What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Static-feelings Hijack Log

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
–==***@@@ FIND-ALL' VERSION 5.2 -5/18 @@@***==– Sat 05/22/2004 7:31a System Info: Microsoft Windows 2000 [Version 5.00.2195] C: "" (28EB:D0B0) - FS:NTFS clusters:4k Total: 5 371 072 512 [5.0G] - Free: 1 843 826 688 [1.7G] *IE version and Service packs: 6.0.2800.1106 C:\Program Files\Internet Explorer\Iexplore.exe ! REG.EXE VERSION 2.0 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings MinorVersion REG_SZ ;SP1;Q824145; *Google Toolbar version and Attributes: Defaults: "A" ;"R" Path not found - C:\Program Files\google Path not found - C:\Program Files\google *UserAgent: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] *Wmplayer version: 6.4.9.1125 C:\Program Files\Windows Media Player\mplayer2.exe *M$Java version: 5.0.3810.0 C:\WINNT\System32\msjava.dll *PC uptime: 7:31am up 0 days, 1:06 Locked or 'Suspect' file(s) found… \\?\C:\WINNT\System32\WDMG.DLL +++ File read error \\?\C:\WINNT\System32\WDMG.DLL +++ File read error *List of top level windows: HWND PID PRIO TITLE 100a0 1620 norm TF_FloatingLangBar_WndTitle 100a4 1620 norm CiceroUIWndFrame 402f0 1248 norm SysFader 30020 1248 norm _Shell_TrayWnd 20416 1188 norm SysFader 103ce 1248 norm SysFader 102b0 1248 norm SysFader 2022a 1188 norm SysFader 1010a 1508 high Windows Task Manager 10016 236 high NetDDE Agent 101ee 1188 norm CiceroUIWndFrame 101ec 1188 norm CiceroUIWndFrame 1025c 1188 norm CiceroUIWndFrame 1025a 1188 norm CiceroUIWndFrame 10444 1188 norm CiceroUIWndFrame 10442 1188 norm CiceroUIWndFrame 4031e 1808 norm C:\WINNT\system32\cmd.exe 2023a 1188 norm SpywareInfo / TomCoyote Chat Room IRC.DIXIESYS.NET #Privacy - Microsoft Interne 8036c 1188 norm Subratam.org -> Kill Spyware Forums -> The about:blank Fix tutorial - Microsoft c0270 1248 norm dllfix 500bc 1188 norm TomCoyote Forums -> Static-feelings Hijack Log - Microsoft Internet Explorer 2900ec 1248 norm Timer 9028a 1248 norm HiJACK THiS 101e6 1188 norm DDE Server Window 10092 1248 norm CSC Notifications Window 10086 1248 norm Power Meter 10080 1248 norm Connections Tray 10078 1476 norm McAfee_FwClientClass 1005a 1400 norm McAfee Firewall 20024 1248 norm DDE Server Window 20038 1016 norm SYSTEM AGENT COM WINDOW 1001c 236 high MM Notify Callback 1007e 1248 norm MS_WebcheckMonitor 20100 1188 norm SysFader 103a8 1248 norm pv 1005e 1248 norm Program Manager 10040 1248 norm Default IME 1010c 1508 high Default IME 20236 1188 norm Default IME 29040c 1188 norm Default IME 320252 1248 norm Default IME 20132 1188 norm Default IME 1044a 1188 norm IMMIF UI 2028c 1248 norm Default IME 1027e 1188 norm Default IME 10268 1188 norm IMMIF UI 101f4 1188 norm IMMIF UI 3009a 1620 norm Default IME 10088 1248 norm Default IME 10082 1248 norm Default IME 1007a 1476 norm Default IME 1005c 1400 norm Default IME 20036 1016 norm Default IME 103aa 1248 norm Default IME 2002a 1248 norm Default IME REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "AppInit_DLLs"="" REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE03BB95-2A23-43FD-9014-C3723DB4F0FB}] REGEDIT4 [HKEY_CLASSES_ROOT\PROTOCOLS\Filter] [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler] @="AP Class Install Handler filter" "CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate] @="AP Deflate Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip] @="AP GZIP Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml] @="AP lzdhtml encoding/decoding Filter" "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html] "CLSID"="{EB4470D4-18F8-4A20-A0BB-8F10E22C3AD0}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain] "CLSID"="{EB4470D4-18F8-4A20-A0BB-8F10E22C3AD0}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml] @="WebView MIME Filter" "CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/xml] "CLSID"="{807553E5-5146-11D5-A672-00B0D022E945}" *Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM 
Post #17
Hi Static-Feelings,

Run start.bat and this time, choose option #2, then choose option #2 again at the next menu. You will get a message that your computer will reboot in 15 seconds. After your computer reboots, a window will flash on your screen and notepad will open with a report in it.

Reboot your computer. Go here and download this program called CWShredder. Then, make sure ALL windows are closed, run CWShredder.exe and click Fix (not scan).

Go to the dllfix folder on your desktop and copy the contents of the output.txt and logs.txt files back into this thread, along with an updated hijackthis log.
Post #18
–==***@@@ FIND-ALL' VERSION 5.2 -5/18 @@@***==– Sat 05/22/2004 7:31a System Info: Microsoft Windows 2000 [Version 5.00.2195] C: "" (28EB:D0B0) - FS:NTFS clusters:4k Total: 5 371 072 512 [5.0G] - Free: 1 843 826 688 [1.7G] *IE version and Service packs: 6.0.2800.1106 C:\Program Files\Internet Explorer\Iexplore.exe ! REG.EXE VERSION 2.0 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings MinorVersion REG_SZ ;SP1;Q824145; *Google Toolbar version and Attributes: Defaults: "A" ;"R" Path not found - C:\Program Files\google Path not found - C:\Program Files\google *UserAgent: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] *Wmplayer version: 6.4.9.1125 C:\Program Files\Windows Media Player\mplayer2.exe *M$Java version: 5.0.3810.0 C:\WINNT\System32\msjava.dll *PC uptime: 7:31am up 0 days, 1:06 Locked or 'Suspect' file(s) found… \\?\C:\WINNT\System32\WDMG.DLL +++ File read error \\?\C:\WINNT\System32\WDMG.DLL +++ File read error *List of top level windows: HWND PID PRIO TITLE 100a0 1620 norm TF_FloatingLangBar_WndTitle 100a4 1620 norm CiceroUIWndFrame 402f0 1248 norm SysFader 30020 1248 norm _Shell_TrayWnd 20416 1188 norm SysFader 103ce 1248 norm SysFader 102b0 1248 norm SysFader 2022a 1188 norm SysFader 1010a 1508 high Windows Task Manager 10016 236 high NetDDE Agent 101ee 1188 norm CiceroUIWndFrame 101ec 1188 norm CiceroUIWndFrame 1025c 1188 norm CiceroUIWndFrame 1025a 1188 norm CiceroUIWndFrame 10444 1188 norm CiceroUIWndFrame 10442 1188 norm CiceroUIWndFrame 4031e 1808 norm C:\WINNT\system32\cmd.exe 2023a 1188 norm SpywareInfo / TomCoyote Chat Room IRC.DIXIESYS.NET #Privacy - Microsoft Interne 8036c 1188 norm Subratam.org -> Kill Spyware Forums -> The about:blank Fix tutorial - Microsoft c0270 1248 norm dllfix 500bc 1188 norm TomCoyote Forums -> Static-feelings Hijack Log - Microsoft Internet Explorer 2900ec 1248 norm Timer 9028a 1248 norm HiJACK THiS 101e6 1188 norm DDE Server Window 10092 1248 norm CSC Notifications Window 10086 1248 norm Power Meter 10080 1248 norm Connections Tray 10078 1476 norm McAfee_FwClientClass 1005a 1400 norm McAfee Firewall 20024 1248 norm DDE Server Window 20038 1016 norm SYSTEM AGENT COM WINDOW 1001c 236 high MM Notify Callback 1007e 1248 norm MS_WebcheckMonitor 20100 1188 norm SysFader 103a8 1248 norm pv 1005e 1248 norm Program Manager 10040 1248 norm Default IME 1010c 1508 high Default IME 20236 1188 norm Default IME 29040c 1188 norm Default IME 320252 1248 norm Default IME 20132 1188 norm Default IME 1044a 1188 norm IMMIF UI 2028c 1248 norm Default IME 1027e 1188 norm Default IME 10268 1188 norm IMMIF UI 101f4 1188 norm IMMIF UI 3009a 1620 norm Default IME 10088 1248 norm Default IME 10082 1248 norm Default IME 1007a 1476 norm Default IME 1005c 1400 norm Default IME 20036 1016 norm Default IME 103aa 1248 norm Default IME 2002a 1248 norm Default IME REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "AppInit_DLLs"="" REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE03BB95-2A23-43FD-9014-C3723DB4F0FB}] REGEDIT4 [HKEY_CLASSES_ROOT\PROTOCOLS\Filter] [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler] @="AP Class Install Handler filter" "CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate] @="AP Deflate Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip] @="AP GZIP Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml] @="AP lzdhtml encoding/decoding Filter" "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html] "CLSID"="{EB4470D4-18F8-4A20-A0BB-8F10E22C3AD0}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain] "CLSID"="{EB4470D4-18F8-4A20-A0BB-8F10E22C3AD0}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml] @="WebView MIME Filter" "CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/xml] "CLSID"="{807553E5-5146-11D5-A672-00B0D022E945}" *Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM 
Post #19
CWSDLL Appinit Fix By Shadowwar Please Do not mirror Without Permission! I can be contacted at spywaresubmit at aol.com Sat 05/22/2004 7:52a Backing up Registry Hive The operation completed successfully Deleting Windows Key The operation completed successfully Restoring Registry Hive The operation completed successfully Deleting temp value The operation completed successfully Running from C:\Documents and Settings\[removed]\Desktop\dllfix\dllfix Scanning for bad files in system32 1st pass File was not found on first Pass. Scanning for bad files in system32 2nd pass A file could not be found. Here is a directory listing to post. ———- DIR.TXT 05/22/2004 06:35a 31,232 micdkaa.dll 05/17/2004 11:50p 57,344 wdmg.dll 03/23/2004 09:17p 497,936 NTDLL.DLL 03/23/2004 09:17p 742,160 KERNEL32.DLL 03/23/2004 09:17p 971,536 sfcfiles.dll 03/23/2004 09:17p 27,920 umandlg.dll 03/23/2004 09:17p 49,936 samlib.dll 03/23/2004 09:17p 42,256 BASESRV.DLL 03/23/2004 09:17p 312,592 NETAPI32.DLL 03/23/2004 09:17p 54,544 mpr.dll 03/23/2004 09:17p 37,136 mf3216.dll 03/23/2004 09:17p 442,640 ipnathlp.dll 03/23/2004 09:17p 1,028,880 ntdsa.dll 03/23/2004 09:17p 76,048 cryptsvc.dll 03/23/2004 09:17p 92,432 dnsrslvr.dll 03/23/2004 09:17p 115,984 PSBASE.DLL 03/23/2004 09:17p 69,904 browser.dll 03/23/2004 09:17p 47,888 EVENTLOG.DLL 03/23/2004 09:17p 388,368 SAMSRV.DLL 03/23/2004 09:17p 167,184 WINTRUST.DLL 03/23/2004 09:17p 111,376 scecli.dll 03/23/2004 09:17p 61,200 CRYPTNET.DLL 03/23/2004 09:17p 50,960 w32time.dll 03/23/2004 09:17p 253,200 scesrv.dll 03/23/2004 09:17p 371,472 NETLOGON.DLL 03/23/2004 09:17p 335,120 MSGINA.DLL 03/23/2004 09:17p 403,216 USER32.DLL 03/23/2004 09:17p 53,520 msasn1.dll 03/23/2004 09:17p 134,928 dnsapi.dll 03/23/2004 09:17p 388,368 ADVAPI32.DLL 03/23/2004 09:17p 543,504 CRYPT32.DLL 03/23/2004 06:17p 242,448 GDI32.DLL 03/10/2004 09:37p 143,120 SCHANNEL.DLL 03/10/2004 09:37p 123,152 MSV1_0.DLL 03/10/2004 09:37p 520,976 LSASRV.DLL 03/10/2004 09:37p 210,192 kerberos.dll 02/20/2004 10:40p 12,288 impborl.dll 02/05/2004 03:18p 5,869,056 sp3res.dll
Post #20
Logfile of HijackThis v1.97.7 Scan saved at 8:21:59 AM, on 5/22/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\drivers\CDAC11BA.EXE C:\WINNT\System32\cisvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\Explorer.EXE D:\McAfee\McAfee Firewall\CPD.EXE D:\McAfee\McAfee Firewall\CPD.EXE C:\WINNT\system32\ctfmon.exe C:\WINNT\System32\cidaemon.exe C:\WINNT\System32\cidaemon.exe C:\Documents and Settings\Administrator\Desktop\HiJACK THiS\HijackThis.exe C:\WINNT\system32\taskmgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINNT\system32\NOTEPAD.EXE C:\WINNT\system32\NOTEPAD.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{C433FE03-1F97-4FB8-A7AB-5CCB078B268E}: NameServer = 216.138.0.4 216.138.0.11
Post #21
Hi Static-Feelings,

Hmmm, that's an interesting hijackthis log. Let's fix what's there.

Run hijackthis again, click Scan. Check the boxes next to these entries. Then close all windows except HijackThis. Tell HijackThis to 'Fix checked'.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

Reboot your computer, run hijackthis again and post a fresh hijackthis log.
Post #22
Logfile of HijackThis v1.97.7 Scan saved at 8:45:06 AM, on 5/22/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\drivers\CDAC11BA.EXE C:\WINNT\System32\cisvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe D:\McAfee\McAfee Firewall\CPD.EXE C:\WINNT\Explorer.EXE D:\McAfee\McAfee Firewall\CPD.EXE C:\WINNT\system32\ctfmon.exe C:\Documents and Settings\Administrator\Desktop\HiJACK THiS\HijackThis.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
Post #23
Hi static-feelings,

Thats a clean log. Here's some reading for prevention.

Protection - download and install:

SpywareBlaster will block bad ActiveX and malevolent cookies. http://www.javacoolsoftware.com/spywareblaster.html

IE-SPYAD puts over 4000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD

Both are very small free programs that you run once, and then just occasionally to check for updates.

Make sure you have the latest critical updates and make sure you check back often for new updates. This will help prevent some of this stuff from getting on your PC.
http://v4.windowsupdate.microsoft.com/en/default.asp

And also see So how did I get infected in the first place?
Post #25
Glad we could help :D

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI