1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Forget Hijacked! Mine's been BOOSTED! Help please.

Discussion in 'Virus & Other Malware Removal' started by JØhnöJÖhn, Apr 27, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    :eek: Getting my IE6 (version 6.0.2800.1106 SP! update and first Q83... There are more to get I know) redirected to an http://aifind.info page right off the bat and then about every 10 seconds if I get to another page right back it goes. I cannot even use that machine to surf for fixes anymore. (Now on pentium laptop right beside the new homebuilt gamer that is now sick.) I do have HJT logs but cannot stay on long enuff to post with that machine. Might be able to get it here by disk/floppy from this machine no problem.

    Got a AMD 2700, Win 2K Pro system, and a bunch of other goodies. Also trapped in a dial-up world. I did manage to get Spy Sweeper, HiJackThis, KillBox, and CWShredder (ver 1.57.0.0) and My Firewall Plus (ver2.11.15.0) last night. But that was too late. I have firewall and virus protection from McAfee but not installed (would it be worthwhile to install or go buy new?)

    This happened Friday evening and it is getting more consistant with the redirect. Also it has sent me to the about:blank page, then master search, and then on some other credit/loan or adult page. Also adds adult links in my favorites folder. Seems it is constantly morphing in the memory stack and is always at least a step ahead of me. No matter what I do.

    I need a fix and then I need a prevent solution. Preparing to clean the drive and reload if all else fails. From what I have read this thing grows and grows. Morphing into all sorts of strange varieties. Maybe it is a "creation team" working on producing these at about a rate of one a week. I hope they are getting big money writing this crap that directs peeps to these sites. This totally blows. :confused:

    Thanks to anyone that helps!
     
  2. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Hi JØhnöJÖhn

    Welcome to TSG! :)

    Please do this. Click here to download Hijack This. Click on the Hijackthis.exe.

    Click the "Scan" button when the scan is finished the scan button will become "Save Log" click that and save the log.

    Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.

    DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required. Someone here will be glad to advise you on what to fix.

    *Note: When you download Hijack This Do Not download it to a temp folder or to the desktop. Create a permanent folder somewhere like in My Documents and name it Hijack This and put it in that folder.
     
  3. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    Logfile of HijackThis v1.97.7
    Scan saved at 8:02:40 PM, on 4/27/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\System32\Ati2evxx.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Yahoo!\Messenger\ypager.exe
    C:\Program Files\Webroot\Accelerate\accelerate.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Webroot\My Firewall Plus\Smc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\John\Desktop\HiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O1 - Hosts: 213.159.117.235 auto.search.msn.com
    O2 - BHO: (no name) - {57385AC9-F85D-4997-B2D1-570FDEC440BE} - C:\WINNT\system32\idf.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Webroot\MYFIRE~1\Smc.exe -startgui
    O4 - HKLM\..\Run: [Accelerate] C:\Program Files\Webroot\Accelerate\accelerate.exe /S
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\Run: [PopUpWasher] C:\Program Files\Webroot\PopUpWasher\PopUpWasher.exe
    O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
    O4 - HKLM\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "John"
    O4 - HKCU\..\RunOnce: [unPopUpWasher] unPopUpWasher.exe rm
    O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "John"
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe
    O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Program Files\Q330994.exe
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38093.8339930556
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{36F75987-0523-48AF-9F2D-70ADA4A284CA}: NameServer = 64.89.70.2 64.89.74.2
    O17 - HKLM\System\CS2\Services\Tcpip\..\{36F75987-0523-48AF-9F2D-70ADA4A284CA}: NameServer = 64.89.70.2 64.89.74.2
     
  4. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    Logfile of HijackThis v1.98.2
    Scan saved at 10:39:43 PM, on 8/14/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\System32\Ati2evxx.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\Ati2evxx.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINNT\AGRSMMSG.exe
    C:\WINNT\system32\CTHELPER.EXE
    C:\Program Files\Yahoo!\Messenger\ypager.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\unzipped\hijackthis1\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\http://www.yahoo.com.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\winnt\system32\www.yahoo.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {0426F231-2BE9-47BE-8D85-730855FAB23E} - C:\WINNT\system32\idf.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll (file missing)
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe
    O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Program Files\Q330994.exe
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{36F75987-0523-48AF-9F2D-70ADA4A284CA}: NameServer = 64.89.70.2 64.89.74.2
    O17 - HKLM\System\CS2\Services\Tcpip\..\{36F75987-0523-48AF-9F2D-70ADA4A284CA}: NameServer = 64.89.70.2 64.89.74.2
    O18 - Filter: text/html - {07A39FA3-EAA9-4C59-B65D-5C6EB868AC31} - C:\WINNT\system32\idf.dll
    O18 - Filter: text/plain - {07A39FA3-EAA9-4C59-B65D-5C6EB868AC31} - C:\WINNT\system32\idf.dll

    Thanks if you can help.jj
     
  5. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Click here to download CWShredder. Close all browser windows, click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.

    When it is finished restart your computer.



    Go here and download Adaware SE.

    Install the program and launch it.

    First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

    From main window :Click Start then under Select a scan Mode tick Perform full system scan.

    Next deselect Search for negligible risk entries.

    Now to scan just click the Next button.

    When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

    Restart your computer.

    Come back here and post another Hijack This log and we'll get rid of what's left.
     
  6. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    Adaware won't download and i've tried about 20 times. Loads 28K and then just stops. What gives? Do you have any ideas? Thanks jj
     
  7. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    You mean it won't download?
     
  8. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    nope. it gets to 28K every time and then just stops. time after time. adaware just doesn't like me i guess. CWS did just fine. I have a feeling that this trojan has stopped me from accessing other web sites, i wonder if it can stop a ftp download? nah... i can initiate it but not complete one so that is out. hmmmm... got any ideas? could you compress and mail it?

    running one of the latest atlon processors with WIN 2k os. 80G hard drive and everything else seems right here on my end. this is turning out to be a real head scratcher.

    thanks again. jj
     
  9. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Hi, Can you have a friend download AdAware SE and burn to a CD for you? The updates for it can also be downloaded and added manually> it has been done in pinches lots of times.
    If friend can do this> make sure they burn the CD as a data cd, using .ISO or image file works well. Most CD drives will be able to read a data disk made to a regular CDR disc, but may not read CDRW's unless you have a compatible burner, too.
     
  10. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    ok. will try to do the CD thing. but i have been doing some digging and it seems that i have a very old version of MS VJM on this machine. it isn't supported anyway so i will need to scrap that first in this case. then i will have a more solid OS to work with. will get back to ya when i get all this done.

    thanks for your help.

    jj
     
  11. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Please go ahead and post another Hijack This log and also do this:

    Click here to download FindNFix.

    Extract it (it should autoextract to C:\FindnFix when you double click it)

    Go to the C:\FindnFix folder and doubleclick on !LOG!.BAT and let it run. It will generate a log.txt file. Copy and paste log.txt back here in your next reply.
     
  12. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    here ya go!

    Logfile of HijackThis v1.98.2
    Scan saved at 1:59:22 PM, on 8/16/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\System32\Ati2evxx.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\hidserv.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\Ati2evxx.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINNT\AGRSMMSG.exe
    C:\WINNT\system32\CTHELPER.EXE
    C:\Program Files\Yahoo!\Messenger\ypager.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\PROGRA~1\WINZIP\winzip32.exe
    C:\unzipped\hijackthis1\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\idf.dll/sp.html (obfuscated)
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\http://www.yahoo.com.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\winnt\system32\www.yahoo.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {C035BE92-72FE-4EFC-B4DD-381ADF0D3144} - C:\WINNT\system32\idf.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll (file missing)
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
    O15 - Trusted Zone: http://*.windowsupdate.com
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe
    O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Program Files\Q330994.exe
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{36F75987-0523-48AF-9F2D-70ADA4A284CA}: NameServer = 64.89.70.2 64.89.74.2
    O17 - HKLM\System\CS2\Services\Tcpip\..\{36F75987-0523-48AF-9F2D-70ADA4A284CA}: NameServer = 64.89.70.2 64.89.74.2
    O18 - Filter: text/html - {09131D56-08C5-410F-8D62-ADE83C2B66B4} - C:\WINNT\system32\idf.dll
    O18 - Filter: text/plain - {09131D56-08C5-410F-8D62-ADE83C2B66B4} - C:\WINNT\system32\idf.dll

    and now the find and fix log follows:


    Mon 16 Aug 04 14:00:14

    »»»»»»»»»»»»»»»»»»***LOG!***(*updated *8/16)»»»»»»»»»»»»»»»»

    *System:
    Microsoft Windows 2000 Professional 5.0 Service Pack 4 (Build 2195)
    *IE version:
    6.0.2800.1106 SP1-Q832894-Q831167-Q837009-Q867801-Q823353

    The type of the file system is NTFS.

    __________________________________
    !!*Creating backups...!!

    The operation completed successfully
    __________________________________

    *Local time:
    Monday, August 16, 2004 (8/16/2004)
    2:00 PM, Eastern Daylight Time
    *Uptime:
    14:00:15 up 0 days, 11:54:29

    ----------------------------------------------------
    »»Member of...: ("ADMIN" logon + group match required!)

    User is a member of group JOHN-CV0K7ZWYL6\None.
    User is a member of group \Everyone.
    User is a member of group BUILTIN\Administrators.
    User is a member of group BUILTIN\Users.
    User is a member of group NT AUTHORITY\INTERACTIVE.
    User is a member of group NT AUTHORITY\Authenticated Users.
    User is a member of group \LOCAL.
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    Group BUILTIN\Administrators matches list.
    Group BUILTIN\Users matches list.

    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    User: [JOHN-CV0K7ZWYL6\John], is a member of:

    BUILTIN\Administrators
    \Everyone

    »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
    The list will produce a small database of files that will match certain criteria.
    Ex: read only files, s/h files, last modified date. size, etc.
    The filters provided and registry scan should match the
    corresponding file(s) listed.
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Unless the file match the entire criteria, it should not be pointed to remove
    without attempting to confirm it's nature!
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
    If in doubt, always search the file(s) and properties according to criteria!

    The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder

    ______________________________________________________________________________
    ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
    ______________________________________________________________________________

    ......Scanning for file(s)...
    *Note! The list(s) may include legitimate files!
    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

    »»»»» (*1*) »»»»» .........
    »»Read access error(s)...

    C:\WINNT\SYSTEM32\D3DC.DLL +++ File read error
    \\?\C:\WINNT\System32\D3DC.DLL +++ File read error

    »»»»» (*2*) »»»»»........
    D3DC.DLL Can't Open!

    »»»»» (*3*) »»»»»........

    C:\WINNT\SYSTEM32\
    d3dc.dll Sat Apr 24 2004 10:36:42p A...R 57,344 56.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 57,344 bytes 56.00 K

    unknown/hidden files...

    C:\WINNT\SYSTEM32\
    advapi32.dll Tue Mar 23 2004 10:17:00p A..H. 388,368 379.27 K
    basesrv.dll Tue Mar 23 2004 10:17:02p A..H. 42,256 41.27 K
    browser.dll Tue Mar 23 2004 10:17:02p A..H. 69,904 68.27 K
    cdral.dll Fri Apr 16 2004 11:50:10p A..H. 45,056 44.00 K
    cdrtc.dll Fri Apr 16 2004 11:50:10p A..H. 49,152 48.00 K
    crypt32.dll Tue Mar 23 2004 10:17:00p A..H. 543,504 530.77 K
    cryptnet.dll Tue Mar 23 2004 10:17:02p A..H. 61,200 59.77 K
    cryptsvc.dll Tue Mar 23 2004 10:17:02p A..H. 76,048 74.27 K
    dnsapi.dll Tue Mar 23 2004 10:17:00p A..H. 134,928 131.77 K
    dnsrslvr.dll Tue Mar 23 2004 10:17:02p A..H. 92,432 90.27 K
    dplayx.dll Wed Apr 14 2004 2:56:46p A..H. 219,648 214.50 K
    dpwsockx.dll Mon Apr 12 2004 11:11:26p A..H. 76,800 75.00 K
    eventlog.dll Tue Mar 23 2004 10:17:02p A..H. 47,888 46.77 K
    gdi32.dll Tue Mar 23 2004 10:17:02p A..H. 242,448 236.77 K
    ipnathlp.dll Tue Mar 23 2004 10:17:02p A..H. 442,640 432.27 K
    itss.dll Tue Jun 22 2004 6:42:32p A..H. 123,392 120.50 K
    kernel32.dll Tue Mar 23 2004 10:17:04p A..H. 742,160 724.77 K
    mf3216.dll Tue Mar 23 2004 10:17:02p A..H. 37,136 36.27 K
    mpr.dll Tue Mar 23 2004 10:17:02p A..H. 54,544 53.27 K
    msasn1.dll Tue Mar 23 2004 10:17:00p A..H. 53,520 52.27 K
    msgina.dll Tue Mar 23 2004 10:17:00p A..H. 335,120 327.27 K
    mstask.dll Thu Jun 10 2004 12:58:12p A..H. 216,848 211.77 K
    netapi32.dll Thu Jun 10 2004 12:58:12p A..H. 309,008 301.77 K
    netlogon.dll Tue Mar 23 2004 10:17:02p A..H. 371,472 362.77 K
    ntdll.dll Tue Mar 23 2004 10:17:04p A..H. 497,936 486.27 K
    ntdsa.dll Tue Mar 23 2004 10:17:02p A..H. 1,028,880 1004.77 K
    psbase.dll Tue Mar 23 2004 10:17:02p A..H. 115,984 113.27 K
    samlib.dll Tue Mar 23 2004 10:17:04p A..H. 49,936 48.77 K
    samsrv.dll Tue Mar 23 2004 10:17:02p A..H. 388,368 379.27 K
    scecli.dll Tue Mar 23 2004 10:17:02p A..H. 111,376 108.77 K
    scesrv.dll Tue Mar 23 2004 10:17:02p A..H. 253,200 247.27 K
    sfcfiles.dll Tue Mar 23 2004 10:17:04p A..H. 971,536 948.77 K
    shell32.dll Wed May 19 2004 7:10:10p A..H. 2,358,544 2.25 M
    sp3res.dll Sun May 16 2004 3:43:54p ...H. 5,873,664 5.60 M
    umandlg.dll Fri May 21 2004 11:33:20p A..H. 27,920 27.27 K
    user32.dll Tue Mar 23 2004 10:17:00p A..H. 403,216 393.77 K
    w32time.dll Tue Mar 23 2004 10:17:02p A..H. 50,960 49.77 K
    wintrust.dll Tue Mar 23 2004 10:17:02p A..H. 167,184 163.27 K

    38 items found: 38 files, 0 directories.
    Total of file sizes: 17,074,176 bytes 16.28 M

    »»»»» (*4*) »»»»».........
    Sniffing..........
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINNT\SYSTEM32\ADVAPI32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\BASESRV.DLL
    Sniffed -> C:\WINNT\SYSTEM32\BROWSER.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CDRAL.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CDRTC.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CRYPT32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CRYPTNET.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CRYPTSVC.DLL
    Sniffed -> C:\WINNT\SYSTEM32\D3DC.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DNSAPI.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DNSRSLVR.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DPLAYX.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DPWSOCKX.DLL
    Sniffed -> C:\WINNT\SYSTEM32\EVENTLOG.DLL
    Sniffed -> C:\WINNT\SYSTEM32\GDI32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\IPNATHLP.DLL
    Sniffed -> C:\WINNT\SYSTEM32\ITSS.DLL
    Sniffed -> C:\WINNT\SYSTEM32\KERNEL32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MF3216.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MPR.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MSASN1.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MSGINA.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MSTASK.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NETAPI32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NETLOGON.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NTDLL.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NTDSA.DLL
    Sniffed -> C:\WINNT\SYSTEM32\PSBASE.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SAMLIB.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SAMSRV.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SCECLI.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SCESRV.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SFCFILES.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SHELL32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SP3RES.DLL
    Sniffed -> C:\WINNT\SYSTEM32\UMANDLG.DLL
    Sniffed -> C:\WINNT\SYSTEM32\USER32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\W32TIME.DLL
    Sniffed -> C:\WINNT\SYSTEM32\WINTRUST.DLL
    SNiF 1.34 statistics

    Matching files : 39 Amount in bytes : 17131520
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»»»(*5*)»»»»»
    ¯ Access denied ® ..................... D3DC.DLL .....57344 24.04.2004

    »»»»»(*6*)»»»»»
    fgrep: can't open input C:\WINNT\SYSTEM32\D3DC.DLL

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
    »»»»»Search by size...
    *List of files and specs according to 'size' :
    *Note: Not all files listed here are infected, but *may include* the
    name and spces of the offending file...
    ___________________________________________________________________________
    Path: C:\WINNT\SYSTEM32 Including: *.DLL

    146. D3dc Dll 57,344 . . R . A 4-24-04 10:36 pm
    948. Vuins32 Dll 57,344 . . . . A 7-22-04 5:28 pm

    ____________________________________________________________________________
    *By size and date...


    C:\WINNT\SYSTEM32\
    d3dc.dll Sat Apr 24 2004 10:36:42p A...R 57,344 56.00 K
    vuins32.dll Thu Jul 22 2004 5:28:02p A.... 57,344 56.00 K

    2 items found: 2 files, 0 directories.
    Total of file sizes: 114,688 bytes 112.00 K

    No matches found.

    No matches found.

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINNT\SYSTEM32\D3DC.DLL
    Sniffed -> C:\WINNT\SYSTEM32\VUINS32.DLL
    SNiF 1.34 statistics

    Matching files : 2 Amount in bytes : 114688
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    SNiF 1.34 statistics

    Matching files : 0 Amount in bytes : 0
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    SNiF 1.34 statistics

    Matching files : 0 Amount in bytes : 0
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»


    BHO search...

    fgrep: can't open input C:\WINNT\SYSTEM32\D3DC.DLL


    No matches found.


    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
    »»Size of Windows key:
    (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

    Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448

    »»Checking for AppInit_DLLs (empty) value...
    ________________________________
    !"AppInit_DLLs"=""!

    Value does not match
    ________________________________

    »»Dumping Values........
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710

    »»Security settings for 'Windows' key:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    (NI) ALLOW Read BUILTIN\Users
    (IO) ALLOW Read BUILTIN\Users
    (NI) ALLOW Read BUILTIN\Power Users
    (IO) ALLOW Read BUILTIN\Power Users
    (NI) ALLOW Full access BUILTIN\Administrators
    (IO) ALLOW Full access BUILTIN\Administrators
    (NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (NI) ALLOW Full access BUILTIN\Administrators
    (IO) ALLOW Full access CREATOR OWNER

    Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    Read BUILTIN\Users
    Read BUILTIN\Power Users
    Full access BUILTIN\Administrators
    Full access NT AUTHORITY\SYSTEM



    »»Performing string scan....
    00001150: ?
    00001190: 8 @
    000011D0: vk 6 a AppInit_DLLsT i C : \ W I N N T \ s
    00001210:y s t e m 3 2 \ d 3 d c . d l l vk h ,
    00001250:DeviceNotSelectedTimeout 1 5 ` vk '
    00001290: A GDIProcessHandleQuota t vk \ Spooler
    000012D0: y e s s i vk a swapdisk vk 0
    00001310: d TransmissionRetryTimeout 9 0 ` vk '
    00001350: s USERProcessHandleQuota
    00001390:
    000013D0:
    00001410:
    00001450:
    00001490:
    000014D0:
    00001510:
    00001550:
    00001590:
    000015D0:

    ---------- WIN.TXT
    AppInit_DLLsT
    --------------
    --------------
    $011E8: AppInit_DLLsT
    $01250: DeviceNotSelectedTimeout
    $01298: GDIProcessHandleQuota
    $01318: TransmissionRetryTimeout
    $01358: USERProcessHandleQuota
    --------------
    --------------
    C:\WINNT\system32\d3dc.dll
    --------------
    --------------
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""
    "DeviceNotSelectedTimeout"="15"
    "GDIProcessHandleQuota"=dword:00002710
    "Spooler"="yes"
    "swapdisk"=""
    "TransmissionRetryTimeout"="90"
    "USERProcessHandleQuota"=dword:00002710

    ..........
    *Debug...
    --------------
    --------------
    Ntdll.DLL at 77F80000
    Kernel32.DLL at 7C570000
    NtQueryInformationFile (Entry at 2AE6BA80) restored to 77F859C5
    NtQuerySystemInformation (Entry at 2AE69267) restored to 77F83227
    LdrLoadDll (Entry at 2AE66F1F) restored to 77F88A12
    LdrUnloadDll (Entry at 2AE66289) restored to 77F8848A
    RtlQueryProcessDebugInformation (Entry at 2AE69966) restored to 77F9EA92
    ..........
    A handle was successfully obtained for the
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
    This key has 0 subkeys.
    The AppInitDLLs value exists and reports as 54 bytes, including the 2 for string termination.

    [AppInitDLLs]
    Ansi string : "C:\WINNT\system32\d3dc.dll"
    0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 4e 00 54 00 | C.:.\.W.I.N.N.T.
    0010 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 | \.s.y.s.t.e.m.3.
    0020 32 00 5c 00 64 00 33 00 64 00 63 00 2e 00 64 00 | 2.\.d.3.d.c...d.
    0030 6c 00 6c 00 00 00 | l.l...
    -----------------------

    »»»»»»Backups list...»»»»»»
    14:00:36 up 0 days, 11:54:49
    -----------------------
    Mon 16 Aug 04 14:00:36


    C:\FINDNFIX\
    keyback.hiv Mon Aug 16 2004 2:00:14p A.... 8,192 8.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 8,192 bytes 8.00 K

    C:\FINDNFIX\KEYS1\
    winkey.reg Mon Aug 16 2004 2:00:14p A.... 287 0.28 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 287 bytes 0.28 K

    *Temp backups...

    "C:\Documents and Settings\John\Local Settings\Temp\Backs2\"
    keyback2.hi_ Aug 16 2004 8192 "keyback2.hi_"
    winkey2.re_ Aug 16 2004 287 "winkey2.re_"

    2 items found: 2 files, 0 directories.
    Total of file sizes: 8,479 bytes 8.28 K
    -D---- JUNKXXX 00000000 14:00.14 16/08/2004
    A----- STARTIT .BAT 0000005F 14:00.14 16/08/2004

    ________________________________________________________________________________
    ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
    AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
    MINIMAL REQUIREMENTS INCLUDE:
    _________XP HOME/PRO; SP1; IE6/SP1
    _________2K/SP4; IE6/SP1
    ________________________________________________________________________________
    »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
    -----END------
    Mon 16 Aug 04 14:00:37
    

    hope this helps!
    and thanks again!
    jj
     
  13. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Be sure to Follow the next set of steps carefully, in the exact order specified.

    ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***

    Get ready to restart:
    First doubleClick on the FIX.bat file in the C:\FINDnFIX\Keys1 folder.
    Wait for the popup -Alert to restart your computer in 15 seconds.

    After the computer restarts and you are back in Windows, navigate to C:\Windows\System32 folder:
    Locate and select the D3DC.DLL file (as it will be visible)
    And use the folder's top menu and got to Edit >
    Move to Folder...
    Select the C:\FINDnFIX\junkxxx as destination and move
    the D3DC.DLL there.

    Note; Move the D3DC.DLL file and DO NOT move any other file except for that one to the junkxxx folder. Doublecheck to be sure you are moving the right file.
    -----------------------------------------------------------------------------------------------------------

    Now look in the C:\FINDnFIX folder and locate the RESTORE.bat file. Doubleclick it to run it.

    Wait for it to run and it will and it will produce a 'log1.txt' file! Copy that log and paste it here!

    -----------------------------------------------------------------------------------------------------------

    *Note:
    Do not change/move around or
    tamper with any of the file(s) folder(s) and path
    included in the 'FINDnFIX' folder.
     
  14. JØhnöJÖhn

    JØhnöJÖhn Thread Starter

    Joined:
    Apr 27, 2004
    Messages:
    8
    here ya go.
    did it just like you said except my sys32 file was in winnt folder.
    but it all seemed to work just like you said it would.
    {by the way... is there a problem with me operating this in an everyone admin format? that might need to be changed to me admin and operate
    under a restricted nom. just feels like that might be the prudent route in the future. should be able to restrict who changes what in the future. "ounce of prevention = a £ of cure." please advise.

    and Thanks!
    jj


    log follows:.....




    Mon 16 Aug 04 22:35:27

    »»»»»»»»»»»»»»»»»»***LOG2!(*updated *8/16)***»»»»»»»»»»»»»»»»

    *System:
    Microsoft Windows 2000 Professional 5.0 Service Pack 4 (Build 2195)
    *IE version:
    6.0.2800.1106 SP1-Qxxxxxx-Qxxxxxx-Qxxxxxx-Qxxxxxx-Qxxxxxx

    The type of the file system is NTFS.

    ___________________________________________
    !!Restoring backups!!

    The operation completed successfully
    ___________________________________________

    *Local time:
    Monday, August 16, 2004 (8/16/2004)
    10:35 PM, Eastern Daylight Time
    *Uptime:
    22:35:28 up 0 days, 0:06:19

    ------------------------------------------


    This log will confirm if the file was successfully moved, and/or
    the right file was selected...

    Scanning for file(s) in System32...

    »»»»»»» (1) »»»»»»»

    »»»»»»» (2) »»»»»»»

    »»»»»»» (3) »»»»»»»

    No matches found.
    Unknown/hidden files...

    C:\WINNT\SYSTEM32\
    advapi32.dll Tue Mar 23 2004 10:17:00p A..H. 388,368 379.27 K
    basesrv.dll Tue Mar 23 2004 10:17:02p A..H. 42,256 41.27 K
    browser.dll Tue Mar 23 2004 10:17:02p A..H. 69,904 68.27 K
    cdral.dll Fri Apr 16 2004 11:50:10p A..H. 45,056 44.00 K
    cdrtc.dll Fri Apr 16 2004 11:50:10p A..H. 49,152 48.00 K
    crypt32.dll Tue Mar 23 2004 10:17:00p A..H. 543,504 530.77 K
    cryptnet.dll Tue Mar 23 2004 10:17:02p A..H. 61,200 59.77 K
    cryptsvc.dll Tue Mar 23 2004 10:17:02p A..H. 76,048 74.27 K
    dnsapi.dll Tue Mar 23 2004 10:17:00p A..H. 134,928 131.77 K
    dnsrslvr.dll Tue Mar 23 2004 10:17:02p A..H. 92,432 90.27 K
    dplayx.dll Wed Apr 14 2004 2:56:46p A..H. 219,648 214.50 K
    dpwsockx.dll Mon Apr 12 2004 11:11:26p A..H. 76,800 75.00 K
    eventlog.dll Tue Mar 23 2004 10:17:02p A..H. 47,888 46.77 K
    gdi32.dll Tue Mar 23 2004 10:17:02p A..H. 242,448 236.77 K
    ipnathlp.dll Tue Mar 23 2004 10:17:02p A..H. 442,640 432.27 K
    itss.dll Tue Jun 22 2004 6:42:32p A..H. 123,392 120.50 K
    kernel32.dll Tue Mar 23 2004 10:17:04p A..H. 742,160 724.77 K
    mf3216.dll Tue Mar 23 2004 10:17:02p A..H. 37,136 36.27 K
    mpr.dll Tue Mar 23 2004 10:17:02p A..H. 54,544 53.27 K
    msasn1.dll Tue Mar 23 2004 10:17:00p A..H. 53,520 52.27 K
    msgina.dll Tue Mar 23 2004 10:17:00p A..H. 335,120 327.27 K
    mstask.dll Thu Jun 10 2004 12:58:12p A..H. 216,848 211.77 K
    netapi32.dll Thu Jun 10 2004 12:58:12p A..H. 309,008 301.77 K
    netlogon.dll Tue Mar 23 2004 10:17:02p A..H. 371,472 362.77 K
    ntdll.dll Tue Mar 23 2004 10:17:04p A..H. 497,936 486.27 K
    ntdsa.dll Tue Mar 23 2004 10:17:02p A..H. 1,028,880 1004.77 K
    psbase.dll Tue Mar 23 2004 10:17:02p A..H. 115,984 113.27 K
    samlib.dll Tue Mar 23 2004 10:17:04p A..H. 49,936 48.77 K
    samsrv.dll Tue Mar 23 2004 10:17:02p A..H. 388,368 379.27 K
    scecli.dll Tue Mar 23 2004 10:17:02p A..H. 111,376 108.77 K
    scesrv.dll Tue Mar 23 2004 10:17:02p A..H. 253,200 247.27 K
    sfcfiles.dll Tue Mar 23 2004 10:17:04p A..H. 971,536 948.77 K
    shell32.dll Wed May 19 2004 7:10:10p A..H. 2,358,544 2.25 M
    sp3res.dll Sun May 16 2004 3:43:54p ...H. 5,873,664 5.60 M
    umandlg.dll Fri May 21 2004 11:33:20p A..H. 27,920 27.27 K
    user32.dll Tue Mar 23 2004 10:17:00p A..H. 403,216 393.77 K
    w32time.dll Tue Mar 23 2004 10:17:02p A..H. 50,960 49.77 K
    wintrust.dll Tue Mar 23 2004 10:17:02p A..H. 167,184 163.27 K

    38 items found: 38 files, 0 directories.
    Total of file sizes: 17,074,176 bytes 16.28 M

    »»»»»»» (4) »»»»»»»
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINNT\SYSTEM32\ADVAPI32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\BASESRV.DLL
    Sniffed -> C:\WINNT\SYSTEM32\BROWSER.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CDRAL.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CDRTC.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CRYPT32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CRYPTNET.DLL
    Sniffed -> C:\WINNT\SYSTEM32\CRYPTSVC.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DNSAPI.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DNSRSLVR.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DPLAYX.DLL
    Sniffed -> C:\WINNT\SYSTEM32\DPWSOCKX.DLL
    Sniffed -> C:\WINNT\SYSTEM32\EVENTLOG.DLL
    Sniffed -> C:\WINNT\SYSTEM32\GDI32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\IPNATHLP.DLL
    Sniffed -> C:\WINNT\SYSTEM32\ITSS.DLL
    Sniffed -> C:\WINNT\SYSTEM32\KERNEL32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MF3216.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MPR.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MSASN1.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MSGINA.DLL
    Sniffed -> C:\WINNT\SYSTEM32\MSTASK.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NETAPI32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NETLOGON.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NTDLL.DLL
    Sniffed -> C:\WINNT\SYSTEM32\NTDSA.DLL
    Sniffed -> C:\WINNT\SYSTEM32\PSBASE.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SAMLIB.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SAMSRV.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SCECLI.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SCESRV.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SFCFILES.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SHELL32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\SP3RES.DLL
    Sniffed -> C:\WINNT\SYSTEM32\UMANDLG.DLL
    Sniffed -> C:\WINNT\SYSTEM32\USER32.DLL
    Sniffed -> C:\WINNT\SYSTEM32\W32TIME.DLL
    Sniffed -> C:\WINNT\SYSTEM32\WINTRUST.DLL
    SNiF 1.34 statistics

    Matching files : 38 Amount in bytes : 17074176
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»»»(5)»»»»»

    »»»»»(6)»»»»»

    »»»»»»» Search by size And Date...

    *List of files specs according to size:
    *Note: Not all files listed here are infected!
    ____________________________________________________________________________
    Path: C:\WINNT\SYSTEM32 Including: *.DLL

    946. Vuins32 Dll 57,344 . . . . A 7-22-04 5:28 pm

    ____________________________________________________________________________

    C:\WINNT\SYSTEM32\
    vuins32.dll Thu Jul 22 2004 5:28:02p A.... 57,344 56.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 57,344 bytes 56.00 K

    No matches found.

    No matches found.

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINNT\SYSTEM32\VUINS32.DLL
    SNiF 1.34 statistics

    Matching files : 1 Amount in bytes : 57344
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    SNiF 1.34 statistics

    Matching files : 0 Amount in bytes : 0
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    SNiF 1.34 statistics

    Matching files : 0 Amount in bytes : 0
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

    BHO search...



    No matches found.


    "C:\FINDnFIX\"
    jlncgaaa.tmp Apr 27 2004 36864 "jlncgaaa.tmp"

    1 item found: 1 file, 0 directories.
    Total of file sizes: 36,864 bytes 36.00 K

    ---***BHO uninstalled!***--

    Source: C:\WINNT\system32\idf.dll
    *** Source file lookup error: Target: DELETE
    *** Source file lookup error: Target: DELETE

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

    »»»*»»» Scanning for moved file... »»»*»»»

    * result\\?\C:\FINDNFIX\JUNKXXX\D3DC.333


    C:\FINDNFIX\JUNKXXX\
    d3dc.333 Sat Apr 24 2004 10:36:42p A.... 57,344 56.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 57,344 bytes 56.00 K

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\FINDNFIX\JUNKXXX\D3DC.333
    SNiF 1.34 statistics

    Matching files : 1 Amount in bytes : 57344
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.*

    **File C:\FINDNFIX\JUNKXXX\D3DC.333
    0000DEBE: 67 44 65 76 69 63 65 00 . 00 53 74 72 65 61 6D 69 gDevice. .Streami
    0000DED3: 63 65 53 65 74 75 70 00 . 32 00 00 00 00 00 E0 01 ceSetup. 2.....à.

    A----- D3DC .333 0000E000 22:36.42 24/04/2004

    Analyzer v1.36 by Boogie Copyright (C) 1997 ESP Team
    Files: C:\FINDNFIX\JUNKXXX\*.*
    Ä
    D3DC.333 MS Windows 95 / Windows NT Exe
    Ä


    Volume: None * DDIR * 10:35 pm | Mon, 8-16-04
    Ser #: AC5E-47C0 DOS Ver. 5.00 0% Used space
    Path: C:\FINDNFIX\JUNKXXX All files selected

    1. D3dc 333 57,344 . . . . A 4-24-04 10:36 pm

    No. of files: 1 | List size: 57,344
    Disk size: 976.5 M | Actual spc: 65,024
    Bytes free: 976.5 M | Wasted space: 7,680

    --a-- W32i - - - - 57,344 04-24-2004 d3dc.333
    A C:\FINDnFIX\junkxxx\d3dc.333

    CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock.
    MD5 Message Digest Algorithm by RSA Data Security, Inc.

    File name Size Date Time MD5 Hash
    ________________________________________________________________________
    D3DC.333 57344 04-24-104 22:36 c185b36f9969d3a6d2122ba7cbc02249

    CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk

    C:\FINDNFIX\JUNKXXX
    D3DC.333 : crc16=3138 crc32=D5C9FB2E

    File: <C:\FINDnFIX\junkxxx\d3dc.333>

    CRC-32 : D5C9FB2E

    MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249




    #######################################################
    *Known files are...
    --------------------
    File: ((56k; (57,344 bytes)
    CRC-32 : D5C9FB2E
    MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249
    --------------------
    File: ((35k; (35,840 bytes)
    CRC-32 : 33081C8B
    MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE
    --------------------
    File: ((21k; (21,504 bytes)
    CRC-32 : 2258F59E
    MD5 : EFEE2CB3 B342A351 51802356 9637F8E6
    #######################################################
    »»Permissions:
    C:\FINDnFIX\junkxxx\d3dc.333 Everyone:(OI)(CI)F
    NT AUTHORITY\SYSTEM:(OI)(CI)F
    BUILTIN\Administrators:(OI)(CI)F
    NT AUTHORITY\SYSTEM:F
    BUILTIN\Administrators:F
    Everyone:F

    Directory "C:\FINDnFIX\junkxxx\."
    Permissions:
    Type Flags Inh. Mask Gen. Std. File Group or User
    ======= ======== ==== ======== ==== ==== ==== ================
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000002 tc-- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000009 --o- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000002 tc-- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000009 --o- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000013 tco- 001F01FF ---- DSPO rw+x \Everyone

    Owner: BUILTIN\Administrators

    Primary Group: JOHN-CV0K7ZWYL6\None

    Directory "C:\FINDnFIX\junkxxx\.."
    Permissions:
    Type Flags Inh. Mask Gen. Std. File Group or User
    ======= ======== ==== ======== ==== ==== ==== ================
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x \Everyone

    Owner: BUILTIN\Administrators

    Primary Group: JOHN-CV0K7ZWYL6\None

    File "C:\FINDnFIX\junkxxx\d3dc.333"
    Permissions:
    Type Flags Inh. Mask Gen. Std. File Group or User
    ======= ======== ==== ======== ==== ==== ==== ================
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x \Everyone
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x \Everyone

    Owner: BUILTIN\Administrators

    Primary Group: JOHN-CV0K7ZWYL6\None

    C:\FINDnFIX\junkxxx\d3dc.333;Everyone:F
    C:\FINDnFIX\junkxxx\d3dc.333;NT AUTHORITY\SYSTEM:F
    C:\FINDnFIX\junkxxx\d3dc.333;BUILTIN\Administrators:F
    C:\FINDnFIX\junkxxx\d3dc.333;NT AUTHORITY\SYSTEM:F
    C:\FINDnFIX\junkxxx\d3dc.333;BUILTIN\Administrators:F
    C:\FINDnFIX\junkxxx\d3dc.333;Everyone:F



    »»Size of Windows key:
    (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

    Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450

    »»Checking for AppInit_DLLs (empty) value...
    ________________________________
    !"AppInit_DLLs"=""!

    Value Matches
    ________________________________

    »»Dumping Values:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710
    AppInit_DLLs =

    »»Security settings for 'Windows' key:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    (NI) ALLOW Read BUILTIN\Users
    (IO) ALLOW Read BUILTIN\Users
    (NI) ALLOW Read BUILTIN\Power Users
    (IO) ALLOW Read BUILTIN\Power Users
    (NI) ALLOW Full access BUILTIN\Administrators
    (IO) ALLOW Full access BUILTIN\Administrators
    (NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (NI) ALLOW Full access BUILTIN\Administrators
    (IO) ALLOW Full access CREATOR OWNER

    Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    Read BUILTIN\Users
    Read BUILTIN\Power Users
    Full access BUILTIN\Administrators
    Full access NT AUTHORITY\SYSTEM



    00001150: ?
    00001190: H
    000011D0: vk , DeviceNotSelectedTimeout 1 5 `
    00001210: vk ' A GDIProcessHandleQuota t vk
    00001250: p \ Spooler Reason y e s s i vk
    00001290: a swapdisk vk d TransmissionRetryTimeout
    000012D0: 9 0 ` vk ' s USERProcessHandleQuota
    00001310: vk a AppInit_DLLsT i
    00001350:
    00001390: d , l x \
    000013D0:y L z < 8 (
    00001410:
    00001450:
    00001490: < < < < < < .
    000014D0:
    00001510:
    00001550:

    ---------- NEWWIN.TXT
    AppInit_DLLsT
    --------------
    --------------
    $011E8: DeviceNotSelectedTimeout
    $01230: GDIProcessHandleQuota
    $012B8: TransmissionRetryTimeout
    $012F8: USERProcessHandleQuota
    $01328: AppInit_DLLsT
    --------------
    --------------
    C:\FINDnFIX\Files2\xcacls.exe

    d...a 0 Aug 16 22:35 .
    d...a 0 Aug 16 22:35 ..
    ....a 57344 Apr 24 22:36 d3dc.333

    3 files found occupying 55296 bytes

    -------- C:\FINDNFIX\JUNKXXX\D3DC.333
    InstallStreamingDeviceStreamingDeviceSetupStreamingDeviceSetup2
    ===============================================================================
    57,344 bytes 5,734,400 cps
    Files: 1 Records: 13,139 Matches: 3 Elapsed Time: 00:00:00.01

    VDIR v1.00
    Path: C:\FINDNFIX\JUNKXXX\*.*
    ---------------------------------------+---------------------------------------
    . <dir> A 08-16-:4 22:35|D3DC 333 57344 A 04-24-:4 22:36
    .. <dir> A 08-16-:4 22:35|
    ---------------------------------------+---------------------------------------
    3 files totaling 57344 bytes consuming 65024 bytes of disk space.
    17299968 bytes available on Drive C: No volume label

    ...File dump...

    junkxxx\d3dc.333
    1 file(s) copied.
    56880 00000000 4b45524e 454c3332 2e444c4c |....KERNEL32.DLL| 0de30
    56896 00004c6f 61644c69 62726172 79410000 |..LoadLibraryA..| 0de40
    56912 47657450 726f6341 64647265 73730000 |GetProcAddress..| 0de50
    56928 00000000 00000000 00000000 a6f00100 |................| 0de60
    56944 01000000 03000000 03000000 88f00100 |................| 0de70
    56960 94f00100 a0f00100 05270000 9a230000 |.........'...#..| 0de80
    56976 242a0000 a7f00100 bef00100 d3f00100 |$*..............| 0de90
    56992 00000100 02000049 6e737461 6c6c5374 |.......InstallSt| 0dea0
    57008 7265616d 696e6744 65766963 65005374 |reamingDevice.St| 0deb0
    57024 7265616d 696e6744 65766963 65536574 |reamingDeviceSet| 0dec0
    57040 75700053 74726561 6d696e67 44657669 |up.StreamingDevi| 0ded0
    57056 63655365 74757032 |ceSetup2 | 0dee0

    Detecting...

    C:\FINDnFIX\junkxxx
    d3dc.333 ACL has 6 ACE(s)
    SID = /Everyone S-1-1-0
    ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
    ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
    SID = NT AUTHORITY/SYSTEM S-1-5-18
    ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
    ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
    SID = BUILTIN/Administrators S-1-5-32-544
    ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
    ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
    SID = NT AUTHORITY/SYSTEM S-1-5-18
    ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
    ACE 3 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
    SID = BUILTIN/Administrators S-1-5-32-544
    ACE 4 is an ACCESS_ALLOWED_ACE_TYPE
    ACE 4 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
    SID = /Everyone S-1-1-0
    ACE 5 is an ACCESS_ALLOWED_ACE_TYPE
    ACE 5 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
    ACL done...


    Finished Detecting...
    ________________________________________________________________________________
    ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
    AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
    MINIMAL REQUIREMENTS INCLUDE:
    _________XP HOME/PRO; SP1; IE6/SP1
    _________2K/SP4; IE6/SP1
    ________________________________________________________________________________
    »»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»
    Mon 16 Aug 04 22:35:54
    -----END-----
    
     
  15. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    -Open the FINDnFIX\Files2< Subfolder:
    Run the -> ZIPZAP.bat file.
    It will quickly clean the rest and
    will make a copy of the bad file(s) in the same
    folder (junkxxx.zip) and open your email client with instructions:
    Simply drag and drop the 'junkxxx.zip' file from
    the folder into the mail message and submit
    to the specified addresses! Thanks!

    Note: If you encounter an error trying to email the file, just skip it and move on.

    When done, restart your computer and
    Delete and entire C:\FINDnFIX folder and its subfolders
    and be sure the junkxxx folder
    was deleted (as part of the cleanup process)


    Click here to download CWShredder. Close all browser windows,UnZip the file, click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.

    When it is finished restart your computer.



    Go here and download Adaware SE.

    Install the program and launch it.

    First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

    From main window :Click Start then under Select a scan Mode tick Perform full system scan.

    Next deselect Search for negligible risk entries.

    Now to scan just click the Next button.

    When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

    Restart your computer.

    Come back here and post another Hijack This log and we'll get rid of what's left.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/224449

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice