Solved: I've been owned by various Spywares (hijack this)
Just yesterday, my internet stopped working on my PC. I know it's not my connection as Xbox live still works fine. I've run Adaware various times and it keeps finding the same spyware: CoolWebSearch (dealt with a varient of this before), HttpFilter, and Possible hijack attempt. It cleans them out and they just come right back. Every so often, a new one will apear even though I haven't gone online since the last sweep.
The really weird thing is that this spyware screwed up my Task Manager. I can Ctrl-Alt-Delete, bring up the task manager but it will not be fully there. It is missing the tab to go to: processes, performance etc. so I can't see what is running in the backround. Truely weird. System Restores and Spysweeps do nothing.
I'm at a loss. Any and all help would be appreciated.
Oh yeah...attached is a screenshot of my messed up Task Manager.
Here is the Hijack This log:
Quote:
Logfile of HijackThis v1.98.0
Scan saved at 2:58:48 AM, on 11/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
»»Size of 'Windows' key: (Default-450;No'AppInit'-398;*Fake-~448!)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 398
User is a member of group DRAGONSPIRIT\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
Extract it (it should autoextract to C:\FindnFix when you double click it)
Go to the C:\FindnFix folder and doubleclick on !LOG!.BAT and let it run. It will generate a log.txt file. Copy and paste log.txt back here in your next reply.
Also a new version of Hijack This has been released so get rid of the old one and Click here to download the new one, come back here and post the log from it.
__________________ If I have helped solve your problem, please Click Here and make a donation to help keep this great site running. 100% goes directly to this site.
Logfile of HijackThis v1.98.2
Scan saved at 10:05:59 PM, on 11/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
The operation completed successfully
22:08:12.51 Fri 11/26/2004
__________________________________
*Local time:
Friday, November 26, 2004 (11/26/2004)
10:08 PM, Central Standard Time
*Uptime:
22:08:13 up 0 days, 0:07:07
*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon + group match required!)
User is a member of group DRAGONSPIRIT\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Group BUILTIN\Administrators matches list.
Group BUILTIN\Users matches list.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
User: [DRAGONSPIRIT\Guy1], is a member of:
BUILTIN\Administrators
\Everyone
Running in WORKSTATION MODE.
SystemDrive is C:
SystemRoot is C:\WINDOWS
Logon Domain is DRAGONSPIRIT
Administrator's Name is Guy1
Computer Name is DRAGONSPIRIT
LOGON SERVER is \\DRAGONSPIRIT
»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!
The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder
___________________________________________________________________________ ___
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
___________________________________________________________________________ ___
......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL
___________________________________________________________________________ _
*By size and date...
No matches found.
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
»»Performing string scan....
00001150: ?
00001190: vk U
000011D0eviceNotSelectedTimeout 1 5 ( W vk '
00001210: zGDIProcessHandleQuota" 9 0 ! vk `
00001250: Spooler2 y e s vk =pswapdisk
00001290: @ p vk 0 R TransmissionRetr
000012D0:yTimeout vk ' USERProcessHandleQuota
00001310: @ p
00001350:
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:
.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value entry was NOT found!
-----------------------
»»»»»»Backups list...»»»»»»
22:09:22 up 0 days, 0:08:16
-----------------------
Fri 26 Nov 04 22:09:22
C:\FINDNFIX\
keyback.hiv Fri Nov 26 2004 10:08:14p A.... 8,192 8.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 8,192 bytes 8.00 K
C:\FINDNFIX\KEYS1\
winkey.reg Fri Nov 26 2004 10:08:14p A.... 268 0.26 K
1 item found: 1 file, 0 directories.
Total of file sizes: 268 bytes 0.26 K
*Temp backups...
"C:\Documents and Settings\Guy1\Local Settings\Temp\Backs2\"
keyback2.hi_ Nov 26 2004 8192 "keyback2.hi_"
winkey2.re_ Nov 26 2004 268 "winkey2.re_"
2 items found: 2 files, 0 directories.
Total of file sizes: 8,460 bytes 8.26 K
-D---- JUNKXXX 00000000 22:08.14 26/11/2004
A----- STARTIT .BAT 00000060 22:08.14 26/11/2004
___________________________________________________________________________ _____
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
___________________________________________________________________________ _____
»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
-----END------
Fri 26 Nov 04 22:09:23
Last edited by OhNos111; 27-Nov-2004 at 02:58 AM..
Click here to download CWSinstall.exe. Click on the CWSinstall.exe file and it will install CWShredder. Close all browser windows, click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.
First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.
From main window :Click Start then under Select a scan Mode tick Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.
When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)
Restart your computer.
Come back here and post another Hijack This log and we'll get rid of what's left.
Logfile of HijackThis v1.98.2
Scan saved at 5:15:56 PM, on 11/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
*System:
Microsoft Windows XP Professional 5.1 Service Pack 1 (Build 2600)
*IE version:
6.0.2800.1106 SP1-Q818529-Q330994-Q822925-Q828750-Q832894
The type of the file system is NTFS.
MS-DOS Version 5.00.500
*command.com test passed!
__________________________________
!!*Creating backups...!!
(*Backup already exist!)
17:16:49.67 Sat 11/27/2004
__________________________________
*Local time:
Saturday, November 27, 2004 (11/27/2004)
5:16 PM, Central Standard Time
*Uptime:
17:16:51 up 0 days, 0:32:28
*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon + group match required!)
User is a member of group DRAGONSPIRIT\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Group BUILTIN\Administrators matches list.
Group BUILTIN\Users matches list.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
User: [DRAGONSPIRIT\Guy1], is a member of:
BUILTIN\Administrators
\Everyone
Running in WORKSTATION MODE.
SystemDrive is C:
SystemRoot is C:\WINDOWS
Logon Domain is DRAGONSPIRIT
Administrator's Name is Guy1
Computer Name is DRAGONSPIRIT
LOGON SERVER is \\DRAGONSPIRIT
»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!
The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder
___________________________________________________________________________ ___
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
___________________________________________________________________________ ___
......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL
___________________________________________________________________________ _
*By size and date...
No matches found.
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
»»Performing string scan....
00001150: ?
00001190: vk U
000011D0eviceNotSelectedTimeout 1 5 ( W vk '
00001210: zGDIProcessHandleQuota" 9 0 ! vk `
00001250: Spooler2 y e s vk =pswapdisk
00001290: @ p vk 0 R TransmissionRetr
000012D0:yTimeout vk ' USERProcessHandleQuota
00001310: @ p
00001350:
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:
.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value entry was NOT found!
-----------------------
»»»»»»Backups list...»»»»»»
17:18:22 up 0 days, 0:33:59
-----------------------
Sat 27 Nov 04 17:18:22
C:\FINDNFIX\
keyback.hiv Fri Nov 26 2004 10:08:14p A.... 8,192 8.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 8,192 bytes 8.00 K
C:\FINDNFIX\KEYS1\
winkey.reg Fri Nov 26 2004 10:08:14p A.... 268 0.26 K
1 item found: 1 file, 0 directories.
Total of file sizes: 268 bytes 0.26 K
*Temp backups...
"C:\Documents and Settings\Guy1\Local Settings\Temp\Backs2\"
keyback2.hi_ Nov 26 2004 8192 "keyback2.hi_"
winkey2.re_ Nov 26 2004 268 "winkey2.re_"
2 items found: 2 files, 0 directories.
Total of file sizes: 8,460 bytes 8.26 K
-D---- JUNKXXX 00000000 22:08.14 26/11/2004
A----- STARTIT .BAT 00000060 17:16.50 27/11/2004
___________________________________________________________________________ _____
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
___________________________________________________________________________ _____
»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
-----END------
Sat 27 Nov 04 17:18:23
In the services window find Security Agent.
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. Exit the Services utility.
If this service isn't there then skip this part and move on.
Double-click on Killbox.exe to run it. Now put a tick by Delete on reboot. In the "Paste Full Path of File to Delete" box, copy and paste each of the following lines one at a time. After each one it will ask for confimation to delete the file on next reboot. Click Yes. It will then ask if you want to reboot now. Click No. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.
C:\WINDOWS\system32\scagent.exe
C:\WINDOWS\httpfilter.dll
C:\WINDOWS\httpfilter2.dll
C:\WINDOWS\httpfilter1.dll
C:\WINDOWS\System32\wmvdmod.exe
Exit the Killbox.
Next run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"
In safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.
OCpp.dll is a dll file for R3D Tweak; a video card overclocking utility.
OK...did everything you asked but I couldn't get "Service Agent" to stop. It just returned an error. I've attached the error as a screenshot.
I did everything else but I'm still getting the httpfilter and CWS:about. Here is the new Hijack this Log.
Quote:
Logfile of HijackThis v1.98.2
Scan saved at 3:41:07 AM, on 12/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
*System:
Microsoft Windows XP Professional 5.1 Service Pack 1 (Build 2600)
*IE version:
6.0.2800.1106 SP1-Q818529-Q330994-Q822925-Q828750-Q832894
The type of the file system is NTFS.
MS-DOS Version 5.00.500
*command.com test passed!
__________________________________
!!*Creating backups...!!
(*Backup already exist!)
17:16:49.67 Sat 11/27/2004
__________________________________
*Local time:
Saturday, November 27, 2004 (11/27/2004)
5:16 PM, Central Standard Time
*Uptime:
17:16:51 up 0 days, 0:32:28
*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon + group match required!)
User is a member of group DRAGONSPIRIT\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Group BUILTIN\Administrators matches list.
Group BUILTIN\Users matches list.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
User: [DRAGONSPIRIT\Guy1], is a member of:
BUILTIN\Administrators
\Everyone
Running in WORKSTATION MODE.
SystemDrive is C:
SystemRoot is C:\WINDOWS
Logon Domain is DRAGONSPIRIT
Administrator's Name is Guy1
Computer Name is DRAGONSPIRIT
LOGON SERVER is \\DRAGONSPIRIT
»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!
The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder
___________________________________________________________________________ ___
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
___________________________________________________________________________ ___
......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL
___________________________________________________________________________ _
*By size and date...
No matches found.
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
»»Performing string scan....
00001150: ?
00001190: vk U
000011D0eviceNotSelectedTimeout 1 5 ( W vk '
00001210: zGDIProcessHandleQuota" 9 0 ! vk `
00001250: Spooler2 y e s vk =pswapdisk
00001290: @ p vk 0 R TransmissionRetr
000012D0:yTimeout vk ' USERProcessHandleQuota
00001310: @ p
00001350:
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:
.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value entry was NOT found!
-----------------------
»»»»»»Backups list...»»»»»»
17:18:22 up 0 days, 0:33:59
-----------------------
Sat 27 Nov 04 17:18:22
C:\FINDNFIX\
keyback.hiv Fri Nov 26 2004 10:08:14p A.... 8,192 8.00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 8,192 bytes 8.00 K
C:\FINDNFIX\KEYS1\
winkey.reg Fri Nov 26 2004 10:08:14p A.... 268 0.26 K
1 item found: 1 file, 0 directories.
Total of file sizes: 268 bytes 0.26 K
*Temp backups...
"C:\Documents and Settings\Guy1\Local Settings\Temp\Backs2\"
keyback2.hi_ Nov 26 2004 8192 "keyback2.hi_"
winkey2.re_ Nov 26 2004 268 "winkey2.re_"
2 items found: 2 files, 0 directories.
Total of file sizes: 8,460 bytes 8.26 K
-D---- JUNKXXX 00000000 22:08.14 26/11/2004
A----- STARTIT .BAT 00000060 17:16.50 27/11/2004
___________________________________________________________________________ _____
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
___________________________________________________________________________ _____
»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
-----END------
Sat 27 Nov 04 17:18:23
Click here to download CWSinstall.exe. Click on the CWSinstall.exe file and it will install CWShredder. Close all browser windows, click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.
First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.
From main window :Click Start then under Select a scan Mode tick Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.
When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)
Restart your computer.
Come back here and post another Hijack This log and we'll get rid of what's left.
Logfile of HijackThis v1.98.2
Scan saved at 3:31:03 PM, on 12/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
In the services window find Security Agent.
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. Exit the Services utility.
If this service isn't there then skip this part and move on.
Double-click on Killbox.exe to run it. Now put a tick by Delete on reboot. In the "Paste Full Path of File to Delete" box, copy and paste each of the following lines one at a time. After each one it will ask for confimation to delete the file on next reboot and if you want to reboot now. Click No then OK on the next prompt. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.
C:\WINDOWS\system32\scagent.exe
C:\WINDOWS\httpfilter.dll
C:\WINDOWS\httpfilter2.dll
C:\WINDOWS\httpfilter1.dll
Exit the Killbox.
Next run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"
Logfile of HijackThis v1.98.2
Scan saved at 6:36:41 AM, on 12/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
In safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
THIS THREAD HAS EXPIRED.
Are you having the same problem?
We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.
Search 
OI)(CI)F 
eviceNotSelectedTimeout 1 5 ( W vk ' 
