Spyware / Malware / Virus Removal

hijackThis log file

23 min read

Looking for the outcome? Ask AI

cvano Topic Starter

Post #1September 22, 2005, 1:48 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 6:50:02 PM, on 9/22/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\java\infosys.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\SpywareBlaster\spywareblaster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Setup Files\hijackthhis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: - {8440CD54-C0DB-475C-B281-D1916644788B} - C:\WINDOWS\lbbho.dll (file missing)
O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O2 - BHO: - {F53BC90D-A9D8-4A64-BB27-1D7A7D9297C2} - C:\WINDOWS\lbbho.dll (file missing)
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [*tapianti] C:\WINDOWS\Drivers\tapianti.exe
O4 - HKLM\..\Run: [*svcs] C:\WINDOWS\security\logs\svcs.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Micah_6:8

Post #2September 23, 2005, 12:27 AM UTC

Greetings and welcome to TomCoyote.org!

You have a "Stopguard" infection. Please do not reboot until told to do so. Each reboot can make the infection harder to remove.

If you have rebooted since you posted this log file, please post a new log file and leave your machine on. If not, continue with the "fix" as suggested below.

Download Killbox from here:

Killbox.zip

Unzip it, but don't run it yet.

Download CleanUp
Install the program, dont run it yet, we will later.

*IMPORTANT NOTE*
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Copy the file names in the quote box below to the clipboard by highlighting them and pressing C (hold the key down, then press C):

C:\DOCUMENTS AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat
C:\WINDOWS\Drivers\tapianti.exe
C:\WINDOWS\security\logs\svcs.exe
C:\WINDOWS\java\infosys.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…://my.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: - {8440CD54-C0DB-475C-B281-D1916644788B} - C:\WINDOWS\lbbho.dll (file missing)

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

O2 - BHO: - {F53BC90D-A9D8-4A64-BB27-1D7A7D9297C2} - C:\WINDOWS\lbbho.dll (file missing)

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O4 - HKLM\..\Run: [*tapianti] C:\WINDOWS\Drivers\tapianti.exe

O4 - HKLM\..\Run: [*svcs] C:\WINDOWS\security\logs\svcs.exe

O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun

O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

Then click "Fix checked".

Close Hijack This!

Now, run Killbox.

In Killbox select "Delete on Reboot".

Click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

When the machine reboots, reboot in "safe" mode.

Now run the CleanUp program:

Running CleanUp

Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
When CleanUp starts go to the Options button (right side of CleanUp screen)
Move the arrow down to "Custom CleanUp!"
Now place a checkmark next to the following (Make sure nothing else is checked!):
Delete Cookies
This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
Empty Recycle Bins
Delete Prefetch files
Cleanup! All Users

[*]Click OK

[*]Then click on the CleanUp button. This will take a short while, let it do its thing.

[*]When asked to reboot system select No

[*]Close CleanUp

Reboot in normal mode and "copy/paste" a new log file into this thread.

cvano

Post #3September 23, 2005, 1:22 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 6:34:00 PM, on 9/23/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\java\infosys.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\Winamp\winamp.exe
D:\Setup Files\hijackthhis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: - {8440CD54-C0DB-475C-B281-D1916644788B} - C:\WINDOWS\lbbho.dll (file missing)
O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O2 - BHO: - {F53BC90D-A9D8-4A64-BB27-1D7A7D9297C2} - C:\WINDOWS\lbbho.dll (file missing)
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [*tapianti] C:\WINDOWS\Drivers\tapianti.exe
O4 - HKLM\..\Run: [*svcs] C:\WINDOWS\security\logs\svcs.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Micah_6:8

Post #4September 23, 2005, 2:21 PM UTC last edited September 23, 2005, 2:22 PM UTC

Please refer to my previous instructions. Go ahead and do "the fix" as posted.

cvano

Post #5September 23, 2005, 3:16 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 8:33:37 PM, on 9/23/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\java\infosys.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Setup Files\hijackthhis\HijackThis.exe

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Micah_6:8

Post #6September 23, 2005, 3:53 PM UTC

Partial success is better than none at all….

Download/install APM

Run APM

Click on each item in the upper window, then look in the lower window.

Check to see which processes are using C:\DOCUMENT AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat

Post back (into this thread) letting me know all processes using that file.

cvano

Post #7September 23, 2005, 4:18 PM UTC

Processes using C:\DOCUMENT AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat are: 536-c:\windows\system32\winlogon.exe 1272-c:\windows\explorer.exe 1392-c:\windows\java\infosys.exe 184- c:\program files\elitecore\cyberoam client for 24online\cyberoamclient.exe(My internet connection client) 1656-c:\program files\internet explorer\iexplore.exe 224-c:\apm\apm.exe

Micah_6:8

Post #8September 23, 2005, 4:59 PM UTC

Step 1:

Please download Process Explorer by Systernals from:

Process Explorer

Step 2:

Copy/paste the text in the Quote box below into Notepad, and save it on the desktop as "killme.txt"

C:\DOCUMENTS AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat
C:\WINDOWS\java\infosys.exe

Step 3:

Print out the following instructions as you will not have Internet Access for the rest of this fix.

Reboot in "safe" mode.

The rest of this fix must be done in safe mode.

Unzip Process Explorer and double click on procexp.exe

In the top section of the Process Exlporer screen double-click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of:

sysofni.dat

once and then click the kill button.

After you have killed all of:

sysofni.dat

under winlogon click OK.

BE SURE TO KILL ONLY THIS FILE!!!

Next double-click on explorer.exe, select the Threads tab, and again click once on each instance of:

sysofni.dat

then click the kill button.

BE SURE TO KILL ONLY THIS FILE!!!

Once you have done that click OK again.

Next double-click on infosys.exe, select the Threads tab, and again click once on each instance of:

sysofni.dat

then click the kill button.

BE SURE TO KILL ONLY THIS FILE!!!

Once you have done that click OK again.

Next run Hijack This! and place a check beside each of the following.

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun

O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

Now click Fix checked and close HijackThis.

Step 4:

On the desktop, open the "killme.txt" file with Notepad.

Then copy the all file names in the "killme.txt" to the clipboard by highlighting them and pressing C (hold the key down, then press C):

Close "killme.txt".

Double click on Killbox.exe and then check the Delete on reboot button.

In Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new Hijack This! log file into this thread.

cvano

Post #9September 23, 2005, 6:43 PM UTC

i dont know how to get this part done Once you see this screen click on each instance of: sysofni.dat once and then click the kill button. After you have killed all of: sysofni.dat under winlogon click OK. BE SURE TO KILL ONLY THIS FILE!!! Next double-click on explorer.exe, select the Threads tab, and again click once on each instance of: sysofni.dat then click the kill button. BE SURE TO KILL ONLY THIS FILE!!! Once you have done that click OK again. Next double-click on infosys.exe, select the Threads tab, and again click once on each instance of: sysofni.dat then click the kill button. BE SURE TO KILL ONLY THIS FILE!!! Once you have done that click OK again.

Micah_6:8

Post #10September 23, 2005, 7:01 PM UTC

OK….

Let's try the other method one more time.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing C (hold the key down, then press C):

C:\DOCUMENTS AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat
C:\WINDOWS\java\infosys.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun

O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

Then click "Fix checked".

Close Hijack This!

Now, run Killbox.

In Killbox select "Delete on Reboot".

Click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

When the machine reboots, reboot in "safe" mode.

Now run the CleanUp program:

Running CleanUp

Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
When CleanUp starts go to the Options button (right side of CleanUp screen)
Move the arrow down to "Custom CleanUp!"
Now place a checkmark next to the following (Make sure nothing else is checked!):
Delete Cookies
This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
Empty Recycle Bins
Delete Prefetch files
Cleanup! All Users

cvano

Post #11September 23, 2005, 7:19 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 12:36:44 AM, on 9/24/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\java\infosys.exe
D:\Setup Files\hijackthhis\HijackThis.exe

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

cvano

Post #12September 23, 2005, 7:22 PM UTC

In the method in which i didnt succeed(i.e click winlogon.exe,under threads,select each instance and kill) i dont know whether delete each entry under winlogon.exe,explorer.exe,infosys.exe or not.

Micah_6:8

Post #13September 23, 2005, 9:11 PM UTC

I've revised the instructions a bit.

I hope this helps.
===================================
Step 1:

Please download Process Explorer by Systernals from:

Process Explorer

Step 2:

Copy/paste the text in the Quote box below into Notepad, and save it on the desktop as "killme.txt"

C:\DOCUMENTS AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat
C:\WINDOWS\java\infosys.exe

Step 3:

Print out the following instructions as you will not have Internet Access for the rest of this fix.

Reboot in "safe" mode.

The rest of this fix must be done in safe mode.

Unzip Process Explorer and double click on procexp.exe

When the program opens, there is an "upper" and "lower" window.

In the "upper window" of Process Explorer screen double-click on winlogon.exe. This brings up another "window", the winlogon.exe properties screen (it says this at the top of that window).

Click on the Threads tab at the top of the winlogon.exe properties screen.

In the "scrollable window" find and click once on each instance of:

sysofni.dat

and then click the Kill button (bottom right of that window.)

After you have killed all of:

sysofni.dat

under winlogon click OK.

BE SURE TO KILL ONLY THIS FILE!!!
If you "kill" something you shouldn't, you'll seriously screw up your system.

Then repeat this process for "explorer.exe" and "infosys.exe" as such:

Next double-click on explorer.exe, select the Threads tab, and again click once on each instance of:

sysofni.dat

then click the kill button.

BE SURE TO KILL ONLY THIS FILE!!!

Once you have done that click OK again.

Next double-click on infosys.exe, select the Threads tab, and again click once on each instance of:

sysofni.dat

then click the kill button.

BE SURE TO KILL ONLY THIS FILE!!!

Once you have done that click OK again.

Next run Hijack This! and place a check beside each of the following.

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun

O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

Now click Fix checked and close HijackThis.

Step 4:

On the desktop, open the "killme.txt" file with Notepad.

Then copy the all file names in the "killme.txt" to the clipboard by highlighting them and pressing C (hold the key down, then press C):

Close "killme.txt".

Double click on Killbox.exe and then check the Delete on reboot button.

In Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new Hijack This! log file into this thread.

cvano

Post #14September 24, 2005, 2:26 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 7:43:39 AM, on 9/24/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\java\infosys.exe
D:\Setup Files\hijackthhis\HijackThis.exe

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Micah_6:8

Post #15September 24, 2005, 3:04 AM UTC

Went back over my notes….

It's been a long time since I've seen this….

I had forgotten about a few files this thing drops that don't show up in a Hijack This! log file that make it return.

*IMPORTANT NOTE*
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Copy the file names in the quote box below to the clipboard by highlighting them and pressing C (hold the key down, then press C):

C:\DOCUMENTS AND SETTINGS\LAN\LOCAL SETTINGS\Temp\sysofni.dat
C:\WINDOWS\java\infosys.exe
c:\windows\system32\host.exe
c:\windows\system32\bkinst.exe

Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
When CleanUp starts go to the Options button (right side of CleanUp screen)
Move the arrow down to "Custom CleanUp!"
Now place a checkmark next to the following (Make sure nothing else is checked!):
Delete Cookies
This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
Empty Recycle Bins
Delete Prefetch files
Cleanup! All Users

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

hijackThis log file

✨ Ask AI

Ask AI