[tampabelle]

Hi James,

Well your Panda scan has raised fresh concerns !!!!

Please download these programs and save them in a new folder on your desktop -

Smitfraud.exe
CleanUp


Please reboot your PC in Safe Mode.

Run Smitfraud.exe

Locate and delete all these file -

C:\WINNT\system32\wp.bmp

F:\WINDOWS\SYSTEM\msdmxm.exe
F:\WINDOWS\SYSTEM\IEDriver\sx.htm
F:\WINDOWS\SYSTEM\sx.htm
F:\WINDOWS\SYSTEM\sb.htm
F:\WINDOWS\SYSTEM\d2ke.exe
F:\WINDOWS\SYSTEM\wnsintsu.exe
F:\WINDOWS\TEMP\ckz576bbb\Files\sx.htm
F:\WINDOWS\TEMP\down.cab[WToolsB.dll]
F:\WINDOWS\TEMP\goqkmfmh.exe
F:\WINDOWS\Downloaded Program Files\CONFLICT.3\ISTactivex.dll
F:\WINDOWS\Downloaded Program Files\QDow_AS2.dll
F:\WINDOWS\Downloaded Program Files\popcaploader.dll
F:\WINDOWS\Downloaded Program Files\popcaploader.inf
F:\WINDOWS\Downloaded Program Files\jao.dll
F:\WINDOWS\Downloaded Program Files\WildApp.inf
F:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.INF
F:\WINDOWS\iedisco.exe
F:\WINDOWS\securea.html
F:\WINDOWS\ISTactivex.dll
F:\Program Files\Netscape\Users\Internet.usinet.jmmiii3\Mail\Inbox[height.exe]
F:\Program Files\Common Files\CMEII\CMEUpd.exe
F:\Program Files\Common Files\CMEII\GIocl.dll
F:\Program Files\Common Files\CMEII\GIoclClient.dll
F:\Program Files\Common Files\CMEII\GStore.dll
F:\Program Files\Common Files\CMEII\GStoreServer.dll
F:\Program Files\WebSiteViewer\123286.exe
F:\loadk32.exe
F:\NULL
F:\WINDOWS\SYSTEM\my_teens.exe
F:\WINDOWS\SYSTEM\Free_Sex_Download.exe
F:\WINDOWS\SYSTEM\eegaicbd.exe
F:\WINDOWS\SYSTEM\sysapp.exe
F:\WINDOWS\SYSTEM\appsys.exe
F:\WINDOWS\SYSTEM\qsearch.exe
F:\WINDOWS\SYSTEM\pgewdmhw.exe
F:\WINDOWS\SYSTEM\opaxvcrk.exe
F:\WINDOWS\SYSTEM\cokkzfww.exe
F:\WINDOWS\SYSTEM\wjqtjtfw.exe
F:\WINDOWS\SYSTEM\lusytuao.exe
F:\WINDOWS\wininet1.exe

Run CleanUp and delete all temp files including temporary internet files on all the drives !!!

Reboot the PC in Normal Mode and post a fresh HJT log. I am in the meanwhile looking for a fix for the infected wininet.dll file. Please do not delete the file as it is an important system file.

[Advertisements]

I have a fix for the wininet.dll file. But first can you zip the file and email it to submit @ atribune . org (without the spaces)?? Mention my name in the subject of the email. We would like to scan the infected file and learn more about it.


Go to your C:\Windows\system32-folder and rename the bad wininet.dll to wininet.old
Then on top in the menu, choose tab 'view' > 'refresh'
Look if there is a new wininet.dll created in your system32-folder.

If not...

Go to your C:\Windows\system32\system32\dllcache-folder and rightclick on the good wininet.dll and choose copy.
Go back to your C:\Windows\system32-folder, rightclick anywhere in that folder and choose paste.

REBOOT

After reboot.. delete the C:\Windows\System32\wininet.old.
Also delete C:\Windows\System32\oleadm.dll

There is however a small chance that after reboot your explorer wont load. That's because of the wininet.dll missing in your system32-folder.
If this happens, after reboot you wont have any problems to replace to good wininet.dll from your dllcache or C:\WINDOWS\ServicePackFiles\i386-folder back to your system32-folder.
That must solve the problem. Because your explorer wont load then, you'll need to perform everything via taskmanager then (ctrl-alt-del) > applications > new task > browse


Upload and Scan that new C:\Windows\system32\wininet.dll on next site to make sure this one is clean:

http://virusscan.jotti.org/

let it scan and post the results in your next reply together with a new hijackthislog.

Edited by tampabelle, 24 June 2005 - 05:22 PM.

[tampabelle]

I have a fix for the wininet.dll file. But first can you zip the file and email it to submit @ atribune . org (without the spaces)?? Mention my name in the subject of the email. We would like to scan the infected file and learn more about it.


Go to your C:\Windows\system32-folder and rename the bad wininet.dll to wininet.old
Then on top in the menu, choose tab 'view' > 'refresh'
Look if there is a new wininet.dll created in your system32-folder.

If not...

Go to your C:\Windows\system32\system32\dllcache-folder and rightclick on the good wininet.dll and choose copy.
Go back to your C:\Windows\system32-folder, rightclick anywhere in that folder and choose paste.

REBOOT

After reboot.. delete the C:\Windows\System32\wininet.old.
Also delete C:\Windows\System32\oleadm.dll

There is however a small chance that after reboot your explorer wont load. That's because of the wininet.dll missing in your system32-folder.
If this happens, after reboot you wont have any problems to replace to good wininet.dll from your dllcache or C:\WINDOWS\ServicePackFiles\i386-folder back to your system32-folder.
That must solve the problem. Because your explorer wont load then, you'll need to perform everything via taskmanager then (ctrl-alt-del) > applications > new task > browse


Upload and Scan that new C:\Windows\system32\wininet.dll on next site to make sure this one is clean:

http://virusscan.jotti.org/

let it scan and post the results in your next reply together with a new hijackthislog.

Edited by tampabelle, 24 June 2005 - 05:22 PM.

[jmmathew]

ok, i ran smitfraud

I ran cleanup

I attempted to delete all listed files, but the following I did not find:

F:\WINDOWS\Downloaded Program Files\CONFLICT.3\ISTactivex.dll
F:\WINDOWS\Downloaded Program Files\QDow_AS2.dll
F:\WINDOWS\Downloaded Program Files\popcaploader.dll
F:\WINDOWS\Downloaded Program Files\popcaploader.inf
F:\WINDOWS\Downloaded Program Files\jao.dll
F:\WINDOWS\Downloaded Program Files\WildApp.inf
F:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.INF
F:\Program Files\Netscape\Users\Internet.usinet.jmmiii3\Mail\Inbox[height.exe]
F:\WINDOWS\SYSTEM\my_teens.exe
F:\WINDOWS\SYSTEM\Free_Sex_Download.exe
F:\WINDOWS\SYSTEM\eegaicbd.exe
F:\WINDOWS\SYSTEM\sysapp.exe
F:\WINDOWS\SYSTEM\appsys.exe
F:\WINDOWS\SYSTEM\qsearch.exe
F:\WINDOWS\SYSTEM\pgewdmhw.exe
F:\WINDOWS\SYSTEM\opaxvcrk.exe
F:\WINDOWS\SYSTEM\cokkzfww.exe
F:\WINDOWS\SYSTEM\wjqtjtfw.exe
F:\WINDOWS\SYSTEM\lusytuao.exe
F:\WINDOWS\wininet1.exe


I did however look in winnt and not windows because I am running 2000

I zipped and emailed the wininet.dll file as asked

I then became somewhat confused with the rest of the instructions.

Do I need to be in safe mode when changing the name to wininet.old?
I didn't see a dllcache folder anywhere.

So I have waited here for further instructions.

Thank you

James III

[tampabelle]

It is quite possible that your hidden files are well, hidden. We need to unhide them

Open Windows Explorer. Click on Tools ---> folder options ----> View tab.

Make sure the following items are checked -

Display the contents of system folder
Show hidden files and folders

Make sure the following items are unchecked -

Hide extensions of known file type
Hide protected operating system files (recommended)


Then proceed with the fix

[jmmathew]

I did infact have the hide system files box checked before, but still none of those files was I able to find. No matter, please now respond to the rest of my concerns

I don't want to screw this part up.

> Do I need to be in safe mode when changing the name to wininet.old?
> I didn't see a dllcache folder anywhere.

> So I have waited here for further instructions.

> Thank you

> James III

Thank you again for all your help.
James III

[tampabelle]

Hi James,

Give me a moment, I am checking on where to get the dll file for Windows 2000.

We dont seem to have received the attachment when you emailed wininet.dll earlier. Would it be possible for you to email it again to [email protected] and also [email protected]??

Thanx

Edited by tampabelle, 28 June 2005 - 05:19 PM.

[tampabelle]

Hi James,

Want to get this right this time.

Copy the part below into notepad and save it as searchwininet.bat
Set filetype to "All files"

dir %Systemdrive%\wininet.dll /a h /s > files.txt
start notepad files.txt


Double click the file and when it is ready it will open files.txt
Post the content of that file.

That will tell us where to copy it from !!!

[jmmathew]

here are the results


Volume in drive C has no label.
Volume Serial Number is 7405-9766

Directory of C:\WINNT\$NtUninstallKB834707-IE6SP1-20040929.091901$

08/29/2002 08:14a 585,728 wininet.dll
1 File(s) 585,728 bytes

Directory of C:\WINNT\$NtUninstallKB867282-IE6SP1-20050127.163319$

08/23/2004 09:32p 589,312 wininet.dll
1 File(s) 589,312 bytes

Directory of C:\WINNT\ServicePackFiles\i386

06/19/2003 03:05p 466,704 wininet.dll
1 File(s) 466,704 bytes

Directory of C:\WINNT\system32

12/07/2004 05:37p 590,336 wininet.dll
1 File(s) 590,336 bytes

Directory of C:\WINNT\system32\dllcache

12/07/2004 05:37p 590,336 WININET.DLL
1 File(s) 590,336 bytes


Thank you,

James III

[jmmathew]

And I see that the file is where you said it would be.

Must have needed to show system files before like you said.

Sorry,

James III

[jmmathew]

I have emailed the wininet.dll file zipped to the addresses you asked me to.

James III

[tampabelle]

Hi James III,

Can you post a fresh HJT log here and also let me know if you have any issues with your PC !!!

[tampabelle]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[tampabelle]

Topic reopened at the request of the user.

Please post a fresh HJT log and let me know of issues you are having with your PC

[jmmathew]

here is my hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 6:27:34 PM, on 7/22/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\WINNT\system32\NILaunch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\AIM\aim.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\James III\Desktop\hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Net-It Launcher] C:\WINNT\system32\NILaunch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [RegSvr32] C:\WINNT\system32\msmsgs.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe



And as I said in my message, the only symptom I have is that of Norton telling me there is a virus.

I was unable to delete or rename the wininet.dll file.

please let me know what I can do.




Thank you very much for your continued help with this matter.

James III

[tampabelle]

Hi James III,

I suggested this fix some time back. You found the file when the system files and hidden files were made visible !!! For more info on how to see system and hidden file read this Page.


Go to your C:\Windows\system32-folder and rename the bad wininet.dll to wininet.old
Then on top in the menu, choose tab 'view' > 'refresh'
Look if there is a new wininet.dll created in your system32-folder.

If not...

Go to your C:\Windows\system32\system32\dllcache-folder and rightclick on the good wininet.dll and choose copy.
Go back to your C:\Windows\system32-folder, rightclick anywhere in that folder and choose paste.

REBOOT

After reboot.. delete the C:\Windows\System32\wininet.old.
Also delete C:\Windows\System32\oleadm.dll

There is however a small chance that after reboot your explorer wont load. That's because of the wininet.dll missing in your system32-folder.
If this happens, after reboot you wont have any problems to replace to good wininet.dll from your dllcache or C:\WINDOWS\ServicePackFiles\i386-folder back to your system32-folder.
That must solve the problem. Because your explorer wont load then, you'll need to perform everything via taskmanager then (ctrl-alt-del) > applications > new task > browse


Upload and Scan that new C:\Windows\system32\wininet.dll on next site to make sure this one is clean:

http://virusscan.jotti.org/

let it scan and post the results in your next reply together with a new hijackthislog.