need help

Are you following my directions, and closing ALL PROGRAMS (especially Internet related ones) before fixing this :

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15


Go to:

Start –> Run

In the box type in msconfig then hit (or click OK)

Click the "BOOT.INI" tab.

Write down what's in the upper box, and post it here.

Yes, I have been following your directions to the letter….in msconfig, there is the general tab, system.ini, win.ini, services, and startup. There is no boot.ini tab

That, it seems, would be your "BOOT.INI" problem….

I'll have to do a little research on that….


In the meantime:

Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop.

Close all programs/windows.

Fix this again:

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15

combofix.exe to run it.

When finished, it will produce a log for you.

Post that log in your next reply, along with a new HijackThis! log.


Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Thanks Micah for your patience. Here's the log: Larry - 06-08-19 8:52:30.73 ComboFix 06.08.18 - Running from: C:\Documents and Settings\[removed]\Desktop\Unused Desktop Shortcuts ((((((((((((((((((((((((((((((( Files Created from 2006-07-19 to 2006-08-19 )))))))))))))))))))))))))))))))))) 2006-08-15 10:45 1,060,864 C:\windows\system32\mfc71.dll 2006-08-03 19:06 109,568 C:\windows\system32\pxinsi64.exe 2006-08-03 19:06 108,544 C:\windows\system32\pxcpyi64.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-08-19 00:24 ——– d——– C:\Program Files\ewido anti-spyware 4.0 2006-08-15 01:26 ——– d——– C:\Program Files\Internet Explorer 2006-08-09 23:32 ——– d——– C:\Program Files\Yahoo! 2006-08-09 23:21 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-08-08 09:46 777472 –a—— C:\WINDOWS\system32\drivers\avg7core.sys 2006-08-08 09:46 27904 –a—— C:\WINDOWS\system32\drivers\avg7rsxp.sys 2006-08-05 01:30 ——– d——– C:\Program Files\Zvideo Codec 2006-08-04 15:24 ——– d——– C:\Program Files\MTV Networks 2006-08-03 19:11 ——– d——– C:\Program Files\Windows Media Player 2006-07-31 00:24 ——– d——– C:\Program Files\MSN Messenger 2006-07-30 23:44 ——– d——– C:\Program Files\Support Tools 2006-07-30 23:44 ——– d——– C:\Program Files\Paltalk Messenger 2006-07-30 23:44 ——– d——– C:\Program Files\OfficeUpdate11 2006-07-30 23:44 ——– d——– C:\Program Files\NetAssistant 2006-07-30 23:44 ——– d——– C:\Program Files\Morpheus Toolbar 2006-07-30 23:44 ——– d——– C:\Program Files\iTunes 2006-07-30 21:41 ——– d——– C:\Program Files\MsnMusic 2006-07-30 09:51 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-07-28 16:22 ——– d——– C:\Program Files\Poker In Canada 2006-07-27 09:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-07-26 08:54 ——– d——– C:\Program Files\Common Files 2006-07-26 08:52 ——– d——– C:\Documents and Settings\Larry\Application Data\Sun 2006-07-21 04:24 72704 –a—— C:\WINDOWS\system32\hlink.dll 2006-07-18 19:14 520192 –a—— C:\WINDOWS\system32\DivXsm.exe 2006-07-18 19:13 3596288 –a—— C:\WINDOWS\system32\qt-dx331.dll 2006-07-18 19:13 20640 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys 2006-07-18 19:13 200704 –a—— C:\WINDOWS\system32\ssldivx.dll 2006-07-18 19:13 109568 ——— C:\WINDOWS\system32\pxinsi64.exe 2006-07-18 19:13 108544 ——— C:\WINDOWS\system32\pxcpyi64.exe 2006-07-18 19:13 1044480 –a—— C:\WINDOWS\system32\libdivx.dll 2006-07-18 19:09 90112 –a—— C:\WINDOWS\system32\dpl100.dll 2006-07-18 19:09 778240 –a—— C:\WINDOWS\system32\divx_xx0c.dll 2006-07-18 19:09 778240 –a—— C:\WINDOWS\system32\divx_xx07.dll 2006-07-18 19:09 761856 –a—— C:\WINDOWS\system32\divx_xx11.dll 2006-07-18 19:09 620180 –a—— C:\WINDOWS\system32\DivX.dll 2006-07-18 19:09 593920 –a—— C:\WINDOWS\system32\dpuGUI11.dll 2006-07-18 19:09 57344 –a—— C:\WINDOWS\system32\dpv11.dll 2006-07-18 19:09 53248 –a—— C:\WINDOWS\system32\dpuGUI10.dll 2006-07-18 19:09 344064 –a—— C:\WINDOWS\system32\dpus11.dll 2006-07-18 19:09 294912 –a—— C:\WINDOWS\system32\dpu11.dll 2006-07-18 19:09 294912 –a—— C:\WINDOWS\system32\dpu10.dll 2006-07-18 19:09 200704 –a—— C:\WINDOWS\system32\dtu100.dll 2006-07-18 19:09 12288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll 2006-07-18 19:09 118784 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2006-06-21 09:17 ——– d——– C:\Documents and Settings\Larry\Application Data\Yahoo! Messenger 2006-06-20 22:50 ——– d——– C:\Program Files\MSXML 4.0 2006-05-28 21:33 331 –a—— C:\Documents and Settings\Larry\Application Data\internaldb1942.dat 2006-05-28 21:32 13089 –a—— C:\Documents and Settings\Larry\Application Data\internaldb4653.dat 2006-05-28 21:32 0 –a—— C:\Documents and Settings\Larry\Application Data\internaldb5486.dat 2006-05-28 21:28 84992 –a—— C:\Documents and Settings\Larry\Application Data\internaldb7033.dat 2006-05-23 15:32 0 –a—— C:\Documents and Settings\Larry\Application Data\internaldb870.dat 2006-05-18 17:01 0 –a—— C:\Documents and Settings\Larry\Application Data\internaldb7065.dat 2006-05-18 17:01 0 –a—— C:\Documents and Settings\Larry\Application Data\internaldb4585.dat 2006-05-13 18:04 0 –a—— C:\Documents and Settings\Larry\Application Data\internaldb2455.dat 2006-05-13 18:03 23 –a—— C:\Documents and Settings\Larry\Application Data\inifile41.ini (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe" "Motive SmartBridge"="C:\\PROGRA~1\\NETASS~1\\SMARTB~1\\MotiveSB.exe" "HP Software Update"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000004 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Gamma Loader.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE " "item"="Adobe Gamma Loader" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LightFrame 3.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\LightFrame 3.lnk" "backup"="C:\\WINDOWS\\pss\\LightFrame 3.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Philips\\LIGHTF~1\\LIGHTF~1.EXE " "item"="LightFrame 3" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NetAssistant.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\NetAssistant.lnk" "backup"="C:\\WINDOWS\\pss\\NetAssistant.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\NETASS~1\\bin\\matcli.exe -boot" "item"="NetAssistant" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\WinZip Quick Pick.lnk" "backup"="C:\\WINDOWS\\pss\\WinZip Quick Pick.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\WinZip\\WZQKPICK.EXE " "item"="WinZip Quick Pick" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\AltnetPointsManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="points manager" "hkey"="HKLM" "command"="c:\\program files\\altnet\\points manager\\points manager.exe -s" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\eBayToolbar] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="eBayTBDaemon" "hkey"="HKLM" "command"="C:\\Program Files\\eBay\\eBay Toolbar2\\eBayTBDaemon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\InCD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="InCD" "hkey"="HKLM" "command"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\IPInSightLAN 01] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IPClient" "hkey"="HKLM" "command"="\"C:\\Program Files\\Visual Networks\\Visual IP InSight\\Sympatico Consumer\\IPClient.exe\" -l" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\IPInSightMonitor 01] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IPMon32" "hkey"="HKLM" "command"="\"C:\\Program Files\\Visual Networks\\Visual IP InSight\\Sympatico Consumer\\IPMon32.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\Lexmark X1100 Series] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="lxbkbmgr" "hkey"="HKLM" "command"="\"C:\\Program Files\\Lexmark X1100 Series\\lxbkbmgr.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\NeroCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\SemanticInsight] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SemanticInsight" "hkey"="HKLM" "command"="C:\\Program Files\\RXToolBar\\Semantic Insight\\SemanticInsight.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\StandardInstall] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\Windows Defender] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MSASCui" "hkey"="HKLM" "command"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\zango] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="zango" "hkey"="HKLM" "command"="\"c:\\program files\\zango\\zango.exe\"" "inimapping"="0" Contents of the 'Scheduled Tasks' folder C:\windows\tasks\MP Scheduled Scan.job Completion time: Sat 08/19/2006 8:53:04.68 ComboFix.txt ComboFix2.txt

A few items in the combofix log that aren't welcome:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\AltnetPointsManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="points manager"
"hkey"="HKLM"
"command"="c:\\program files\\altnet\\points manager\\points manager.exe -s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\startupreg\zango]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zango"
"hkey"="HKLM"
"command"="\"c:\\program files\\zango\\zango.exe\""
"inimapping"="0"

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from Spybot Search and Destroy
(This is the NEW Version 1.4)
Get AdAware SE Personal from Lavasoft
(This is the NEW Build 1.6)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

Configure Adaware

Configure Spybot

Reboot after running each program.

Post a new HijackThis! log.

A link for rebuiding your missing "BOOT.INI":

Missing or Invalid BOOT.INI Fix

Great!

The rest of your log looks "fine as frog hair".


How's it running?


Securing Your PC After An Attack

Very smooth Micah! Thanks ever so much for your help. This is greatly appreciated! Larry:)

Thank you for choosing TomCoyote for your malware removal solutions.

M68

Securing Your PC After An Attack

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.