MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: c1dcon.d8t.biz on Windows 2000 system
June 05, 2020, 12:08:49 AM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
June 05, 2020, 12:08:49 AM

Login with username, password and session length
 Featured Sites:
News
Help us help you! Help us help you by helping out! The more people know about us, the more help will be available. Click here to find out how...
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: c1dcon.d8t.biz on Windows 2000 system  (Read 3005 times)
paulrye
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« on: July 09, 2004, 09:40:32 PM »

Operating System: Windows 2000 SP4 (WinNT 5.00.2195)
Problem Application: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Problem Hardware Make & Model: Dell Inspiron 2000

Hi Benditup,

This is my second post.  My first post is at the bottom of the thread: All Forums/INTERNET & NETWORK SUPPORT/Security & Viruses/c1dcon.d8t.biz.  There, you helped "Sander" with c1dcon on a Windows XP system, and I posted at the end, asking how to fix my wife's Windows 2000 computer.  My wife was anxious to use her computer yesterday for her business, and the problem was affecting her email program.  She couldn't delete or created and send new email using Yahoo Mail.  So, I went ahead and tried to fix the problem using guidance you provided to "Sander".  The good news is that there was some improvement; she can use her email again.  The bad news is that some part of the virus is still active.

Here's what I did:
1. Set Windows to show hidden files and folders.
2. Restarted Windows 2000 in SAFE MODE.
3. Could not find the c:\WINDOWS (I looked under WINNT) or c:\Program Files files or folders that you told Sander to delete.
4. Did another scan with HijackThis. Put a check next to these files and ran FIX CHECKED:
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
5. Ran CWSHREDDER and let it fix all problems.
6. Restarted computer in Normal mode.
7. Accessed Internet Options via Control Panel, under Programs tab "Reset Web Settings".
8. Under the General tab, deleted files + offline content, and Reset home page.
9. Did a Disk Cleanup, using "cleanmgr".

After the changes, I shut down and restarted the computer.  I tried running Explorer under Earthlink 2004.  It started up with about:blank and a blank page.  I reset the home page to my Earthlink start page, and it worked OK after that.  Yahoo Mail works again; I could delete old emails.  But, I did start getting some popups again, not an endless stream, just two or three.  After closing Explorer and Earthlink, I got even more popups.  When I tried to shutdown the computer, I even got popups when I clicked on the Windows Start button.  Some part of the virus is still on the computer!

Here is a current HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 2:34:34 PM, on 7/9/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINNT\system32\dexl32o.exe
C:\WINNT\system32\ios1b.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\notepad.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {9E992732-295F-4987-8BE3-16FAC1639198} - C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.dll
O2 - BHO: (no name) - {D77BF074-728C-407E-947C-E37792850F04} - C:\WINNT\system32\llika.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [gfwxwewix] C:\WINNT\system32\rglcxfe.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [dnsbak] C:\WINNT\Config\dnsbak.exe
O4 - HKLM\..\Run: [dexl32o] C:\WINNT\system32\dexl32o.exe
O4 - HKLM\..\Run: [ios1b] C:\WINNT\system32\ios1b.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [dpmodemx] C:\WINNT\system32\dpmodemx.exe
O4 - HKCU\..\Run: [\IEService.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {1DF36010-E276-11D4-A7C0-00C04F0453DD} (Stamps.com Secure Postal Account Registration) - https://secure.stamps.com/download/us/registration/3_0_0_786/sdcregie.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) - http://www.imagestation.com/common/classes/batchdwnl.cab?version=4,3,2,20802
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37878.6512037037
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/mail/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

If I try to do anything else without help, I might just make things worse, so please help!
Logged

Paul Rye
paulrye
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« Reply #1 on: July 11, 2004, 04:26:12 AM »

Hi Benditup,

I tried the following recommendations that you made for "Rage":

1. Went to http://housecall.trendmicro.com/ and tried to run the antivirus scan, but I could not complete the download initiated by housecall.  When the download failed, Internet Explorer shut down, and I got more popups, including another download offer, "Do you want to install and run "Free Browser Plugin...", CPM Media, Ltd?"  I declined.

2. I updated Ad-Aware and did a custom scan according the "gear heel" options you recommended to Rage:  
General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"
Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."
Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."
Click "Proceed" to save your settings, then click "Start", make sure
"Activate in-depth scan" is ticked green then scan your system.

3. The custom scan found many, many more problems in the registry than before, and identified many of them as being caused by CoolWebSearch.  I selected everything found by Ad-Aware and removed them.
4. I restarted the computer and ran Ad-Aware again.  It found a few more things and I removed them, too.
5. I restarted the computer and ran Ad-Aware again.  It found nothing.
6. Accessed Internet Options via Control Panel, under Programs tab "Reset Web Settings".
7. Under the General tab, deleted files + offline content, and Reset home page.
8. Did a Disk Cleanup, using "cleanmgr".

Thought I had it all cleaned up, but these popups started coming back whenever I closed Internet Explorer.  I'm beginning to think that the CoolWebSearch problem is fixed, but there is more than one problem on this computer causing popups.

I did right mouse clicks on the popups and checked "Properties".  The popups were always associated with these five URLs:
http://www.manipulelasuperficiedelhielo.com/go.php?l=0003
http://c.azjmp.com/az/ch.php?f=662&i=315&sub=Invscreen
http://www.xzoomy.com/stc2.php?stid=036
http://ads.ad-flow.com/ad.service?CUSTOMER=122&CAMPAIGN=45&CONTENT=1441
http://www.undergroundlair.net/adview.php?what=zone:13&source=0003&n=a8ec1933

I found a website, http://www.pchell.com/support/xzoomy.shtml, that directed me to an uninstaller for the program causing the xzoomy popup.  After I ran it, I haven't gotten any more xzoomy popups, yet.
I can't find any free fixes for the manipulelasuperficiedelhielo, although there are references to the problem on the Internet.

I ran a text search to find "manipulelasuperficiedelhielo" anywhere on my hard drive and found it in the following files:
c:\WINNT\system32\log.bak
c:\WINNT\system32\fiz0
c:\WINNT\system32\fiz1
c:\WINNT\system32\fiz2
c:\WINNT\system32\fiz3
c:\WINNT\system32\fiz4
c:\WINNT\system32\fiz6
c:\WINNT\system32\fiz7
c:\WINNT\system32\fiz8
c:\WINNT\system32\fiz10
c:\WINNT\system32\fiz12
c:\WINNT\system32\fiz13
c:\WINNT\system32\fiz15
c:\WINNT\system32\fiz16
c:\WINNT\system32\fiz19
c:\Documents and Settings\All Users\Documents\DrWatson\user.dump\
c:\Documents and Settings\Administrator\Local Settings\Temp\EML22.tmp
c:\Documents and Settings\Administrator\Local Settings\Temp\Temporary
Internet Files\Content.IE5\Index
c:\Documents and Settings\Administrator\Application
Data\Earthlink\6.0\paulbeckyrye@earthlink.net\mailbox\ElnkMail

I know next to nothing about these files.  Any ideas on how to get rid of manipulelasuperficiedelhielo?


Here is my current HijackThis logfile:

Logfile of HijackThis v1.97.7
Scan saved at 9:04:19 PM, on 7/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\WINNT\system32\vfsrci.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\WINNT\system32\lackboxb.exe
C:\WINNT\system32\notepad.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://www.earthlink.net/partner/more/msie/button/search.html
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {8A97AB83-8A94-4F83-B731-04BD47009EB2} -
c:\winnt\system32\llika.dll (file missing)
O2 - BHO: (no name) - {9E992732-295F-4987-8BE3-16FAC1639198} -
C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} -
C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common
Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [gfwxwewix] C:\WINNT\system32\rglcxfe.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware
6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [dnsbak] C:\WINNT\Config\dnsbak.exe
O4 - HKLM\..\Run: [vfsrci] C:\WINNT\system32\vfsrci.exe
O4 - HKLM\..\Run: [lackboxb] C:\WINNT\system32\lackboxb.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [dpmodemx] C:\WINNT\system32\dpmodemx.exe
O4 - HKCU\..\Run: [\IEService.exe]
C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink
TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony
Handheld\HOTSYNC.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program
Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program
Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program
Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program
Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} -
http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
- http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {1DF36010-E276-11D4-A7C0-00C04F0453DD} (Stamps.com Secure Postal Account Registration) - https://secure.stamps.com/download/us/registration/3_0_0_786/sdcregie.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus
scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} (ZingBatchAXDwnl Class) -http://www.imagestation.com/common/classes/batchdwnl.cab?version=4,3,2,20802
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37878.6512037037
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/mail/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Logged

Paul Rye
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #2 on: July 11, 2004, 05:15:34 AM »

Hi paul
Uninstall SpywareBegone, it's bogus, can cause more problems than help
out

Can you set windows to show hidden files and folders
* Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading select Show hidden files and folders.
    * Uncheck the Hide protected operating system files (recommended) option.
    * Click Yes to confirm.
    * Click OK.

Navigate to these files and let me know what they are related too
I'm quite sure they are all baddies, I want to be sure
C:\WINNT\system32\lackboxb.exe <---this file---I didn't see this one in your first log
C:\WINNT\system32\rglcxfe.exe <---this file
C:\WINNT\Config\dnsbak.exe <---this file
C:\WINNT\system32\dexl32o.exe<---this file


Right click on them----left click properties---version
What are they related too?
Please submit them to Kapersky for a free virus scan
http://www.kaspersky.com/scanforvirus
Simply navigate to them by clicking the "browse" button
Right click---select--- then "Submit"

We will remove them for now unless you know what they are......
We'll empty the recycle bin later

Do another Scan with Hijackthis and put a check next to these entries and then FIX CHECKED when ALL other windows are closed

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {9E992732-295F-4987-8BE3-16FAC1639198} - C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.dll

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [gfwxwewix] C:\WINNT\system32\rglcxfe.exe
O4 - HKLM\..\Run: [dnsbak] C:\WINNT\Config\dnsbak.exe
O4 - HKLM\..\Run: [dexl32o] C:\WINNT\system32\dexl32o.exe
O4 - HKLM\..\Run: [lackboxb] C:\WINNT\system32\lackboxb.exe

O4 - HKCU\..\Run: [\IEService.exe]
C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe

O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan

O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} -
http://down.plaxo.com/down/release/instub.cab

RESTART your computer in Safe Mode

Find and delete these files and folders if found
C:\WINNT\system32\rglcxfe.exe
C:\WINNT\Config\dnsbak.exe
C:\WINNT\system32\dexl32o.exe
C:\WINNT\system32\lackboxb.exe
The above 4 files if unknown or found bad by Kapersky

C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe <--this file

c:\freescan <---this folder

RESTART your computer in Normal Mode

Download and Install the free version of Ad-Aware
CHECK FOR UPDATES
Set these
click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

RESTART your computer again
If you can, could you now try and run the virus scan at Housecall's and/or try one here at Panda's
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Post back with a Fresh hijackthis log

Could you also Download and Install
FindnFix.exe

Run the "!LOG!.bat" file, wait for the final output (log.txt)
Attach the output log please---Just click on Insert File Attachment
and browse and select it for upload
« Last Edit: July 11, 2004, 05:17:07 AM by benditup » Logged

 
paulrye
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« Reply #3 on: July 12, 2004, 05:59:34 AM »

Hi Benditup,

Neither SpywareBegone or Freescan appeared in my list of installed
programs.  There was a folder called c:\Freescan and it contained a
configuration settings file called Spyware begone.  There was also a shortcut
c:\Documents and Settings\Administrator\Recent\Freescan.  I deleted
both the Freescan folder and the shortcut.

The files you asked me to investigate were:
C:\WINNT\system32\lackboxb.exe <---this file---I didn't see this one in
your first log
C:\WINNT\system32\rglcxfe.exe <---this file
C:\WINNT\Config\dnsbak.exe <---this file
C:\WINNT\system32\dexl32o.exe<---this file
Unfortunately, I can
Logged

Paul Rye
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page November 21, 2018, 03:43:05 AM