[Mike in NJ]

Excal,
Here is the file from wininet.bat


Volume in drive C has no label.
Volume Serial Number is F886-EAD1

Directory of C:\I386

08/29/2002 07:00 AM 599,040 WININET.DLL
1 File(s) 599,040 bytes

Directory of C:\WINDOWS\SoftwareDistribution\Download\ea4fe5325a873581baacd3ab51700fd2\rtmgdr

04/27/2005 10:54 AM 574,976 wininet.dll
1 File(s) 574,976 bytes

Directory of C:\WINDOWS\SoftwareDistribution\Download\ea4fe5325a873581baacd3ab51700fd2\RTMQFE

04/27/2005 01:51 PM 585,216 wininet.dll
1 File(s) 585,216 bytes

Directory of C:\WINDOWS\SYSTEM32

08/29/2002 07:00 AM 599,040 wininet.dll
1 File(s) 599,040 bytes


Mike

[Advertisements]

Hi mike,

Now comes the tricky part. Make sure you follow these instructions to a T. Do not deviate from them at all, if you do, bad things may happen. If you have any questions, feel free to ask them before you start the fix

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

Please go to start>my computer then navigate to this file:

C:\Windows\System32\wininet.dll

right click on it and rename it to wininet.old

go to your C:\i386, rightclick on the wininet.dll present there, choose copy and paste it in your system32-folder.

*Note - It could be possible you will get an error saying the file already exists when you try to paste the good one in your system32-folder.
If it gives an error, just reboot

Reboot

Please remove just the files from the following paths using Windows Explorer (if present):

C:\Windows\System32\wininet.old
C:\Windows\System32\oleadm.dll

please post and let me know the results.


Thanks,



Excal

Edited by Excal, 09 August 2005 - 03:28 PM.

[Excal]

Hi mike,

Now comes the tricky part. Make sure you follow these instructions to a T. Do not deviate from them at all, if you do, bad things may happen. If you have any questions, feel free to ask them before you start the fix

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

Please go to start>my computer then navigate to this file:

C:\Windows\System32\wininet.dll

right click on it and rename it to wininet.old

go to your C:\i386, rightclick on the wininet.dll present there, choose copy and paste it in your system32-folder.

*Note - It could be possible you will get an error saying the file already exists when you try to paste the good one in your system32-folder.
If it gives an error, just reboot

Reboot

Please remove just the files from the following paths using Windows Explorer (if present):

C:\Windows\System32\wininet.old
C:\Windows\System32\oleadm.dll

please post and let me know the results.


Thanks,



Excal

Edited by Excal, 09 August 2005 - 03:28 PM.

[Mike in NJ]

Excal -

It won't let me rename the file - says access is denied, make sure disk is not full or write protected and that the file is not currently in use.

Could be because the virus is using it?


No other program is running (that I know of).

Thank you,

Mike

[Excal]

Go ahead and do this - we're going to see if we can use command prompt to rename and replace the infected file.

please copy these instructions and paste them into notepad for use while in safe mode

Please reboot your computer into safe mode.

Once in Safe Mode, go to Start > Run type:

cmd

Click OK.

Please copy the following line and paste it into the black window:

CD C:\Windows\system32

Hit enter.

It will go to the next line, then copy this line and paste it in:

rename wininet.dll wininet.old

Hit enter.

Copy this line and paste it in:

CD C:\i386

Hit enter.

Copy this line and paste it in:

copy wininet.dll C:\windows\system32

Hit enter.

Finally, type exit and hit enter.

Then please go into your C:\Windows\system32 directory and make sure there is a wininet.old and a wininet.dll BOTH in there. Please let me know if you run into any problems. You MUST make sure there is a wininet.dll in the system32 directory before you reboot otherwise you will run into serious issues.

[Mike in NJ]

Excal!!!! You did it!!!!

Way to go. And thank you so very much again. No more w32/*.* popping up.

And it was so much fun working in the dos wondow, just like the old days. Very cool.

Do you want any logs to make sure the system is now totally clean (like it looks like)?

Nice, patient, work, thank you again

Mike

[Excal]

Sure, Post me another HijAckthis log please




Excal

[Mike in NJ]

Big E - Here you go...

Logfile of HijackThis v1.99.1
Scan saved at 11:25:53 PM, on 8/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\AIM\aim.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\HijackThis.exe

O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123293741578
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123293725781
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,23/mcgdmgr.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot....ownload/kdx.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thanks Thanks Thanks...........

Mike

[Excal]

Great job, it appears your computer is clean

Ensure you rehide your “hidden files and folders” back to the way they were.

Now that your system is Malware Free, it is important to reset your system Restore. Click Here to learn how to.

Might I suggest the following Free Spyware programs, if you don't already have them, for added security, you can download them at the following links. These programs work great for detection:

Ad-aware SE
Spybot S&D
Microsoft Anti-Spyware


If you are unhappy with your current antivirus and want to replace it or if you dont already have one, I suggest one of these free programs:
*Note - do not use more than one anti-virus program as it will more than likely cause conflict.

AVG
Avast
AntiVir


The following free programs are great for prevention:

SpywareBlaster 3.4
Spywareguard
IE/Spyad

A Firewall is a must! Here are 3 good free versions:
(do not have more than one firewall running on your system)

Sygate
Kerio
ZoneLabs

There are other options other than Internet Explorer for a browser, which some say have better security. Two of them are:

Firefox
Opera

If you decide to keep Internet Explorer, This site is a great source for tightening up security on It's settings.

Make sure that you keep your Operating System and IE updated with the latest Critical Security Updates from Microsoft...they usually come out once a month, on the 2nd Tuesday of each month.

Included in those updates is Windows XP Service Pack 2. Click Here
Since you're junkware free, the time to get it is NOW. Service Pack 2 is a MAJOR upgrade for XP. It adds numerous security and software patches, as well as new features and functionality. You will also be adding another layer of protection against future threats.

Be sure and give the Temp folders a cleaning out now and then as well, Make sure after you clean your Temp files to empty out your Recycle bin as well.
For ease use the following program:

Cleanup
Run "Cleanup" and when it has finished, Reboot

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided. Also read How I got Infected

[Mike in NJ]

Big "E" Excal

Thank you very much for your help. Because of you, this machne seems to be perfect! I would have been lost otherwise, been forced to reformat the disk and start the pc from scratch, which never seems to work right. This machine was so messed up that it took days to fix, and your patience won out in the end. Plus, it seemed I no sooner posted something that you replied right away, another amazing part of your work.

Sorry this thank you took a few days to write.

Mike

[Excal]

Mike,


It was truly my pleasure. It was definatly a challenge, but I am glad we got you working right.

Good luck to you and safe surfing!

Thanks,



Excal

[Excal]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.