Is something blocking me from HTML or the internet?

Scottie,

All you need to do is follow forum guidelines and read the Announcement and the sticky threads. Has you followed them you would not be using an old version of HijackThis and you would not be posting a HijackThis log without being asked to post it, and you would not be posting it inline. Here is what you need to do:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

Okay see if you can get the current version of HijackThis ( HijackThis 1.99.1 ) onto the problem PC. This will fit on to a floppy disk assuming you have a floppy drive. If you cannot even do that, it may make things difficult since the newe versions are much better at finding and fixing problems. If you cannot do that, just tell me why and then use whatever version you do have and post a new HJT log from normal boot mode!

 

Please read my instructions for installing and using HijackThis again. You installed exactly where I asked you not to install it. That is, on your Desktop.
C:\Documents and Settings\Scott\Desktop\New Folder\HijackThis.exe

Please install it properly.

Did you install this C:\WINDOWS\system32\DLLBOOT.EXE
Is it some kind of key generator? If you do not know what it is, make sure you tell me.
I would normally just request that an item that looks like this be removed immediately.

 

Please download this: ABIremover

Unzip it into its own folder. Now boot into safe mode with no network support and do not open any browsers. Now run the the ABIremover.exe file.

When done reboot into normal mode and follow the steps below. Some items may no longer be present so just ignore them and continue with all steps.

Since I'm not sure at this point if the DLLBoot.exe program is something you know about, I'm leaving it out of the cleanup steps for now.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\system32\system33r.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\scrss.exe
C:\PROGRA~1\INTERN~2\mum.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
F2 - REG:system.ini: Shell=explorer.exe system33r.exe
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O3 - Toolbar: Find - {8D029AEC-E412-4948-84B5-699A740946AE} - %SystemRoot%\System32\iefind.dll (file missing)
O4 - HKLM\..\Run: [Microsoft Wininit (System33r)] system33r.exe
O4 - HKLM\..\Run: [Video Driver Loading Service] scrss.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\system32\msmsgs.exe
O4 - HKLM\..\RunServices: [Microsoft Wininit (System33r)] system33r.exe
O4 - HKLM\..\RunServices: [Video Driver Loading Service] scrss.exe
O4 - HKCU\..\Run: [InternodeUsage] C:\PROGRA~1\INTERN~2\mum.exe
O4 - HKCU\..\Run: [Video Driver Loading Service] scrss.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/277f1eed352bc8d8d414/netzip/RdxIE601.cab
After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\system32\system33r.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\scrss.exe
C:\Program Files\INTERN~2\mum.exe
C:\WINDOWS\system32\msmsgs.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working. Can you download now? If so, try running the online scanners from the READ ME FIRST.

 

Bad idea. The Desktop is not safe from improper deletions and other user accounts do not have access to your desktop. C:\Documents and Settings is a place to store documents and settings. It is not a place to store programs. That is what C:\Program Files is for. Putting it where we recommend removes those issues.

Add the C:\WINDOWS\system32\DLLBOOT.EXE stuff to the list of things to fix. Kill the process, fix the lines in HJT and delete the file in safe mode.

 

Try using the msconfig method to boot to safe mode (you also will need to un-do it later to get out of safe mode). See this and select your OS:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam

If that does not work, do everything in normal boot mode and tell me what results you get on the deletions.

 

Yes you can reinstall mum.exe but it seems like it is aleady running based on your HJT log.

You should uninstall Messenger Plus! 2. It is can install a load of malware onto your PC and is the kind of software that cannot be trusted.

I would also uninstall PCDoctor Online (O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe ) unless you buy it, it is of no use. Not very useful anyway.


You never moved HJT to the proper folder and you are still forgetting to exit your browser before running HijackThis. You still have a problems. Stuff that I requested to be fixed is still there.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
F2 - REG:system.ini: Shell=explorer.exe system33r.exe
O3 - Toolbar: Find - {8D029AEC-E412-4948-84B5-699A740946AE} - %SystemRoot%\System32\iefind.dll (file missing)
O4 - HKLM\..\Run: [Microsoft Wininit (System33r)] system33r.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Configuration Default] WUXAT.EXE
O4 - HKLM\..\RunServices: [Microsoft Wininit (System33r)] system33r.exe
O4 - HKCU\..\Run: [Power2GoExpress] WUXAT.EXE

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
c:\windows\system32\system33r.exe
c:\windows\system32\WUXAT.EXE
C:\Program Files\WildTangent <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file. Let me know if you have any problems finding or deleting any of these files/folders.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Since you can download now, you should try running the Trend Micro online scanner from the READ ME FIRST.

 

Now you are clean! To help keep it that way, make sure you follow the steps in the below thread:

How to Protect yourself from malware!

 

You're welcome. Happy I could help!