[barbara960]

[FONT=Times][SIZE=14][COLOR=green] Hi Ya All, A couple of strange things have started to happen recently (I think about the time that this Winfix2005 (Uwfx5lp_0001_0715netinstaller) INFECTED me----I've been reading all the stuff you guys have to say on this but am not sure if I really need to try all that yet, I'm kinda unskilled here, as I have just been cutting it off when it starts. Maybe later????) Anyhow, WHENEVER I OPEN A DEST TOP SHORT CUT (to disk drives, computer, etc) I GET THE ERROR MESSAGE THAT IE HAS PEFORMED AN ILLEGAL FUNCTION AND WILL CLOSE DOWN (either the screen flashes off for a second and comes back or I get three consecutive same messages, ok to all of them, and then the page will come up.) THE SECOND THING IS THAT I AM NO LOGER ABLE TO ACCESS MY E DRIVE (R/W). tHE MESSAGE IS THAT IT IS NOT READY (I can't get a green light on it, it flashes for several miutes then all lights go out. I have checked all wiring and it says it is working properly). I don't have any idea if this is a viral problem or a machine problem. I ran CLEAN UP, SPY-BOT , ADAWARE, SPYBUSTER AND THEN HIGHJACK THIS. Any SUGGESTIONS would be appreciated. Thanks alot! BD Logfile of HijackThis v1.99.1
Scan saved at 8:49:40 AM, on 8/10/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\DIALSPEED.NET\DIALSPEED INTERNET ACCELERATOR\3.52.1010.7\IACLIM.EXE
C:\MY DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Access4Less
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: BHO Class - {FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\SECURESERVICEPACK.DLL
O2 - BHO: eCATRegistrar Class - {02336F51-24CA-4422-AB63-18841ADF35E6} - C:\PROGRAM FILES\DIALSPEED.NET\DIALSPEED INTERNET ACCELERATOR\3.52.1010.7\ECATBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: DIALSPEED Internet Accelerator - {4BC3AC04-3E56-411D-B465-4FEA06654611} - C:\PROGRAM FILES\DIALSPEED.NET\DIALSPEED INTERNET ACCELERATOR\3.52.1010.7\THINCLIENTTOOLBAR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IAClient] C:\Program Files\DIALSPEED.NET\DIALSPEED Internet Accelerator\3.52.1010.7\IACLiM.exe
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0715] "C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5LP_0001_0715NETINSTALLER.EXE"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9} (BHO Class) - http://plugin.secure...servicepack.cab
O16 - DPF: {35B1769E-299A-4E17-B9D0-E669A02C0F18} (QCDownload2 Class) - http://setup.dialspe.../QCDownload.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...Bridge-c139.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 209.63.0.2,209.197.0.2

[Advertisements]

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


O2 - BHO: BHO Class - {FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\SECURESERVICEPACK.DLL
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0715] "C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5LP_0001_0715NETINSTALLER.EXE"
O16 - DPF: {FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9} (BHO Class) - http://plugin.secure...servicepack.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...Bridge-c139.cab



*** Deleting Files ***
Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):


C:\WINDOWS\DOWNLOADED PROGRAM FILES\SECURESERVICEPACK.DLL
C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5LP_0001_0715NETINSTALLER.EXE

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

[Dragon]

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


O2 - BHO: BHO Class - {FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\SECURESERVICEPACK.DLL
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0715] "C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5LP_0001_0715NETINSTALLER.EXE"
O16 - DPF: {FE6A3E85-0F6C-49AD-8843-68FF44E7EEA9} (BHO Class) - http://plugin.secure...servicepack.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...Bridge-c139.cab



*** Deleting Files ***
Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):


C:\WINDOWS\DOWNLOADED PROGRAM FILES\SECURESERVICEPACK.DLL
C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5LP_0001_0715NETINSTALLER.EXE

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

[barbara960]

Hey Efwis, that was way cool ! It took care of the strange error messages and seems to have eliminated the start up of Winfix. I was not able to find any of the DPF's.... Big bummer though, I still can not access my R/W drive. It still flashes the green for a while then goes dark. If you can think of anything else (maybe the Hijack this log will help(?), I would be very greatfull...Thanks BD Logfile of HijackThis v1.99.1
Scan saved at 9:35:05 AM, on 8/11/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\DIALSPEED.NET\DIALSPEED INTERNET ACCELERATOR\3.52.1010.7\IACLIM.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\MY DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Access4Less
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: eCATRegistrar Class - {02336F51-24CA-4422-AB63-18841ADF35E6} - C:\PROGRAM FILES\DIALSPEED.NET\DIALSPEED INTERNET ACCELERATOR\3.52.1010.7\ECATBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: DIALSPEED Internet Accelerator - {4BC3AC04-3E56-411D-B465-4FEA06654611} - C:\PROGRAM FILES\DIALSPEED.NET\DIALSPEED INTERNET ACCELERATOR\3.52.1010.7\THINCLIENTTOOLBAR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IAClient] C:\Program Files\DIALSPEED.NET\DIALSPEED Internet Accelerator\3.52.1010.7\IACLiM.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {35B1769E-299A-4E17-B9D0-E669A02C0F18} (QCDownload2 Class) - http://setup.dialspe.../QCDownload.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 209.63.0.2,209.197.0.2

I will wait breathlessly !!!!!

[Dragon]

thats more of a hardware issue from the sounds of it. because of that I will refer you to our hardware section, it could be driver issue or your cd r/w has just died, our trusted techs in Hardware can help you out on that better then I can.

Please post a new topic here for that issue.
http://www.geekstogo...p?act=SF&s=&f=9

as for your log, yoiu system is clean
Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:

• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

Prevention Programs:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

Other necessary Programs:

• AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
• Firewall<= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
• More Secure Browser<= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox, however Opera and SlimBrowsers are good as well.

And also see TonyKlein's good advice
So how did I get infected in the first place? and Spyware Aid's spyware article: Spyware, Adware, Malware: What it is, how it got on my computer, how to get rid of it, and how to prevent it.

[barbara960]

Thanks ALOT Efwis

[Dragon]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.