? That is, when I boot in safe mode, I have the option of logging in as "Administrator" or "Home User" (my default). What I'm wondering is is it possible for ISTbar to be restricted to this third user "Administrators" and that's why we can't seem to alter it or delete it.
Post #36
Make a folder on your machine and download RegDACL.

Click the "Download Freeware version as small zip file" link, and download the zip file into that folder. Unzip it in that folder.

Copy the text in the following quote box into Notepad:

RegDACL HKLM\Software\ISTbar /L > junk.txt
notepad junk.txt

Save it as checkme.bat, and save it into the RegDACL folder.

Now, the checkme.bat file.

A Notepad window will open up.

Paste it's contents into your next post.
:)
Post #37
Hey Micah, Here is the contents of the txt file created: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Hint: No DACL exists for HKLM\Software\ISTbar! Access Control List for Registry key HKLM\Software\ISTbar:
Post #38
Sorry it's taken a while to reply. :oops:

Copy the text in the following quote box into Notepad:

RegDACL HKLM\Software\ISTbar /gga:F

Save it as fixme.bat, and save it into the RegDACL folder.

Reboot in "safe" mode, and log into an account with "Administrator" privileges.

Now, the fixme.bat file.

This should give any login with "Administrator" privileges full access to this key.

Now, try to delete it (with regedit or Reglite).

If you can't delete it right out, "take ownership" of the key, then delete it.

Let me know how it goes.
:)
Post #39
Thank you so much Micah!! :D It's gone! Not a trace! I ran AdAware and the only things showing up are tracking cookies! I feel so much better knowing that my 'puter isn't infected! Thanks again and, take care! :wavey:
Post #42
Thanks again Micah, and Jacee, and Bobbi!

Just for good measure I'm posting another HJT logfile…A line I'm wondering about I've bolded…Please tell me if it's okay.

Logfile of HijackThis v1.99.1
Scan saved at 1:42:25 AM, on 13/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1125619201843
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai.net/f/248/5462/2h/www…ol/SymDlBrg.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{172712F7-1537-4DB4-B5F2-63CBA1489CC2}: NameServer = 206.47.244.54 206.47.244.110
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #43 last edited
The IP address traces to here:

IP Address: [removed]

City: TORONTO

State or Region: ONTARIO

Country: CANADA

ISP: BELL

If that looks familiar, then all is well.

The rest of the log is A-OK!
:)
Post #44
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI