PLEASE HELP. IE not working! [CLOSED]

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

Geeks to Go! » Security » Malware Removal - HijackThis™ Logs Go Here

PLEASE HELP. IE not working! [CLOSED], oh boy oh boy

Options

Keenan414 View Member Profile	Aug 30 2005, 02:48 AM Post #1
Member Posts: 12 OS: Windows XP	Okay... you guys helped me fix Aurora and my pc was fine, then I let a friend use it and now it's absolutely useless.. I'm booted in safe mode right now to post this but when booted regular IE won't even open for me, even pop-ups close themselves sometimes, but usually they just keep coming until it freezes, even when I'm not in IE.. and when i reboot sometimes it goes to a blue screen about a problem and when i try and reboot it says explorer is not responding and all kinds of crap, basically my PC sucks right now and i REALLY need it being that class starts today, and I have an online class... any help would be greatly appreciated as this problem is WAY out of my league, even HJT froze up once... but here goes my post... Logfile of HijackThis v1.99.1 Scan saved at 4:46:54 AM, on 8/30/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\Explorer.exe c:\windows\system32\ubzjczv.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchtheworld4you.com/sp2.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchtheworld4you.com/sp2.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file) F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O1 - Hosts: 213.222.11.6 auto.search.msn.com O1 - Hosts: 213.222.11.6 ieautosearch O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll O2 - BHO: Highlighter Class - {8924A422-F9E1-470A-AA90-528F15BDA39A} - C:\Program Files\Snap UltraSearch\DesktopToolbarHelper.3.1125390866.dll O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\System32\lanbrup.exe O4 - HKLM\..\Run: [v39V3FT] mswannel.exe O4 - HKLM\..\Run: [msresearch] C:\WINDOWS\msresearch.exe O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe O4 - HKLM\..\Run: [emmivc] C:\WINDOWS\System32\emmivc.exe O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\lgdlps.exe reg_run O4 - HKLM\..\Run: [urcv] C:\WINDOWS\urcv.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update00.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [dnam] C:\WINDOWS\system32\d140113.a.Stub.EXE O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [newexp] C:\WINDOWS\System32\newexp O4 - HKLM\..\Run: [ixswyfb] c:\windows\system32\ubzjczv.exe r O4 - HKCU\..\Run: [e0q9RPfEg] mp4106n.exe O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe" O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000079.exe O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000079.exe O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe O4 - HKCU\..\Run: [Firke] C:\WINDOWS\System32\l?[bleep].exe O4 - HKCU\..\Run: [dpvdrc] C:\WINDOWS\System32\dpvdrc.exe O4 - HKCU\..\RunOnce: [dpvdrc] C:\WINDOWS\System32\dpvdrc.exe O4 - Global Startup: nkcn.exe O4 - Global Startup: Snap UltraSearch.lnk = C:\Program Files\Snap UltraSearch\Toolbar.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0002.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - (no file) O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\MDWSTR10.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGF0IEtlZW5hbgAA\command.exe O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe please help in anyway possible before I throw this thing out the window

Armodeluxe View Member Profile	Sep 2 2005, 08:19 PM Post #2
Member 2k Posts: 2,744 OS: Windows XP SP2	Hi Keenan414, Firstly I should inform you that we recently lost usetobe... You have a complete mess over there..we have to deal with look2me before anything..cause that's the culprit bringing all the other stuff.. You have the latest version of VX2. Download L2mfix from one of these two locations: http://www.atribune.org/downloads/l2mfix.exe http://www.downloads.subratam.org/l2mfix.exe Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread. IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

Armodeluxe View Member Profile	Sep 4 2005, 11:57 AM Post #4
Member 2k Posts: 2,744 OS: Windows XP SP2	Close any programs you have open since this step requires a reboot. From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log, and we'll clean up what's left. IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

Keenan414 View Member Profile	Sep 5 2005, 11:49 AM Post #5
Member Posts: 12 OS: Windows XP	Setting Directory C:\ C:\ System Rebooted! Running From: C:\ killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1192 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1240 'rundll32.exe' Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! Backing Up: C:\WINDOWS\system32\arstream.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\arstream.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\CSMPSTUI.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\CSMPSTUI.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\DSCPSAPI.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\DSCPSAPI.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\LJASICO.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\LJASICO.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\lrXpm12n.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\lrXpm12n.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\lvtwn12n.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\lvtwn12n.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MDWSTR10.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MDWSTR10.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MFDRV.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MFDRV.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MSDIMAP.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MSDIMAP.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MVCAT32.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MVCAT32.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\pxisdecd.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\pxisdecd.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\TFEMBED.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\TFEMBED.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp 1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp 1 file(s) copied. deleting: C:\WINDOWS\system32\arstream.dll Successfully Deleted: C:\WINDOWS\system32\arstream.dll deleting: C:\WINDOWS\system32\arstream.dll Successfully Deleted: C:\WINDOWS\system32\arstream.dll deleting: C:\WINDOWS\system32\CSMPSTUI.DLL Successfully Deleted: C:\WINDOWS\system32\CSMPSTUI.DLL deleting: C:\WINDOWS\system32\CSMPSTUI.DLL Successfully Deleted: C:\WINDOWS\system32\CSMPSTUI.DLL deleting: C:\WINDOWS\system32\DSCPSAPI.DLL Successfully Deleted: C:\WINDOWS\system32\DSCPSAPI.DLL deleting: C:\WINDOWS\system32\DSCPSAPI.DLL Successfully Deleted: C:\WINDOWS\system32\DSCPSAPI.DLL deleting: C:\WINDOWS\system32\LJASICO.DLL Successfully Deleted: C:\WINDOWS\system32\LJASICO.DLL deleting: C:\WINDOWS\system32\LJASICO.DLL Successfully Deleted: C:\WINDOWS\system32\LJASICO.DLL deleting: C:\WINDOWS\system32\lrXpm12n.dll Successfully Deleted: C:\WINDOWS\system32\lrXpm12n.dll deleting: C:\WINDOWS\system32\lrXpm12n.dll Successfully Deleted: C:\WINDOWS\system32\lrXpm12n.dll deleting: C:\WINDOWS\system32\lvtwn12n.dll Successfully Deleted: C:\WINDOWS\system32\lvtwn12n.dll deleting: C:\WINDOWS\system32\lvtwn12n.dll Successfully Deleted: C:\WINDOWS\system32\lvtwn12n.dll deleting: C:\WINDOWS\system32\MDWSTR10.DLL Successfully Deleted: C:\WINDOWS\system32\MDWSTR10.DLL deleting: C:\WINDOWS\system32\MDWSTR10.DLL Successfully Deleted: C:\WINDOWS\system32\MDWSTR10.DLL deleting: C:\WINDOWS\system32\MFDRV.DLL Successfully Deleted: C:\WINDOWS\system32\MFDRV.DLL deleting: C:\WINDOWS\system32\MFDRV.DLL Successfully Deleted: C:\WINDOWS\system32\MFDRV.DLL deleting: C:\WINDOWS\system32\MSDIMAP.DLL Successfully Deleted: C:\WINDOWS\system32\MSDIMAP.DLL deleting: C:\WINDOWS\system32\MSDIMAP.DLL Successfully Deleted: C:\WINDOWS\system32\MSDIMAP.DLL deleting: C:\WINDOWS\system32\MVCAT32.DLL Successfully Deleted: C:\WINDOWS\system32\MVCAT32.DLL deleting: C:\WINDOWS\system32\MVCAT32.DLL Successfully Deleted: C:\WINDOWS\system32\MVCAT32.DLL deleting: C:\WINDOWS\system32\pxisdecd.dll Successfully Deleted: C:\WINDOWS\system32\pxisdecd.dll deleting: C:\WINDOWS\system32\pxisdecd.dll Successfully Deleted: C:\WINDOWS\system32\pxisdecd.dll deleting: C:\WINDOWS\system32\TFEMBED.DLL Successfully Deleted: C:\WINDOWS\system32\TFEMBED.DLL deleting: C:\WINDOWS\system32\TFEMBED.DLL Successfully Deleted: C:\WINDOWS\system32\TFEMBED.DLL deleting: C:\WINDOWS\system32\guard.tmp Successfully Deleted: C:\WINDOWS\system32\guard.tmp deleting: C:\WINDOWS\system32\guard.tmp Successfully Deleted: C:\WINDOWS\system32\guard.tmp Zipping up files for submission: adding: arstream.dll (188 bytes security) (deflated 50%) adding: CSMPSTUI.DLL (188 bytes security) (deflated 48%) adding: DSCPSAPI.DLL (188 bytes security) (deflated 48%) adding: LJASICO.DLL (188 bytes security) (deflated 48%) adding: lrXpm12n.dll (188 bytes security) (deflated 48%) adding: lvtwn12n.dll (188 bytes security) (deflated 48%) adding: MDWSTR10.DLL (188 bytes security) (deflated 48%) adding: MFDRV.DLL (188 bytes security) (deflated 48%) adding: MSDIMAP.DLL (188 bytes security) (deflated 48%) adding: MVCAT32.DLL (188 bytes security) (deflated 48%) adding: pxisdecd.dll (188 bytes security) (deflated 48%) adding: TFEMBED.DLL (188 bytes security) (deflated 50%) adding: guard.tmp (188 bytes security) (deflated 48%) adding: clear.reg (188 bytes security) (deflated 37%) adding: SystemInfo.ini (188 bytes security) (deflated 3%) adding: debugInstaller.txt (188 bytes security) (deflated 8%) adding: lo2.txt (188 bytes security) (deflated 88%) adding: test.txt (188 bytes security) (deflated 86%) adding: test2.txt (188 bytes security) (deflated 17%) adding: test3.txt (188 bytes security) (deflated 17%) adding: test5.txt (188 bytes security) (deflated 17%) adding: tmp.txt (188 bytes security) (deflated 57%) adding: xfind.txt (188 bytes security) (deflated 82%) Restoring Registry Permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Revoking access for predefined group "Administrators" Inherited ACE can not be revoked here! Inherited ACE can not be revoked here! Registry permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators ... successful Restoring Windows Update Certificates.: deleting local copy: arstream.dll deleting local copy: arstream.dll deleting local copy: CSMPSTUI.DLL deleting local copy: CSMPSTUI.DLL deleting local copy: DSCPSAPI.DLL deleting local copy: DSCPSAPI.DLL deleting local copy: LJASICO.DLL deleting local copy: LJASICO.DLL deleting local copy: lrXpm12n.dll deleting local copy: lrXpm12n.dll deleting local copy: lvtwn12n.dll deleting local copy: lvtwn12n.dll deleting local copy: MDWSTR10.DLL deleting local copy: MDWSTR10.DLL deleting local copy: MFDRV.DLL deleting local copy: MFDRV.DLL deleting local copy: MSDIMAP.DLL deleting local copy: MSDIMAP.DLL deleting local copy: MVCAT32.DLL deleting local copy: MVCAT32.DLL deleting local copy: pxisdecd.dll deleting local copy: pxisdecd.dll deleting local copy: TFEMBED.DLL deleting local copy: TFEMBED.DLL deleting local copy: guard.tmp deleting local copy: guard.tmp The following Is the Current Export of the Winlogon notify key: ************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] "DllName"="C:\\WINDOWS\\System32\\NavLogon.dll" "StartShell"="NavStartShellEvent" "Logoff"="NavLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 The following are the files found: ************************************************************************ C:\WINDOWS\system32\arstream.dll C:\WINDOWS\system32\arstream.dll C:\WINDOWS\system32\CSMPSTUI.DLL C:\WINDOWS\system32\CSMPSTUI.DLL C:\WINDOWS\system32\DSCPSAPI.DLL C:\WINDOWS\system32\DSCPSAPI.DLL C:\WINDOWS\system32\LJASICO.DLL C:\WINDOWS\system32\LJASICO.DLL C:\WINDOWS\system32\lrXpm12n.dll C:\WINDOWS\system32\lrXpm12n.dll C:\WINDOWS\system32\lvtwn12n.dll C:\WINDOWS\system32\lvtwn12n.dll C:\WINDOWS\system32\MDWSTR10.DLL C:\WINDOWS\system32\MDWSTR10.DLL C:\WINDOWS\system32\MFDRV.DLL C:\WINDOWS\system32\MFDRV.DLL C:\WINDOWS\system32\MSDIMAP.DLL C:\WINDOWS\system32\MSDIMAP.DLL C:\WINDOWS\system32\MVCAT32.DLL C:\WINDOWS\system32\MVCAT32.DLL C:\WINDOWS\system32\pxisdecd.dll C:\WINDOWS\system32\pxisdecd.dll C:\WINDOWS\system32\TFEMBED.DLL C:\WINDOWS\system32\TFEMBED.DLL C:\WINDOWS\system32\guard.tmp C:\WINDOWS\system32\guard.tmp Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. ************************************************************************ REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{FD360A6F-CA31-4CB1-AA83-3AA2EEA5AE00}"=- "{432D1A46-281E-4D22-961C-76BFC43BA884}"=- [-HKEY_CLASSES_ROOT\CLSID\{FD360A6F-CA31-4CB1-AA83-3AA2EEA5AE00}] [-HKEY_CLASSES_ROOT\CLSID\{432D1A46-281E-4D22-961C-76BFC43BA884}] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ************************************************************************ Desktop.ini Contents: ************************************************************************ ************************************************************************** Logfile of HijackThis v1.99.1 Scan saved at 1:49:05 PM, on 9/5/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\UGF0IEtlZW5hbgAA\command.exe C:\WINDOWS\System32\cwbpnhw\gxnjtydh.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe C:\WINDOWS\System32\cwbpnhw\gxnjtydh.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe C:\WINDOWS\System32\svchost.exe c:\windows\system32\dvoinzc.exe C:\WINDOWS\System32\apzatd.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\Explorer.exe C:\HijackThis.exe C:\DOCUME~1\PATKEE~1\LOCALS~1\Temp\tp7543.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchtheworld4you.com/sp2.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchtheworld4you.com/sp2.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file) R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O1 - Hosts: 213.222.11.6 auto.search.msn.com O1 - Hosts: 216.39.69.102 view.atdmt.com O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll O2 - BHO: LANBridge Class - {71D1708F-973D-4600-AF01-AD86688403AE} - C:\WINDOWS\System32\ztpsolij.dll O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\System32\lanbrup.exe O4 - HKLM\..\Run: [v39V3FT] mswannel.exe O4 - HKLM\..\Run: [msresearch] C:\WINDOWS\msresearch.exe O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\apzatd.exe reg_run O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update00.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [newexp] C:\WINDOWS\System32\newexp O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Ybkbcd.exe O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Ugsiay.exe O4 - HKLM\..\Run: [ygwq] C:\WINDOWS\System32\dydq\ygwq.exe O4 - HKLM\..\Run: [ehkapf] C:\WINDOWS\System32\teym\ehkapf.exe O4 - HKLM\..\Run: [ofggh] C:\WINDOWS\System32\ynnrgaip\ofggh.exe O4 - HKLM\..\Run: [fyhayc] C:\WINDOWS\System32\vvxojh\fyhayc.exe O4 - HKLM\..\Run: [ncana] C:\WINDOWS\System32\osstjl\ncana.exe O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe O4 - HKLM\..\Run: [clxxl] C:\WINDOWS\System32\wtmo\clxxl.exe O4 - HKLM\..\Run: [mrcghu] C:\WINDOWS\System32\myipxus\mrcghu.exe O4 - HKLM\..\Run: [duldix] C:\WINDOWS\System32\wjek\duldix.exe O4 - HKLM\..\Run: [njjj] C:\WINDOWS\System32\xykt\njjj.exe O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe O4 - HKLM\..\Run: [ctlul] C:\WINDOWS\System32\nuyku\ctlul.exe O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [nulub] C:\WINDOWS\System32\bfrsequf\nulub.exe O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe O4 - HKLM\..\Run: [xmnx] C:\WINDOWS\System32\ssmorxwx\xmnx.exe O4 - HKLM\..\Run: [MedGS] C:\WINDOWS\System32\medgs1.exe O4 - HKLM\..\Run: [opr] C:\WINDOWS\System32\opr.exe O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe" O4 - HKLM\..\Run: [gxnjtydh] C:\WINDOWS\System32\cwbpnhw\gxnjtydh.exe O4 - HKLM\..\Run: [aamgxk] C:\WINDOWS\System32\jmyppx\aamgxk.exe O4 - HKLM\..\Run: [jaoq] C:\WINDOWS\System32\ylfdsl\jaoq.exe O4 - HKLM\..\Run: [ftngkgj] C:\WINDOWS\System32\vxyuu\ftngkgj.exe O4 - HKLM\..\Run: [jlbmlx] C:\WINDOWS\System32\nckfehkx\jlbmlx.exe O4 - HKLM\..\Run: [vhsekdnv] C:\WINDOWS\System32\qcob\vhsekdnv.exe O4 - HKLM\..\Run: [salm] c:\program files\180searchassistant\salm.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [uhixih] C:\WINDOWS\uhixih.exe O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\PATKEE~1\LOCALS~1\Temp\bundle_cdt1006.exe run O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKLM\..\Run: [gwjsqpe] c:\windows\system32\dvoinzc.exe r O4 - HKCU\..\Run: [e0q9RPfEg] mp4106n.exe O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe" O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000079.exe O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000079.exe O4 - HKCU\..\Run: [dpvdrc] C:\WINDOWS\System32\dpvdrc.exe O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKCU\..\Run: [wincmap] "C:\Program Files\winCMAPP\wincmapp.exe" O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe O4 - Global Startup: nkcn.exe O4 - Global Startup: Snap UltraSearch.lnk = C:\Program Files\Snap UltraSearch\Toolbar.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: Freeprod Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Freeprod Toolbar\freeprod.dll O9 - Extra 'Tools' menuitem: Freeprod Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Freeprod Toolbar\freeprod.dll O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - C:\WINDOWS\System32\datadx.dll O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - C:\WINDOWS\System32\datadx.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-its:mhtml:file://c:\nosunel.mht!http://daemonlinks.net/script/lc.chm::/bridge-c46.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - ms-its:mhtml:file://c:\nosunex.mht!http://daemonlinks.net/script/ys.chm::/ysb_regular.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0002.exe O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dll O20 - AppInit_DLLs: repairs.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGF0IEtlZW5hbgAA\command.exe O23 - Service: ctlulnuyku - Unknown owner - C:\WINDOWS\System32\nuyku\ctlul.exe O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe O23 - Service: ehkapfteym - Unknown owner - C:\WINDOWS\System32\teym\ehkapf.exe O23 - Service: gxnjtydhcwbpnhw - Unknown owner - C:\WINDOWS\System32\cwbpnhw\gxnjtydh.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe Thanks for the helP... its workin better already..

Armodeluxe View Member Profile	Sep 5 2005, 06:09 PM Post #6
Member 2k Posts: 2,744 OS: Windows XP SP2	Hi Keenan We're just starting..I'm afraid this will be many steps to clean them all..and now we have a new unwanted guest there: New.Net This program hijacks your internet access, so has to be removed first.. First, Download LSPFix.exe to a convenient location such as your desktop. Do NOT run this program. This is only to be used if you lose Internet Access after removing NewDotNet. To Get rid of NewDotNet, go to: Start > Control Panel > Add or Remove Programs and remove the following: New.Net Applications or New.Net Domains (anything that says New.Net) If it is not there, go here and follow Procedure 4. (ONLY if you can't find the New.Net in Add/Remove programs). In the event that you lose Internet access after removing New.Net, please double-click LSPFix.exe that you downloaded earlier. You will see 2 panels. If there is any file listed in the "Remove" panel on the right-side, leave it as is and just click "Finish>>" then reboot your computer and you should now have access to the Internet.. If nothing is listed under the "Remove Panel", do NOT do anything - just close the program. You will need to use another computer to come back here for further instructions on what to do. If the uninstall was successful,reboot, come back to this thread and post a new log by using the Add Reply button at the top.

Keenan414

Sep 7 2005, 07:38 PM

Post #7

Member

Posts: 12
OS: Windows XP

new.net wasnt in the add/remove so i downloaded the uninstall from that site and rebooted and its still workin... thank gosh! heres a new HJT log for you.

Logfile of HijackThis v1.99.1
Scan saved at 9:37:16 PM, on 9/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\oubbtpd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchtheworld4you.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchtheworld4you.com/sp2.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 213.222.11.6 auto.search.msn.com
O1 - Hosts: 216.39.69.102 view.atdmt.com
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [QuickTime Task] "C: