[uber-doober]

heres the fresh HJT log...


Logfile of HijackThis v1.99.1
Scan saved at 3:39:08 PM, on 7/31/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\America Online 7.0\waol.exe
C:\Documents and Settings\Tye\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} (MS3DViewerOCX Control) - http://www.swissquak...3DViewerOCX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla...ller/dwnldr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{421F75F4-7B7E-4522-9C44-CB8E070EEEAF}: NameServer = 69.50.184.85,195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC4D9FEB-6393-4136-BC80-5EE93ADA41C3}: NameServer = 205.188.146.145
O17 - HKLM\System\CS1\Services\Tcpip\..\{421F75F4-7B7E-4522-9C44-CB8E070EEEAF}: NameServer = 69.50.184.85,195.225.176.37
O17 - HKLM\System\CS2\Services\Tcpip\..\{421F75F4-7B7E-4522-9C44-CB8E070EEEAF}: NameServer = 69.50.184.85,195.225.176.37
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



Heres the smitrem log...



smitRem log file
version 2.2

by noahdfear

The current date is: Sun 07/31/2005
The current time is: 15:18:25.10

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

wp.bmp


~~~ Windows directory ~~~



~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

CLEAN!

[Advertisements]

Hey Tye,

Million Dollar Question - How is your PC behaving now ?? Any issues it ???

[tampabelle]

Hey Tye,

Million Dollar Question - How is your PC behaving now ?? Any issues it ???

[uber-doober]

hey, i think that you got rid of the virus but i still dont have any icons, if thats because i couldnt get onto the control panel its because i dont have a start menu and there for do not know were to find the control panel, if this is the reason i have no icons please tell me where to find it.

[tampabelle]

Hi Tye,


Copy the following in a new text file in Notepad and save it as fix.reg (make sure the Save as Type is set to All Files) -

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamsMRU]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoToolbarsOnTaskbar"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSetTaskbar"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ClassicShell"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}]
@="Media Band"
"BarSize"=-


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoBandCustomize"=dword:00000000
"NoMovingBands"=dword:00000000
"NoCloseDragDropBands"=dword:00000000
"NoSaveSettings"=dword:00000000
"NoSetTaskbar"=dword:00000000
"NoToolbarsOnTaskbar"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoMovingBands"=dword:00000000
"NoCloseDragDropBands"=dword:00000000
"**del.NoMovingBands"=" "

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"**del.NoSaveSettings"=" "

Double click on fix.reg and let it merge with your registry.

Let me know how it goes and how your PC is now !!!!

[uber-doober]

I havnt noticed any improvement after i merged it with the directory, I really hope there is a way to get my startbar and icons back

[Excal]

Hi Tye,

Tampabelle has to leave town and asked me to pick up this log for him.

are you able to do this?

Copy everything in the code box below and paste it into notepad. Go up to "File > Save As..." and click the drop-down box to change the "Save As Type" to "All Files". Save it as wininet.bat on your desktop.

dir %Systemdrive%\wininet.dll /a h /s > files.txt
start notepad files.txt

Double click wininet.bat and when it is ready it will open files.txt
Copy the content of files.txt and paste it here.


Please let me know

Thanks,


Excal

[uber-doober]

heres that .txt file...



Volume in drive C has no label.
Volume Serial Number is 5415-6BE4

Directory of C:\I386

08/29/2002 07:00 AM 599,040 WININET.DLL
1 File(s) 599,040 bytes

Directory of C:\Program Files\Common Files\Adaptec Shared\System

04/24/1999 12:22 AM 459,024 Wininet.dll
1 File(s) 459,024 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

08/29/2002 06:41 AM 599,040 wininet.dll
1 File(s) 599,040 bytes

Directory of C:\WINDOWS\SYSTEM32

01/21/2004 05:16 PM 588,288 WININET.DLL
1 File(s) 588,288 bytes

Directory of C:\WINDOWS\SYSTEM32\DLLCACHE

01/21/2004 05:16 PM 588,288 WININET.DLL
1 File(s) 588,288 bytes

[Excal]

Hi Tye,

Now comes the tricky part. Make sure you follow these instructions to a T. Do not deviate from them at all, if you do, bad things may happen. If you have any questions, feel free to ask them before you start the fix

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

Please go to start>my computer then navigate to this file:

C:\Windows\System32\wininet.dll

right click on it and rename it to wininet.old

go to your C:\windows\system32\dllcache-folder, rightclick on the wininet.dll present there, choose copy and paste it in your system32-folder.
(If there is no wininet.dll present in your dllcache, look if there is one in next folder: C:\WINDOWS\ServicePackFiles\i386 so copy that one to the system32-folder.
please delete the following

*Note - It could be possible you will get an error saying the file already exists when you try to paste the good one in your system32-folder.
If it gives an error, just reboot

Reboot

Please remove just the files from the following paths using Windows Explorer (if present):

C:\Windows\System32\wininet.old
C:\Windows\System32\oleadm.dll

please post and let me know the results.


Thanks,



Excal

[uber-doober]

ok heres the deal...

I cant find the tools>folder options>view tab but i think that the hide potected operating systems folder is unchecked given that i did find the WININET.DLL file when i browsed to find it. So i did find the WININET.DLL file and i did as you said and renamed it WININET.old, i tried to find the file dllcache-folder but i just couldnt find it so i took the wininet.dll from the ServicePackFiles, i copied it and pasted it into system 32, I tried to delete wininet.old but it wouldnt let me and I couldnt find the file oleadm.dll and so now I ask you


WHAT SHOULD I DO???

And by the way thanks for the help

[Excal]

Hi Tye,


So everything is running fine? You just can't find the wininet.old and the oleadm.dll?


If thats the case lets just try this.

Please download the Killbox.

Please run Killbox.

• Select "Delete on Reboot".
• Copy the file names below to the clipboard by highlighting them and pressing Control-C:
  
  
  C:\Windows\System32\wininet.old
  C:\Windows\System32\oleadm.dll
  
  
• Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
• Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
  
  If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..
  
• Let the system reboot.

Post back and let me how things go and how things are running.


Thanks,



Excal

[uber-doober]

Well I managed to delete the 2 files using the kill box as you told me to, I still dont have any desktop icons or a start menu




Im still hoping for the best...

[Excal]

Please do this again.

Copy everything in the box below and paste it into notepad. Go up to "File > Save As..." and click the drop-down box to change the "Save As Type" to "All Files". Save it as wininet.bat on your desktop.

dir %Systemdrive%\wininet.dll /a h /s > files.txt
start notepad files.txt

Double click wininet.bat and when it is ready it will open files.txt
Copy the content of files.txt and paste it here.

[uber-doober]

Hey excal, well ive done this befor with tampabelle so i dont know why this isnt happening right now, when i try to open notepad nothing happens, it just doesnt open not warning window, no pop up nothing...

I hope this isnt bad

[Excal]

So to start>Search and put in notepad.exe

Let me know how many you find and the locations of them


Thanks,



Excal

[uber-doober]

I got the note pad working, heres what it said...


Volume in drive C has no label.
Volume Serial Number is 5415-6BE4

Directory of C:\I386

08/29/2002 07:00 AM 599,040 WININET.DLL
1 File(s) 599,040 bytes

Directory of C:\Program Files\Common Files\Adaptec Shared\System

04/24/1999 12:22 AM 459,024 Wininet.dll
1 File(s) 459,024 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

08/29/2002 06:41 AM 599,040 wininet.dll
1 File(s) 599,040 bytes

Directory of C:\WINDOWS\SYSTEM32

01/21/2004 05:16 PM 588,288 wininet.dll
1 File(s) 588,288 bytes

Directory of C:\WINDOWS\SYSTEM32\DLLCACHE

01/21/2004 05:16 PM 588,288 wininet.dll
1 File(s) 588,288 bytes