Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Windows Explorer Error (Referred)

  • Please log in to reply



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
There is nothing out of the ordinary in that log either.

Download L2mfix from one of these two locations - however you're downloading them to load them on the infected system!:


Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  • 0





  • Topic Starter
  • Member
  • PipPip
  • 46 posts
I may be able to access the Internet via a local network tommorrow (11/05/05), if I can what programs do you want me to download/update/run etc.
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
I'll just give you the download links now and will give you the instructions whenever you let me know what you were able to download.

ewido security suite

Killbox by Option^Explicit

l2mfix from my previous post.

And this online virus scan if possible - save the results log.

Update About:Buster, and see about Updating CWShredder and running it again.
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Oh, and this one:

CoolWWWSearch Smartkiller. Unzip it and Update it.
  • 0




  • Topic Starter
  • Member
  • PipPip
  • 46 posts
Here is the log for L2MFIX

L2MFIX find log 1.03
These are the registry keys present
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{3FCEF010-09A4-11D4-8D3B-D12F9D3D8B02}"="TIShelEx Shell Extension"
"{48F45200-91E6-11CE-8A4F-0080C81A28D4}"="TMD Shell Extension"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ACDFDEFC-5FD7-487D-91DC-365235188666}]

Files Found are not all bad files:

ackc.dll Thu 7 Apr 2005 13:29:20 A.... 39,936 39.00 K
afbj.dll Wed 6 Apr 2005 16:35:36 A.... 39,936 39.00 K
bacj.dll Thu 7 Apr 2005 14:12:58 A.... 39,936 39.00 K
bdoj.dll Sun 3 Apr 2005 11:37:14 A.... 39,936 39.00 K
eojf.dll Sun 3 Apr 2005 11:48:28 A.... 39,936 39.00 K
fend.dll Wed 6 Apr 2005 17:06:04 A.... 39,936 39.00 K
gcll.dll Thu 7 Apr 2005 13:18:50 A.... 39,936 39.00 K
gnhp.dll Sat 2 Apr 2005 16:19:04 A.... 39,936 39.00 K
hgdh.dll Thu 7 Apr 2005 13:21:58 A.... 39,936 39.00 K
hmoj.dll Sun 3 Apr 2005 11:37:14 A.... 39,936 39.00 K
iifb.dll Mon 4 Apr 2005 14:45:06 A.... 39,936 39.00 K
ilpn.dll Thu 7 Apr 2005 14:22:44 A.... 39,936 39.00 K
jame.dll Sun 3 Apr 2005 10:51:44 A.... 39,936 39.00 K
jcnm.dll Wed 6 Apr 2005 9:30:38 A.... 39,936 39.00 K
jdjc.dll Fri 8 Apr 2005 9:51:02 A.... 39,936 39.00 K
jigl.dll Sun 3 Apr 2005 10:48:50 A.... 39,936 39.00 K
jlpb.dll Thu 7 Apr 2005 7:08:48 A.... 39,936 39.00 K
jmkc.dll Fri 8 Apr 2005 9:51:02 A.... 39,936 39.00 K
kban.dll Mon 4 Apr 2005 14:50:20 A.... 39,936 39.00 K
kmoo.dll Thu 7 Apr 2005 13:27:56 A.... 39,936 39.00 K
kpni.dll Thu 7 Apr 2005 14:20:12 A.... 39,936 39.00 K
ldba.dll Sat 9 Apr 2005 19:02:22 A.... 39,936 39.00 K
lebp.dll Wed 6 Apr 2005 16:26:10 A.... 39,936 39.00 K
ljnf.dll Wed 6 Apr 2005 16:27:44 A.... 39,936 39.00 K
magp.dll Wed 6 Apr 2005 16:58:02 A.... 39,936 39.00 K
mjab.dll Thu 7 Apr 2005 19:28:56 A.... 39,936 39.00 K
mnhc.dll Thu 7 Apr 2005 7:08:48 A.... 39,936 39.00 K
nbjk.dll Tue 5 Apr 2005 13:17:42 A.... 39,936 39.00 K
ngnp.dll Fri 8 Apr 2005 11:40:08 A.... 39,936 39.00 K
nmbh.dll Thu 7 Apr 2005 13:21:58 A.... 39,936 39.00 K
odkc.dll Thu 7 Apr 2005 13:29:20 A.... 39,936 39.00 K
ofoi.dll Thu 7 Apr 2005 14:20:14 A.... 39,936 39.00 K
ojjf.dll Sun 3 Apr 2005 11:48:28 A.... 39,936 39.00 K

33 items found: 33 files, 0 directories.
Total of file sizes: 1,317,888 bytes 1.25 M
Locate .tmp files:

No matches found.
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 145C-600B

Directory of C:\WINDOWS\System32

10/05/2005 08:00 PM <DIR> dllcache
05/10/2003 07:36 PM <DIR> Microsoft
0 File(s) 0 bytes
2 Dir(s) 9,834,225,664 bytes free
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
L2mfix is showing me 30+ files that need to be removed!!

So, Ewido may help us out!

Follow these instructions for Ewido - it has to be downloaded and updated before it can be run:

Download Ewido Security Suite
  • Install ewido security suite
  • Launch ewido, there should be a big E icon on your desktop, double-click it.
  • The program will prompt you to update click the OK button
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start
The update will start and a progress bar will show the updates being installed.

Once the updates are installed do the following:
  • Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run Ewido.
  • Click on scanner
  • Make sure the following boxes are checked before scanning:
    • Binder
    • Crypter
    • Archives
  • Click on Start Scan
  • Let the program scan the machine
While the scan is in progress you will be prompted to clean files, click OK

Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop
Reboot into normal mode.

Post the log from Ewido and as well as a new HiJackThis log. Try your best to run ActiveScan also! Be sure to save the results from ActiveScan as I will need to see it.

Edited by bananafanafo, 10 May 2005 - 12:49 PM.

  • 0




  • Topic Starter
  • Member
  • PipPip
  • 46 posts
I am typing this to you on the infected machine so we have headway! Still no access to Desktop Icons or Move/copy/paste files in Windows Explorer though.

Ewido Log (Updated as asked and it found & removed 41 issues, man it took a long time)

ewido security suite - Scan report

+ Created on: 11:27:37 AM, 11/05/2005
+ Report-Checksum: EF030AB9

+ Date of database: 10/05/2005
+ Version of scan engine: v3.0

+ Duration: 120 min
+ Scanned Files: 82211
+ Speed: 11.41 Files/Second
+ Infected files: 41
+ Removed files: 41
+ Files put in quarantine: 41
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:

+ Scan result:
C:\RECYCLER\S-1-5-21-73586283-113007714-1957994488-1003\De293.frE956 -> Trojan.TopAntiSpyware.h -> Cleaned with backup
C:\RECYCLER\S-1-5-21-73586283-113007714-1957994488-1003\De295.txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\system32\ackc.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\afbj.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\bacj.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\bdoj.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\eojf.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\fend.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\gcll.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\gnhp.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\hgdh.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\hmoj.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\iifb.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\ilpn.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\jame.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\jcnm.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\jdjc.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\jigl.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\jlpb.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\jmkc.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\kban.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\kmoo.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\kpni.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\ldba.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\lebp.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\ljnf.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\magp.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\mjab.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\mnhc.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\nbjk.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\ngnp.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\nmbh.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\odkc.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\ofoi.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\ojjf.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\system32\spoolsrv32.exe -> Trojan.TopAntiSpyware.j -> Cleaned with backup
E:\File Store\Programs\cracking\patchfx110\business assist.EXE -> Not-A-Virus.VirTool.OptixPatch.04 -> Cleaned with backup
E:\File Store\Programs\cracking\patchfx110\patchfx.res -> Not-A-Virus.VirTool.OptixPatch.04 -> Cleaned with backup
E:\File Store\Programs\ICQ\ICQ_UIN-To IP_Converter_for_2001b.exe -> Not-A-Virus.VirTool.ICQ_UinIp -> Cleaned with backup
E:\Latcham\Cookies\latcham@mywebsearch[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
E:\Latcham\Local Settings\Temp\temp.frE956 -> Trojan.TopAntiSpyware.h -> Cleaned with backup

::Report End

Hijack This Log

Logfile of HijackThis v1.99.1
Scan saved at 11:31:41 AM, on 11/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\program files\Telstra\Signup\tbpt.exe
C:\Program Files\Mouse\Amoumain.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Telstra Big Pond
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [{F7D90BD2-14A9-11d3-AD9E-00AA0064EC94}] C:\program files\Telstra\Signup\tbpt.exe
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = vic.bigpond.net.au
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Activescan is still running but has found one problem, I will post it when it is finished. I will download & update other programs as discussed when activescan is finished.
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Well, Ewido got rid of all the files we were going to have to delete, plus some!

Is this your own folder?

E:\File Store\Programs\cracking

Still no access to Desktop Icons or Move/copy/paste files in Windows Explorer though.

You get a dr watson postmortem debugger error anytime you do any of the things above?
  • 0




  • Topic Starter
  • Member
  • PipPip
  • 46 posts
Dr Watson error almost everytime I click on the desktop icon or try and move/delete/copy/paste in Windows Explorer. PC Freezes until process is killed in Task Manager. E Drive is the Teenage Son's Store area for all his rubbish, what is on there?

PC sh@t itself 2/3rd's of the way through activescan (Windows Explorer error as usual) am going to try it again now, it had found 3 items when it died.
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts

E Drive is the Teenage Son's Store area for all his rubbish, what is on there?

I don't want to get the son in trouble lol :tazz: They appear to be cracks for some software.
  • 0




    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
If ActiveScan dies again, go ahead and update and run CoolWWWSearch Smartkiller.

Then follow all of the instructions in post #3.
  • 0




  • Topic Starter
  • Member
  • PipPip
  • 46 posts
Activescan sh#t itself again, got all the way to the end ID'ed 3 issues, asked if I wanted to view the report and then came up with the following message " Internet Explorer has encountered a problem with an add-on and has to close, click more info and it says Flash.ocx Flash Player 7.0.19 caused the problem. I am trying one more time....

When I unzip & run the program downloaded from the CoolWWWSearch Smartkiller. link
I get the following message and no opportunity to update it...

CoolWWWSearch.Smartkiller (v1/v2) has not been found on your system.
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
That means it found no infection.

Please follow the instructions n post #3 and we'll see if that helps any...
  • 0




  • Topic Starter
  • Member
  • PipPip
  • 46 posts
Activescan Log

Incident Status Location

Adware:Adware/MyWay No disinfected Windows Registry
Adware:Adware/StartPage.DE No disinfected C:\WINDOWS\Web\desktop.html
Adware:Adware/IGuard No disinfected C:\WINDOWS\wldr.dll

I'm starting on Post 3# directions and will post those shortly.
  • 0



    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
While in Safe Mode, Set your system to SHOW HIDDEN FILES

Delete the items in bold using Windows Explorer (don't use "search"):

  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP