[Metallica]

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=959

O4 - HKLM\..\Run: [Local runole service] C:\WINDOWS\System\srvc32.exe

O4 - HKLM\..\RunServices: [Srv32 spool service] C:\WINDOWS\System\spoolsrv32.exe

O9 - Extra button: Microsoft AntiSpyware helper - {4BF2F769-637E-41C9-AEB6-E21719465B50} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4BF2F769-637E-41C9-AEB6-E21719465B50} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing)

O9 - Extra button: Microsoft AntiSpyware helper - {4BF2F769-637E-41C9-AEB6-E21719465B50} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4BF2F769-637E-41C9-AEB6-E21719465B50} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)

Reboot into safe mode and delete:
C:\WINDOWS\SYSTEM\SPOOLSRV32.EXE

Download this file: http://www.bleepingc...g/smitfraud.reg
Doubleclick smitfraud.reg and confirm you want to merge it with the registry.

Download the Hoster from HERE Press "Restore Original Hosts" and press "OK". Exit Program.

Download: DelDomains.inf
Should the link above display the text instead of downloading the file, then copy & paste the text into notepad and save the file as DellDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

Regards,

[Advertisements]

Hi Metallica

Thanks so much for helping me
i have checked the files and fixed them as requested
rebooted into safe mode and realised i have no idea how to delete C:\WINDOWS\SYSTEM\SPOOLSRV32.EXE
tried searching for files/folders but it didnt work
sorry to be so useless
please advise

lilli

[lilli]

Hi Metallica

Thanks so much for helping me
i have checked the files and fixed them as requested
rebooted into safe mode and realised i have no idea how to delete C:\WINDOWS\SYSTEM\SPOOLSRV32.EXE
tried searching for files/folders but it didnt work
sorry to be so useless
please advise

lilli

[Metallica]

*IMPORTANT* Be sure you know how to VIEW HIDDEN FILES

Then open "My Computer"
Doubleclick the C: drive icon
Doubleclick WINDOWS folder
Doubleclick SYSTEM
Rightclick SPOOLSRV32.EXE and choose delete

Regards,

[lilli]

ok i am such an idiot i think i just mistyped it tried again and deleted it
completed next step
now when i try to download hoster it ask me how i want to open it ?? i which programme, tried notepad and word didnt work
help again

[Metallica]

No problem.

Hoster is a zipped file.
Download and install freezip
http://members.ozema...lifetv/freezip/
to unzip those and you will see there is a exe inside you can doubleclick.
(Although ME should have a rightclick menu for unpacking them, I think)

Regards,

[lilli]

ok
i think i have done every thing
shall i post another log?
also do i need all those new things on my desktop
thanks for your patience you have been great


thought i'd do it anyway
does it look better now


Logfile of HijackThis v1.99.1
Scan saved at 13:56:41, on 13/05/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\WINDOWS\SYSTEM\E_S10IC2.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLDIAL.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\AOL 9.0\AOLTRAY.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.pas...uth.srf?lc=1033
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O7 "EPUSB1:" /M "Stylus CX3200"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE"
O4 - Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.va...OCX/FlashAX.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.co...._1/axofupld.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game18.zylomg...gamesplayer.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.micro...n7/dlhelper.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...478/mcfscan.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

Edited by lilli, 13 May 2005 - 06:54 AM.

[lilli]

Incident Status Location

Adware:Adware/Tubby No disinfected C:\WINDOWS\SYSTEM\MTC.ini
Adware:Adware/IGuard No disinfected Windows Registry
Adware:Adware/Tubby No disinfected C:\WINDOWS\SYSTEM\MTC.ini
just ran active scan and this is what it found 3pm friday london time

[Metallica]

Your HijackThis log is clean.

Can you find C:\WINDOWS\SYSTEM\MTC.ini

Rightclick it and choose "Open With .... " Notepad.

Post the content please.

Regards,

[lilli]

thanks so much again for all your time

does that mean its gone?

here is the file you asked for hope i did it right it was modified 8th april? probably when problem began


]

v=§
u=¦
l0=
c0=Æ

l1=à 4".2+
l2=î("40%(?
l3=æ"/%0.4.
l4=ã#6-35
l5=ç,2&4*-
l6=ë28;9)7-0
l7=ä);3<
l8=è';171
l9=è659??1?A
l10=BaQgW_

[1]
l1=ï$-08(Ã9564++=
l2=î("40%(?
l3=æ"/%0.4.
l4=ã#6-35
l5=ç,2&4*-
l6=ë28;9)7-0
l7=ä);3<
l8=è';171
l9=è659??1?A
l10=BaQgW_

[2]
l1=å8$31&3)55-
l2=á)".,7
l3=ï)'18*8417/
l4=ô4$1&*64
l5=÷,%,8(
l6=õ32'
l7=ù&20=6
l8=ü'5)A
l9=è(:2=:<?=3?=
l10=4X_c[VYi

[3]
l1=í.+&4
l2=à,"%..&)2
l3=â3#37
l4=ò180*:;-
l5=ô/399
l6=ä%()(:*>

[4]
l1=ì-,*0(Ã(':179
l2=ç.5'5Ãç':179
l3=õ&0(8.'5Çë+>5;=
l4=ú1'-&)Æê*=4:<
l5=í8'0?5=010@Ìð0C:@B
l6=õ-1<,:-978.@Îò2E<BD
l7=Ú÷;3<*8î.A8>@
l8=ú+.)<Éþ;D3ACÐô4G>DF
l9=÷0>.<í2:;5Ðô4G>DF

[5]
l1=ê.25)$+*
l2=ê/"0
l3=ñ7Áè-3'5+.
l4=ä'%8Ä÷,42/1
l5=ô&,453Çî39-;14
l6=å6**0<
l7=ò+,:08<0Ëò7=1?58
l8=ç8,,2>î.@3C
l9=ë06*8.5.:Î#6DI=8;

[6]
l1=å$!-6+Ãí4:=;+9/2
l2=ê)''Âì39<:*8.1
l3=å3'(Ãí4:=;+9/2Í E@F8
l4=á773Äî5;><,:03
l5=ê17:8(6,/í?=:5CE
l6=ê32+Æð7=@>.<25
l7=å4';Çñ8>A?/=36

[7]
l1=Þ#5-6Âð4<0-<
l2=æ!3&&37+
l3=ó&'1
l4=á0$0
l5=î$8:8,
l6=ï%8:<:++?5<<
l7=ä2';-><
l8=í4;-;<,/6/;
l9=ë,<2=3
l10=:TcS[Tb
l11=6Qj

[8]
l1=á 4*0*Ãå*=1,/
l2=ð545,%3Åê)=393
l3=ã"6,2,Åú19
l4=æ4()Äô54280Ëð/C9?9
l5=å$8.4.Çû39393
l6=ö35Åê)=393Ì!8D6
l7=ç&:060Éý1?D836
l8=ê8,-Èí,@6<6
l9=ø,@Èí,@6<6
l10=3bS`dg

[9]
l1=à.-177)7Åî);.B-?3
l2=ñ/'6:%7+
l3=â0/399+9Çï+81@
l4=ì#3846:
l5=ñ5-3:,:<
l6=ï33/;7;=
l7=è6;086/9@
l8=÷6@?*<0
l9=æ5<2@4>BA

[10]
l1=Þ#6&0797+Æû;+A19
l2=à54+1)89Æû;+A19
l3=â37,7*Åú:*@08
l4=á+5Ãø8(>.6
l5=í2(,/5/
l6=ø%(';188î?C8C6E
l7=ù&)(<299?

Edited by lilli, 13 May 2005 - 08:19 AM.

[lilli]

cant believe this, my macafee background system scan is still finding infected files
C:\_RESTORE\TEMP\A0013589.CPY
virus name Downloader-YN.dll
this file cannt be deleted

any suggestions

[Metallica]

You can delete that MTC.ini

The files found in the folder C:\_RESTORE arein your Restore Points.
http://kb.bitdefende...indows-Me).html

Regards,

[lilli]

ok deleted MTC.ini

turned off system restore which by the way i tried to use to get back to pre virus stage but that didnt work. i assume i should turn it on again next time i reboot.

does that mean we are all done and i can actually look at my bank account after 3 weeks, not that i really want to lol

what do i do with the great big bar of chocolate i just bought because i was getting so depressed. should i send it to you along with my undying gratitude. can't thank you enough really.

[Metallica]

Wow.

Who told you about my soft spot? CHOCOLATE !?!

~~ Me runs to beat ~Kat~ to the candy ~~

Yes, it should be safe to check your bank account. Sorry I have no way of fixing the cashflow.

Please have a look at my site for some tips on how to remove and prevent spyware.

Regards,