[ditto]

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):

C:\windows\system32\winwdz32.exe


Scan HJT and fix these entries while in safe mode:

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\EliteBar version 50.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\EliteBar version 50.dll

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

[Advertisements]

Hi
I found winwdz32.exe in my system and google searched to find it's meaning, which brought me to this forum thread. Amazingly, this was the only hit google was able to find. Just in case you didn't know, it was proving to be extremely frustrating and elusive for the week or so that it was on my system.
That was two weeks ago.

I rebooted in safe mode and cleared out registry entries for LQ, SYS29, winckt32 etc... no further problems at this time. I'm about to delete winwdz32 separately. since the EliteBar/sys29 trojan isn't running it won't be the problem. so far, so good. I'll let you know how it goes.

who would've thought that google would be such a powerful ally in eliminating internet security threats.

[JusteR]

Hi
I found winwdz32.exe in my system and google searched to find it's meaning, which brought me to this forum thread. Amazingly, this was the only hit google was able to find. Just in case you didn't know, it was proving to be extremely frustrating and elusive for the week or so that it was on my system.
That was two weeks ago.

I rebooted in safe mode and cleared out registry entries for LQ, SYS29, winckt32 etc... no further problems at this time. I'm about to delete winwdz32 separately. since the EliteBar/sys29 trojan isn't running it won't be the problem. so far, so good. I'll let you know how it goes.

who would've thought that google would be such a powerful ally in eliminating internet security threats.

[coachwife6]

Hi JusteR. Welcome to Geeks to Go.

That is interesting. If you want us to look at your machine, please place a HiJack This log in a new thread.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results

[JusteR]

all is okay now, thanks...
JusteR

[Betafish]

I've got these viruses too:
MediaticketsInstaller, mtrslib2[1].js, sub0t.dll and winmgt.exe....norton keeps finding all four. it says it's deleting sub0t.dll and winmgt.exe...i run norton again and they're back...i followed the steps above but i'm not finding these files.

here's a copy of my hijack log

Logfile of HijackThis v1.97.7
Scan saved at 2:46:57 AM, on 10/11/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Help\Tours\htmlTour\dll\vpt3\choco\svchostdll.exe
c:\windows\system32\server.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\lsasvc.exe
C:\WINDOWS\Help\Tours\htmlTour\dll\vpt3\choco\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\ms-ntfs.exe
C:\WINDOWS\system32\service.exe
C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\dllcache\here\winsm.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometab.bellsouth.net
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A8D3004-E747-7E9B-8356-64550DA67A13} - C:\WINDOWS\System32\zusec.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DSL Monitor] C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [IISAdmin] C:\WINDOWS\system32\logonsrv.exe
O4 - HKLM\..\Run: [Microsoft AUTH Update] MSlti32.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\RunServices: [Microsoft AUTH Update] MSlti32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft AUTH Update] MSlti32.exe
O4 - HKCU\..\Run: [Utus] C:\Documents and Settings\Nathaniel\Application Data\coe.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...8107.6588541667
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft...ols/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

[coachwife6]

Hi Betafish. Welcome to Geeks to Go.

Before we look at your log, I need you to start your own thread. It gets too confusing to merge threads.

Also, I need the newest version of Hijack This. Download the newest version in my signature and post that log. The newest version does a much better job of identifying the processes running on your machine.