RatHat
Karen,
You can leave it as is, just don't check the CD Auto Run.
Regards,
RatHat
Spyware / Malware / Virus Removal
[Closed] I am infected with Exploit Obscured Html AGAIN!
64 min read
Classy_Lady
Hi Rat Hat - You can assume since you didn't get a post from me last night that the fix didn't work. Needless to say I am getting scared that the machine is now FUBAR! PLEASE PLEASE PLEASE tell me you can fix this.
I did what you asked - I burned the beta file you posted onto a cd - took it home - booted up my pc at home in SAFE MODE. In safe mode I get the option to login as Administrator or Owner (the Administrator account no longer exists when not in safe mode) and while both accounts function as full Admin, I extracted your file first to the desktop of the Administrator account and then checked ENABLED in all the boxes except the Auto Run - clicked Exit and restarted the machine. The system remained unchanged in that it still brought up my desktop but continued to give me 'You don't have permission' messages. So I restarted the machine in SAFE MODE and extracted the file onto the OWNER account and tried the same steps - unfortunately the same issue reoccurs. I then deleted the DSS.exe file because this problem seemed to start after downloading and attempting to run this - and while there is not Uninstall, I just deleted it but that didn't help UGH! I then tried to do a system restore that was offered in SAFE MODE thinking that if I went back to a point before Christmas my machine would magically get better again - unfortunately that didn't change anything either. In Safe Mode I was able to go to USER accounts and I tried creating another ADMIN account thinking that I could switch between them in regular Windows mode and get my permissions restored - No such luck! The account shows - I am able to switch users in regular mode however the permissions are not any different than in the OWNER account mode. 
I have to tell you my husband is very mad at me and is giving me alot of grief over this so I would appreciate it if we could get this resolved quickly. He is upset that I let the kids use the PC to begin with because he says everytime they do we get a virus or trojan - and he is upset that I am working with virtual strangers (you and this forum) to resolve this and have no way to contact anyone or followup because everyone is Anonymous. PLEASE help me here. I only have today and tomorrow morning at work - which is access to a pc and internet. From home I am unable to do anything Can you get some help on this? Can you get someone more experienced so we can do this quickly? My husband is not very nice when he is angry and so I don't want to have to tell him that this is messed up MORE through trying to fix it.
I look forward to hearing from you ASAP.
Thanks
Sincerely
Karen (Classy Lady)
RatHat
Karen,
There are some new rootkits around that may have caused this, however at the moment I cannot tell for sure. You can ask your husband to come into this thread if he is upset, and I will try to explain what is happening to him.
One thing he has to understand is that it is not you, or your kids fault that this has happened. It can happen to almost anyone. You just have to look at the number of people who come to this and other forums for assistance, to see that. The people requesting help are not all kids who mess around on weird sites, but people from all walks of life.
This forum, and others like it, only allow trained people to respond to malware logs. All of us are volunteers, and do not ask to be paid for our services. It iss unlikely that you would get better results if you went to a computer shop. There they would most likely just ask you to reformat.
OK, now l will do a bit of research on this and get back to you shortly. Please don't try to fix anything or make any changes until I get back to you.
Regards,
RatHat
There are some new rootkits around that may have caused this, however at the moment I cannot tell for sure. You can ask your husband to come into this thread if he is upset, and I will try to explain what is happening to him.
One thing he has to understand is that it is not you, or your kids fault that this has happened. It can happen to almost anyone. You just have to look at the number of people who come to this and other forums for assistance, to see that. The people requesting help are not all kids who mess around on weird sites, but people from all walks of life.
This forum, and others like it, only allow trained people to respond to malware logs. All of us are volunteers, and do not ask to be paid for our services. It iss unlikely that you would get better results if you went to a computer shop. There they would most likely just ask you to reformat.
OK, now l will do a bit of research on this and get back to you shortly. Please don't try to fix anything or make any changes until I get back to you.
Regards,
RatHat
Classy_Lady
Thanks Rat Hat. I am at work until 4pm. I won't be able to touch the pc until after I get home. I will check back to this thread before heading out to see what you have come up.
My husband is not real computer literate or savvy - he knows one way to do things and minimal things at that. Doesn't use a computer at work or anything like that so while I understand this isn't my fault or the kids fault, his feeling is that they went to different sites than we go to therefore they MUST have caused this
And while I thank you for the offer to invite him into this thread, he cannot read anything until after the PC is fixed since it is our only one.
I have had good help in the past from the volunteers at this site which is why I said I am determined to take the class and 'give back' when I am fixed. I don't want to go and get my pc reformatted because I will loose all my pictures and documents as you well know. Thanks for your understanding and willingness to research and help. I will look to hear from you later.
Sincerely
Karen (Classy Lady)
My husband is not real computer literate or savvy - he knows one way to do things and minimal things at that. Doesn't use a computer at work or anything like that so while I understand this isn't my fault or the kids fault, his feeling is that they went to different sites than we go to therefore they MUST have caused this
And while I thank you for the offer to invite him into this thread, he cannot read anything until after the PC is fixed since it is our only one. I have had good help in the past from the volunteers at this site which is why I said I am determined to take the class and 'give back' when I am fixed. I don't want to go and get my pc reformatted because I will loose all my pictures and documents as you well know. Thanks for your understanding and willingness to research and help. I will look to hear from you later.
Sincerely
Karen (Classy Lady)
RatHat
1. Please open Notepad
2. Now copy/paste the entire content of the codebox below into the Notepad window:
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
Please attach the log in your next post.
To attach a file, do the following:
OK, lets see how running the above goes. The first option will fix a few entries, the second will produce a log that may give a better view of what exactly has happened.
If this fails to get it restored to full admin rights, there is another option open to us, but I would rather leave that for now. The next option will require your original windows installation disk, so dig that out, just in case.
Regards,
RatHat
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
File::
C:\Program Files\Common Files\remove_tools.html
Driver::
FarStoneFireWallDrive
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}]
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
- A new HijackThis log.
Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
- Close ALL OTHER PROGRAMS.
- Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
- Check the Radio buttons for Files/Folders Created Within 90 Days and Files/Folders Modified Within 90 Days
- Under Additional Scans click the checkboxes in front of ALL items:
- Now click the Run Scan button on the toolbar.
- Let it run unhindered until it finishes.
- When the scan is complete Notepad will open with the report file loaded in it.
- Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Please attach the log in your next post.
To attach a file, do the following:
- Click Add Reply
- Under the reply panel is the Attachments Panel
- Browse for the attachment file you want to upload, then click the green Upload button
- Once it has uploaded, click the Manage Current Attachments drop down box
- Click on [external image: Posted Image] to insert the attachment into your post
OK, lets see how running the above goes. The first option will fix a few entries, the second will produce a log that may give a better view of what exactly has happened.
If this fails to get it restored to full admin rights, there is another option open to us, but I would rather leave that for now. The next option will require your original windows installation disk, so dig that out, just in case.
Regards,
RatHat
Classy_Lady
RatHat - I have printed out your latest set of instructions however I have a question - do I create this notepad information in SAFEMODE or in the general screen after boot up?
Keep in mind that while I can see my desktop - 98% of the items I click on tell me I don't have permission to access them…
Since I cannot get to copy and paste in the notepad is it ok for me to TYPE the data? Or should I load this on a cd and take it home? Technically I am booting in SAFE MODE but there is an option to boot in SAFE MODE with Networking - will that allow me to see the What the Tech page on the internet in safe mode? I haven't tried it in the NETWORKING mode as yet.
Am I doing the drag of the .txt script to combofix in Safe Mode?
As far as original windows installation disk - ummmm the pc came with Windows XP - I am not sure I have a disk. I think my son has Windows XP on cd but can you verify what type of detail i am looking for? The pc is 5 or 6 years old I think.
Thanks - and sorry about all the questions
~~Karen
RatHat
Karen,
Click here then choose Download HTML Version.
Copy the downloaded file to disk, then transfer it to the infected machine and open it up to view all of this topic. Also download WinPFind and copy that to disk.
You can run the combofix option from safe mode, but should try to run WinPFind from normal mode.
I will need you to use the XP CD if we need to go into the recovery console to restore some of your registry keys, but we will face that when we get to it.
By the way, does your infected computer have a CD Burning drive?
Regards,
RatHat
Click here then choose Download HTML Version.
Copy the downloaded file to disk, then transfer it to the infected machine and open it up to view all of this topic. Also download WinPFind and copy that to disk.
You can run the combofix option from safe mode, but should try to run WinPFind from normal mode.
I will need you to use the XP CD if we need to go into the recovery console to restore some of your registry keys, but we will face that when we get to it.
By the way, does your infected computer have a CD Burning drive?
Regards,
RatHat
Classy_Lady
Yes it has a CD Burning drive although I am not sure I can access the burning software at the moment.
I will follow the steps you listed above, and let you know if I have difficulty. If I am successful with these steps, you should hear from me on this Forum tonight - If I am not successful, I will contact you again in the morning after I get to work.
Thanks!
~Karen
Classy_Lady
Rat Hat
I tried what you asked of me and I was able to run the Combofix and get a .txt log file (had to run it twice for some reason) and a couple times during the process the window came up notifying me that I was operating in Safe Mode and did I want to continue or go to Restore. Of course I clicked continue in safe mode and after second reboot and rerun, I got a logfile which I have uploaded and copied herecombofix.txt Please let me know if I need to copy and paste it for you.
The bad news is that after running the combofix and rebooting the machine, I am still unable to access my icons on the desktop continuing to get the error message that I do not have permissions. I was also not able to use the CD Burner in safe mode - told me I have to ask the administrator (maybe the account I am in should be different?) I work in the Owner account since that is the only one I have after reboot - and after looking at the properties both Owner and Administrator accounts have full admin rights. The difference appears to be the desktop setup, the placement of icons (all the new stuff is on the desk of the OWNER and not the Admin)
I don't know what else to try but hoping that the combofix.txt file will prove helpful. I saw something saying Rootkit and named Catchme? I am thinking that is something buried that is being elusive and causing this issue?
I am only at work till 11:30 today and if need be I can try to access this forum from the Library over the weekend but I am unsure if that is a possibility. Please give me as much as you can before I leave for the day so I can take it with and try it this afternoon.
Thank you!!
Best Regards
Karen (Classy Lady)
RatHat
Karen,
Could you run the WinPFind program I asked you to?
It looks like this make take a bit more time than we thought, so be prepared. One thing though, I will not give up on you, so don't worry, we'll get there in the end.
Now first is the quickfix, that I doubt will solve everything, but just might get you back online for a while.
Download to your Desktop FixPolicies.exe, a self-extracting ZIP archive from here:
We are about to use an extremely powerful program, so PRINT OUT these instructions and follow them exactly. If you are not sure of something, ask first.
Please download and unzip Icesword to its own folder.
Get a notepad and pen, because you are going to have to write down some file paths and names. If you are not sure what a file path is, here is an example: C:\Windows\Explorer.exe This shows the C:\ Drive, then the folder; Windows, then the name of the file; Explorer.exe
Step 1: Close all windows and run IceSword. Click the "Processes" tab and watch for processes displayed in red color. A red colored process in this list indicates that it's hidden. Write down the PathName of any processes in red color. Then click on LOG at the top left. It will prompt you to save the log, call this Processes and save it to your desktop.
Step 2: Click the "Win32 Services" tab and look out for red colored entry in the services list. Write down the Module name of any services in red color, you will need to expand out the Module tab to see the full name. Then click on LOG. It will prompt you to save the log, call this Services and save it to your desktop.
Step 3: Now, click "SSDT" tab and check for red colored entries. If there are any, write down the KModule name. (This function does not allow you to save a log).
Now post all of the data collected under the headings:
Regards,
RatHat
Could you run the WinPFind program I asked you to?
It looks like this make take a bit more time than we thought, so be prepared. One thing though, I will not give up on you, so don't worry, we'll get there in the end.
Now first is the quickfix, that I doubt will solve everything, but just might get you back online for a while.
Download to your Desktop FixPolicies.exe, a self-extracting ZIP archive from here:
- Double-click FixPolicies.exe
- Click the "Install" button on the bottom toolbar of the box that will open.
- The program will create a new Folder called FixPolicies.
- Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
- A Command window will briefly appear and then close.
- This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.
We are about to use an extremely powerful program, so PRINT OUT these instructions and follow them exactly. If you are not sure of something, ask first.
Please download and unzip Icesword to its own folder.
Get a notepad and pen, because you are going to have to write down some file paths and names. If you are not sure what a file path is, here is an example: C:\Windows\Explorer.exe This shows the C:\ Drive, then the folder; Windows, then the name of the file; Explorer.exe
Step 1: Close all windows and run IceSword. Click the "Processes" tab and watch for processes displayed in red color. A red colored process in this list indicates that it's hidden. Write down the PathName of any processes in red color. Then click on LOG at the top left. It will prompt you to save the log, call this Processes and save it to your desktop.
Step 2: Click the "Win32 Services" tab and look out for red colored entry in the services list. Write down the Module name of any services in red color, you will need to expand out the Module tab to see the full name. Then click on LOG. It will prompt you to save the log, call this Services and save it to your desktop.
Step 3: Now, click "SSDT" tab and check for red colored entries. If there are any, write down the KModule name. (This function does not allow you to save a log).
Now post all of the data collected under the headings:
- Processes
- Win32 Services
- SSDT
Regards,
RatHat
Classy_Lady
RatHat
I was unable to run the WP prgram cuz I couldn't download since I don't have internet on Safe Mode - is there a way for me to have Internet and be in SAFE MODE? how do i get these downloads to my pc? Yesterday I downloaded the HTML file to CD and took it home and then opened it and copy pasted the notpad item but couldn't get to the link since I wasn't online…..any steps or ideas for me? Is there a way to download the WP program here and transfer to disk or CD? will it work the same?
I just tried to access the file you say is a self extracting one - so that I can put it on disk - but my company has blocked it! Can you give it to me a different way!?
I will print everything here and be very careful.
Karen (Classy Lady)
RatHat
OK Karen,
Download the attached zip file FixPolicies.zip
Unzip it, and copy the folder and files it creates to a CD.
Download Icesword and copy that to CD also. Do the same with WinPFind.
Take the disk home and copy the files/folders to the desktop of the infected computer, then run the Fixpolicies.cmd first as outlined before.
Next run Icesword, then after that run WinPFind.
You can boot into Safe Mode with Networking, and see if you can acess the internet to post back the logs. If not, is there any way you can get hold of a flash drive, to copy the logs to?
If you can, make sure you scan the flash drive with the clean computer's AV before copying the logs across to post.
Regards,
RatHat
Classy_Lady
Rat Hat 
We are making progress!! I am in safe mode and on the internet WOOO HOOO
Here is a Hijack This log run just after the FixPolicies.exe
Logfile of HijackThis v1.99.1
Scan saved at 8:34:27 PM, on 1/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Desktop\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.ce1.attbb.net:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ce1.attbb.net;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {01020304-0506-0708-090A-0B0C0D0E0F08} - http://messenger.yahoo.com/maintenance/patch.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} - http://mirror.worldwinner.com/games/v45/bl…x/blockwerx.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,19/mcgdmgr.cab
O16 - DPF: {D81CA86B-EF63-42AF-BEE3-4502D9A03C2D} - http://wwws.musicmatch.com/graphics/WebPlayer/MMLRadio.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - http://chat.yahoo.com/cab/yvwrctl.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
We are making progress!! I am in safe mode and on the internet WOOO HOOOHere is a Hijack This log run just after the FixPolicies.exe
Logfile of HijackThis v1.99.1
Scan saved at 8:34:27 PM, on 1/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Desktop\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.ce1.attbb.net:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ce1.attbb.net;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {01020304-0506-0708-090A-0B0C0D0E0F08} - http://messenger.yahoo.com/maintenance/patch.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} - http://mirror.worldwinner.com/games/v45/bl…x/blockwerx.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,19/mcgdmgr.cab
O16 - DPF: {D81CA86B-EF63-42AF-BEE3-4502D9A03C2D} - http://wwws.musicmatch.com/graphics/WebPlayer/MMLRadio.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - http://chat.yahoo.com/cab/yvwrctl.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Classy_Lady
RatHat
You told me Icesword is a powerful program and I am a bit scared. You said to ask BEFORE I do anything so….I am asking - Now that I am working online in Safemode - do I download the Icesword and work the steps in SafeMode or try the normal network and run it there? You also said to do the WinPFind AFTER the Icesword - so I am gonna sit tight and not do anything until I get a reply here.
Thanks! we are making progresss YIPPEEE!! 
Additional note: I tried rebooting to regular mode and everything is the same - cannot access any programs - don't have permission. i tried to open and run IceSword in regular mode and was unable - same error message. I rebooted in SAFE MODE w/Networking - tried to run ICESWORD and got the following message
Open Device Failed Error Code: 1073741762 then i click ok and get a second message saying: Initialize Failed
Now What??
Karen
Additional note: I tried rebooting to regular mode and everything is the same - cannot access any programs - don't have permission. i tried to open and run IceSword in regular mode and was unable - same error message. I rebooted in SAFE MODE w/Networking - tried to run ICESWORD and got the following message
Open Device Failed Error Code: 1073741762 then i click ok and get a second message saying: Initialize Failed
Now What??
Karen
RatHat
Karen,
Now that you are online, download WinPFind and run that, if you can, from Normal mode. Save the log to your desktop and post it back to me here.
Also rename HijackThis.exe to Karen.exe then try to run that in Normal Mode, save the log and post it to me here.
We can leave Icesword for now.
Regards,
RatHat
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI