Can't get rid of D_4362.dll

I've somehow gotten the file D_4362.dll in C:\Program Files\Common Files\System , and I can't get rid of it. I delete it, but then when I restart it's there again, so there's obviously something still in my system that's putting it there. But I have no idea what. And it's hijacking my browser. So could someone help?

I've attached my files. AVG AntiSpyware said there's no report available. Hopefully I didn't screw it up. It did fix some things, but they were all medium and low importance.

I've deleted D_4362.dll through Hijack This also, and that didn't do any more good.

I'll really appreciate it if someone can tell me how to get rid of this thing! :confused

TIA!

Leigh

 

Hi Sk8ie!
Welcome to Major Geeks!

I'm taking a look at your logs. This can take some time.

You have both McAfee and Symantec running. You MUST get rid of one of them immediately! Here are removal tools for each. Please choose the one you want to keep and run the removal tool for the other one:
McAfee Consumer Product Removal Tool (SymNRT)

If you choose to remove Symantec rather than McAfee, please empty the Norton Antivirur Quarantine before you run the removal tool, as you need the software installed in order to empty the quarantine.
Removing Files from Norton Antivirus Quarantine
Norton Removal Tool (SymNRT)

abri

 

Hi Sk8ie!

After you've removed the antivirus you don't want to keep as per the instructions in post #2, please do the following:

1) Go to add/remove programs and uninstall the below:

- - Java 2 Runtime Environment, SE v1.4.2_03

2) Reboot after uninstalling the above.

3) Install the current version of Sun Java from: Sun Java Runtime Environment

4) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger


5) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {FDEA2C12-A476-A13C-2B4C-A3BD546315C2} - C:\PROGRA~1\COMMON~1\System\D_4362.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bejeweled2/sis/popcaploader_v10.cab

If you don't recognize this, fix it as well:
O8 - Extra context menu item: Send Image to Phone - http://www.freeringers.net/ezimage.php

Don't forget to close all browser windows before clicking on fix. After you click fix, just close hijackthis.

6) Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

7) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip

Let me know how things are running now?

abri

 

I don't think I actually have Norton installed. I might have at the beginning and uninstalled it, or it might be the Norton Ghost thing that I have. But AFAIK I'm only using McAfee. I'm still looking into it, but are you sure that I have Norton Antivirus by what you're seeing?

And thank you so much for helping me!

 

Thanks!

I don't think I had Norton Antivirus, so I wasn't able to empty the Quarantine, but I did uninstall all of the Norton products.

I did all of this.

I don't use Windows Messenger, so I removed it.

I fixed all of the things you listed.

Except I do actually use this, so I left it.

Did this, and attached the zip file.

Unfortunally, the D_4362.dll file came back and my browser is still being redirected. :cry If it helps, the two main things it seems to be advertising are Online Guard and Spy-Shredder, if those sound familiar. Do you see anything else in my new log?

 

Hi Sk8ie!

Some of your fixes did not work. It may be that they were blocked by your antivirus or they may be blocked by your 07 lines. We may need several steps to complete this. Please do the following:


1) Continue by downloading a tool we will need

- Process Explorer
Extract it to its own folder somewhere that you will be able to locate it later.

2) Please print out these instructions so that you can operate with All Browser Windows CLOSED.

3) After this, I would like for you to shut down your computer, disconnect your computer (physically) from the internet and then disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Then boot back up into Normal Mode (not Safe Mode) (do not open any other processes)


Make sure that one and only one Internet Explorer browser is opened up

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of any of the below DLL files (if found) and then click the kill button.
D_4362.dll

After you have killed all instances of any of the above DLLs under winlogon click ok.
(If you do not find these DLLS, just continue on.)

Next double click on explorer.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
D_4362.dll

After you have killed all instances of any of the above DLLs under Explorer click ok.
(If you do not find these DLLS, just continue on.)

Next double click on iexplore.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
D_4362.dll

After you have killed all instances of any of the above DLLs under iexplore click ok.
(If you do not find these DLLS, just continue on.)

Now just exit Process Explorer.


4) Next we need to remove a service, please follow the below…

• Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
• On the page that opens, scroll down to Symantec Core LC
• then right click the entry, select Properties and press Stop Service.
• When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
• Now Click OK until you get back to Windows.
• Next, run C:\MGTools\analyse.exe by double-clicking on it (this is HijackThis or HJT which has been renamed), but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
• At the lower right, click on the Config button
• Then click the Misc tools button
• Select Delete an NT Service
• Copy/paste Symantec Core LC into the box that opens, and press OK
• If you receive any error messages just ignore them and continue.
• Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after runni5) [/SIZE]

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

O2 - BHO: (no name) - {FDEA2C12-A476-A13C-2B4C-A3BD546315C2} - C:\PROGRA~1\COMMON~1\System\D_4362.dll
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

After clicking Fix, exit HJT.

5) Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Be sure to tell me if this worked or not. You will get a message.

6) Run CCleaner in the default setting.

7) Now, please shut down your computer, reconnect to the internet and make sure your antivirus/antispyware is all running again.

8) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip

Let me know how things are running now?

abri

 

I did everything up to this point, but the odd thing is that I didn't find the files when I looked in each of the three places, even though the file is still there.

I did all of this except the O23 item was not there.

Yes, it worked.

I couldn't do this. I was assuming it would wipe out cookies and history, etc, so I unchecked those items under IE. I hate wiping those things out. I ran it for everything else, though.

I've attached the .zip file.

However, the file is still there. But, I was looking in my McAfee Recent Events section, and found that when it said that a change was allowed to the registry, it listed this:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\update.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper
Objects\{FDEA2C12-A476-A13C-2B4C-A3BD546315C2}'HKEY_LOCAL_MACHINE\CLSID\{FDEA2C12-A476-
A13C-2B4C-A3BD546315C2}\InProcServer32C:\Program Files\Common Files\System\D_4362.dll

When I moved that update.exe file to the recycle bin and rebooted, I didn't get the file back. Is that update file something that I should have, or was it put there by this spyware? I want to know if I can delete it.

Also, in looking at files created around this same time I got this spyware (or whatever you call it), I also have these files that I think could be connected.

wn789.exe
WN789.EXE-114FC72E.pf
US0105.EXE-3982C04A.pf
svchost.exe

Do you know what these files are and if any of them can be deleted to fix the problem?

Thanks!

 

Hi Sk8ie!

This is a valid file if it's in the right location: svchost.exe
It sould be located here: C:\WINDOWS\System32\svchost.exe
Don't delete it:

You can empty the contents of your prefetch folder including the two items you found:

WN789.EXE-114FC72E.pf
US0105.EXE-3982C04A.pf

As for this file: wn789.exe
I'm quite sure it should also be deleted, but what is the pathway?

Please upload both wn789.exe and update.exe and have them scanned at either jotti or VirusTotal and let me know the results.

If you had your antivirus and antispyware programs turned off during the fixes, then I think the following two entries are the problem. We have to get this fixed. No matter how many times you successfully run Regedit4, it won't do anything as long as your Regedit is disable.

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

In order to fix these two entries, we first have to locate them, as they may be in a different location than what is listed. Please download and install the following (there are two different programs for you to try: RegistrarLite and farther down, Regsrch):

http://downloads.bjgarrick.com/files/RegistrarLite.zip

Double click on the rl.exe file to start the program.
Click on Search.
In the window that opens, copy and paste the following into the search bar:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
If it doesn't find this, try looking for DisableRegedit=1
or look for DisableRegedit

See if you can locate where your regedit is being turned off. If so, post that key to me.

You can also use RegSrch to try and find this file. The file will be more difficult to find, because it isn't showing it's real pathway.
Please download RegSrch.zip

Unzip the archive to your desktop and double click on the VBS file.
(If your AntiVirus alerts, allow the script to run.

Now enter C:\PROGRA~1\COMMON~1\System\D_4362.dll and post back with the results in this thread (call it regsrch.txt).

Next, I would like to try using Pocket Killbox to unregister this .dll file. If you already have it installed, you can just run it. If not, please download it here:

Download Pocket KillBox

Save it to your desktop or a place easy to find.


Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, if possible check the Unregister .dll Before Deleting box as well.

• If you get an error message about Pending Operations, just reboot your computer manually.

Finally, run CCleaner to clean up your temp files.

Note: It would be a good idea to change your internet habits to rely on bookmarks and favorites rather than your history. Also, there is a way to make a list of cookies which you don't want to have deleted.

Once you complete this post, reboot once more and attach a fresh MGlogs.zip. Let me know how things went.

abri

 

For wn789.exe (pathway is C:\Documents and Settings\My Name where My Name is...my name ), I got this result at VirusTotal:

BitDefender -- BehavesLike:Trojan.WUDisable
Prevx1 -- Trojan.Gorhax

For update.exe the pathway is C:\Documents and Settings\All Users\Start Menu\Programs\Startup , and I got no bad results at VirusTotal (or Jotti), but I really think it's a problem anyway.

And for svchost.exe, I do have it in the folder you said, and that one looks fine, it says it's by Microsoft, and I also have it in C:\i386, which seems ok, but the problem one is another one that's in C:\Program Files\Common Files\System , where the bad dll file is. It didn't show up as a problem at VirusTotal, but all of those exe files were created at about the same time, and I think they're all related.

So I can empty my whole C:\WINDOWS\Prefetch folder? I have no idea what those files do.

I'll go and do the other steps you said now.

ETA: When I run RegistrarLite I don't come up with anything for any of those strings. I'm having trouble with RegSrch. When I start the search, I get a message that says Registry editing has been disabled by your administrator. And then I get another message saying

Script: C:\Documents and Settings\My Name\Desktop\RegSrch.vbs
Line: 39
Char: 3
Error: File not found
Code: 800A0035
Source: Microsoft VBScript runtime error

So it's not working.

ETA again: So when I enter the string into Pocket Killbox, do I use the real string or the one with the ~1 that has been shortened?

 

Hi Sk8ie,

1) Please run RegistrarLite and search for the following registry keys. Check under CurrentVersion of each of the above keys to see if there are any strange spellings of Policies. It's possible that Policies has been intentionally mispelled. Let me know what you find.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System

2) Next download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

3) Now run CCleaner as you did in the READ & RUN ME instructions. Double click on the CCleaner icon on the desktop. Where it opens, you will see a button in the lower right-hand corner "Run Cleaner". Click on that. A warning will tell you CCleaner is about to delete files permanently from your computer. Click on okay. Allow it to run until it finishes. When it finishes, just close it with the X in the top right-hand corner.

4) After you finish the above, please run C:\MGtools\GetLogs.bat and attach a fresh MGlogs.zip along with the Avenger log.

I will be away from the computer soon and someone else will be helping you. I'll check for your response one more time.

abri

 

I don't see any "CurrentVersion"s of any of those. This was the closest I coujld find. The other two weren't keys, that I could tell (I'm not entirely sure I understand what I'm doing with this), but I didn't see any mispellings of Policies for this one.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}

I did that and I'll reboot now. I'll come back and edit in a minute.

 

Too late to edit my post.

Ok, did the other stuff, and have attached the logs. One of the lines was missing a space or something so Avenger didn't delete one of the files the first time around, but I fixed it and ran it again, so now both of those files are gone. I deleted the problem dll file before I rebooted the last time, and it didn't come back. :celebrate So I think I'm doing pretty well.

I guess my last two questions are:

1) Should I delete C:\Program Files\Common Files\System\svchost.exe , which is still there?
2) Should I clear out that C:\WINDOWS\Prefetch folder? What do those files do?

Thanks so much for your help!!!

 

Done.

Even if a couple seem to be related to the bad files? Or maybe they don't hurt anything if the exe files are gone?

Ok, I've attached it.

Thanks!

 

Sorry it took me so long to do this. Holiday stuff, you know.

I did this, but I didn't see those two lines when I was in HJT in safe mode.

I did those two things, and have attached the logs.

My PC seems to be working fine. I don't notice any problems remaining from those files.

Is it possible that there could be something that I just don't see, or if everythng seems to be ok is it likely that it is?

I guess I'm mainly worried about having some kind of spyware.

Thanks!

 

I rebooted in safe mode and did a fix on those two lines. Then I ran MGtools in Normal Mode. I wasn't sure if it was supposed to be in normal or safe. I've attached the log.