[Michelle]

Copy everything in the code box below and paste it into a new Notepad. Change the "Save As Type" to "All Files" and save it as removejobA.bat on your desktop.

%systemdrive% 
cd C:\WINDOWS\Tasks 
attrib -r -s -h AF961A6B933D8ABF.job 
del AF961A6B933D8ABF.job

Locate removejobA.bat Double-click the file.

Wait a minute, then do this one:

Copy everything in the code box below and paste it into a new Notepad. Change the "Save As Type" to "All Files" and save it as removejobB.bat on your desktop.

%systemdrive% 
cd C:\WINDOWS\Tasks 
attrib -r -s -h B2DEE1859DA18E4D.job 
del B2DEE1859DA18E4D.job

Locate removejobB.bat Double-click the file.

After it's done, please do this again:

Delete this folder (be sure your hidden files are showing otherwise you won't find it) If hidden files are showing and it's still not there, good!

C:\Documents and Settings\All Users\Application Data\Aim Wipe Ace Fast

Reboot your computer.

Edited by bananafanafo, 22 May 2005 - 09:37 AM.

[Advertisements]

After following the instructions in my previous post, please do this:

Disconnect from the Internet.
Disable Norton Auto-Protect.
Disable Ewido.
Disable AOL Anti-Spyware.

Read these carefully. We are using HiJackThis in place of Process Explorer and using Killbox a different way. I sure hope this works!

*Open HiJackThis
*Click on "Open the Misc Tools Section"
*Click on "Open Process Manager"
*In the top right-hand corner it will say "Show DLLs" - please put a checkmark in this box.
*Another panel will open on the bottom.
*In the TOP panel, I need you to click on C:\Windows\System\Winlogon.exe to highlight it.
*When it's highlighted all the DLLs will load in the BOTTOM panel.
*In this BOTTOM panel I need you to find all instances of C:\WINDOWS\repair\catip.dll
*Highlight the first one you see and click "Kill Process"
*Do this for each instance of C:\WINDOWS\repair\catip.dll until all of them under Winlogon are killed (you may have to "refresh list" to make sure they are all gone)
*Go back up to the TOP Panel and locate C:\Windows\Explorer.exe
*Do the same exact thing you did above for winlogon.exe

You may be prompted after each one "are you sure" make sure to click YES!

Next run HijackThis and place a check beside the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44} - C:\WINDOWS\repair\catip.dll

O20 - Winlogon Notify: catip - C:\WINDOWS\repair\catip.dll

Close HijackThis.

Double click on vundo.reg that's on your desktop and click YES when asked if you want to merge with the registry. Wait for the merged successfully prompt.

*Please pay close attention to the new Killbox instructions!

Double click on Killbox.exe and then click the "REPLACE on Reboot", then put a checkmark next to "Use Dummy"

Enter the following filepath and filename into the Full path of file to delete box (in the upper box, please leave the 2nd box exactly as it is!):

C:\WINDOWS\repair\catip.dll

Click the red circle with the white x and allow your computer to reboot.

After your computer has rebooted please run Hijackthis again and post a new HijackThis log.

Edited by bananafanafo, 22 May 2005 - 03:32 AM.

[Michelle]

After following the instructions in my previous post, please do this:

Disconnect from the Internet.
Disable Norton Auto-Protect.
Disable Ewido.
Disable AOL Anti-Spyware.

Read these carefully. We are using HiJackThis in place of Process Explorer and using Killbox a different way. I sure hope this works!

*Open HiJackThis
*Click on "Open the Misc Tools Section"
*Click on "Open Process Manager"
*In the top right-hand corner it will say "Show DLLs" - please put a checkmark in this box.
*Another panel will open on the bottom.
*In the TOP panel, I need you to click on C:\Windows\System\Winlogon.exe to highlight it.
*When it's highlighted all the DLLs will load in the BOTTOM panel.
*In this BOTTOM panel I need you to find all instances of C:\WINDOWS\repair\catip.dll
*Highlight the first one you see and click "Kill Process"
*Do this for each instance of C:\WINDOWS\repair\catip.dll until all of them under Winlogon are killed (you may have to "refresh list" to make sure they are all gone)
*Go back up to the TOP Panel and locate C:\Windows\Explorer.exe
*Do the same exact thing you did above for winlogon.exe

You may be prompted after each one "are you sure" make sure to click YES!

Next run HijackThis and place a check beside the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44} - C:\WINDOWS\repair\catip.dll

O20 - Winlogon Notify: catip - C:\WINDOWS\repair\catip.dll

Close HijackThis.

Double click on vundo.reg that's on your desktop and click YES when asked if you want to merge with the registry. Wait for the merged successfully prompt.

*Please pay close attention to the new Killbox instructions!

Double click on Killbox.exe and then click the "REPLACE on Reboot", then put a checkmark next to "Use Dummy"

Enter the following filepath and filename into the Full path of file to delete box (in the upper box, please leave the 2nd box exactly as it is!):

C:\WINDOWS\repair\catip.dll

Click the red circle with the white x and allow your computer to reboot.

After your computer has rebooted please run Hijackthis again and post a new HijackThis log.

Edited by bananafanafo, 22 May 2005 - 03:32 AM.

[HEH]

Hmmm, I attempted the first instructions and verified folder options looking at all files. I can't find C:\Documents and Settings\All Users\Application Data\Aim Wipe Ace Fast. All other instructions appear to work (removejobA.bat & removejobB.bat)

The second set of instructions were less successful. In Hijackthis, I highlighted C:\WINDOWS\System32\Winlogon.exe, and found the catip.dll in the bottom pane, but I can't kill it.

I get a message that says:

The selected process could not be killed. It may have already been closed or it may be protected by windows.

This process might be a service which you can stop from the services applet in Admin tools.

I looked in services.misc, but I don't see anything that looks like catip.dll

I went ahead to hijackthis and fixed the 02 BHO and 20 Winlogon Notify:

Closed Hijackthis and ran vundo.reg

Opened killbox and everything ran per instructions, Replace on boot, Use Dummy, and For the first time it appeared to run the system rebooted. Here is the log, but I still have the virus alert...

Logfile of HijackThis v1.99.1
Scan saved at 12:35:23 PM, on 5/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\OPLIMIT\ocrawr32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Harold\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\OPLIMIT\ocraware.exe
O2 - BHO: MSEvents Object - {44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44} - C:\WINDOWS\repair\catip.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O20 - Winlogon Notify: catip - C:\WINDOWS\repair\catip.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


I would guess killing that process is key, but is it possible...I guess eventually we will know. Thanks for your help. Harold

[Michelle]

That's about right

Yes, you are correct, the key to getting rid of this is to kill all of it's running processes. Which means we need to get Process Explorer to work.

Please delete the copy of Process Explorer that you have. Disable AOL anti-spyware, norton auto-protect, and Ewido. Download a fresh copy of Process Explorer, disconnect from the Internet and see if it will now allow you to see the processes under Winlogon.

[HEH]

 process_explorer.doc   46KB   47 downloads

I have deleted and downlaoded a new copy of process explorer, but nothing seems to matter. This is what I can see (attached), but I can't kill anything. I can see and kill catip.dll stuff when I view explorer properties, (threads). I'll keep trying different combinations using everything that you have provided while I wait for more ideas. I'll let you know if anything changes or I make any progress getting to the winlogon threads. Thanks Harold

[HEH]

Nothing seems to work, without going into a lot of details, I've attempted to use process explorer, hijackthis, and admin services, but I can't seem to get access to winlogon.exe threads. I've also attempted more combinations of using the removal tool, killbox and these tools as well. Same results, when I finally reboot normally, I get the virus alert. Harold

[Michelle]

I'll be back as soon as possible with something else to try. If it doesn't work... well, we'll cross that bridge if we get to it.

[Michelle]

Do you receive any kind of error message when you run Process Explorer? The reason I ask is because I'm also running XP SP2 and when I run Process Explorer, based on your screenshot, it looks a lot different.

Edited by bananafanafo, 22 May 2005 - 01:53 PM.

[HEH]

No, Process explorer seems to run fine, it just doesn't allow access to threads under Winlogon. As a matter of fact it doesn't even allow you to read anything except the address. When I use Hijackthis atleast I can see the list of DLLs. ? I'll keep trying.

[Michelle]

I attached a screenshot of what my Winlogon window looks like.

Edited by bananafanafo, 22 May 2005 - 02:20 PM.

[HEH]

Do I have the right software, maybe I have downloaded something similar or maybe there is a better version/update?  Process_Explorer.doc   32.5KB   34 downloads

[Michelle]

It's the correct version.

Do this for me, please:

Go into C:\Windows\System32 and look to see if there is a file called AUTOEXEC.NT and a file called CONFIG.NT

Let me know if either one of these are missing.

[HEH]

I have both of them, but as I have been looking at the process explorer I nolonger have any catip.dll information when I look at explorer.exe threads? I can still see registry entries, and of course I have the virus alert and I can see the c:\WINDOWS\repair\catip.dll when I look for it with Hijack this under winlogon.exe and obviously I can go to the windows\repair\directory and find it...Your guess is better than mine, but I hope that is progress. I have had to delete 4 entries every other time I've looked there?

Edited by HEH, 22 May 2005 - 02:29 PM.

[Michelle]

When you first run process explorer, before doubleclicking Winlogon, does it look like this:

[HEH]

Yes, I have something like that, but just for grins I single clicked on smss.exe and I don't get anything in the lower pane? I don't get anything in the lower pane when I look at winlogon.exe either. I can look at handles, but not DLLs, I can view DLLs in explorer and sysytem??? Maybe that is another problem or configuration issue? I don't know enough to say. I don't think that I have any problems, but I didn't know anything about the LOP virus either...