HJT Log

benodictine · Jul 19, 2006

I have completed the steps indicated in the cleaning procedure found at this link:

http://forums.majorgeeks.com/showthread.php?t=35407

I've attached the 3 logs requested in the link above:

activescan.txt
bdscan.txt
hijackthis.log

I took notes as i followed the steps above documenting everything I did so if you'd like to see those just ask. I hope someone can help me I'd really appreciate it.

Thanks

benodictine · Jul 19, 2006

I forgot to add the computers spec.

dell demension 3000
XP Home SP2 (build 2600)
2.40 ghz Intel Pentium 4
40Gb HD
256MB ram

If you need any more info, just ask.

Thanks

benodictine · Jul 20, 2006

please help. is anybody out there? pleeeeeeeease help. please please please please please.

Shadow_Puter_Dude · Jul 20, 2006

Uninstall SystemDoctor

Follow the direction for SpywareQuake & SpyFalcon Removal Procedure.

Post the report from SmitRem and a fresh HijackThis log. When finished.

benodictine · Jul 21, 2006

Thanks so much for the reply/help Shadow_Puter_Dude.

Of all the files and folders that were asked to be deleted only the %System32%\cfgmngr32.dll was found. I renamed it to .ddd and deleted it at the appropriate time.

When I ran smitRem it found trust cleaner but was unable to locate the files to delete/uninstall it.

%System32%\autodisc32.dll was not found but %System32%\autodisc.dll was. Is that file bad too?

During all this before, after, and during I never saw anything relating to Spyware Quake.

I've attached the smitfiles.txt and new hijackthis.log files.

I hope this is the info you need. Thanks so much for you time, I really appreciate it.

Shadow_Puter_Dude · Jul 21, 2006

Quick question do you now or have had ClamAV installed?

benodictine · Jul 22, 2006

As far as I know I do not now and never have had ClamAV installed.

As I mentioned in my first post, I took notes/documneted what I did/happened as I followed the steps. The following is probably worth noteing:

Step 5: Cleaning Malware

• I booted into safe mode and phiscaly upluged the nic cable.

• I ran ccleaner in all user accounts.

• I ran all the programs I was instructed to. Windows Defender worked in safe mode but did not work in normal mode. In normal mode I get the following error messages at startup, at least one of them relates to Windows Defender:

c:\WINDOWS\inet20001\winlogon.exe

Windows cannot find 'C:\WINDOWS\inet20001\winlogon.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the start button, and then click search.
Click to expand...

I click OK and then I get this message:

Desktop

Could not load or run ‘C:\WINDOWS\inet20001\winlogon.exe’ specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry.
Click to expand...

After that I receive the following message:

Windows Defender User Interface

Windows Defender User Interface has encountered a problem and needs to close. We are sorry for the inconvenience.

If you were in the middle of ……

Please tell Microsoft about this problem.

We have created an error report that….

Send Error Report Don’t send error report.
Click to expand...

I sent the error report.

Then the C:\WINDOWS directory opens up. I just close it and nothing else happens.

• In Normal mode I ran CounterSpy seeing as Windows defender didn’t work. It started but eventually froze up, so I was able to complete the scan.

I hope this helps you help me. Thanks again.

Shadow_Puter_Dude · Jul 22, 2006

Move HijackThis to C:\Program Files\HJT. Rename hijackthis.exe to analyse.exe. Do this now, before proceeding.

Windows Messeger is running in the background on this computer, and represents a security risk. Disable Windows Messenger by running Shoot The Messenger. If you are using this as your IM client then replace it with MSN Messenger.

Download
- Pocket Killbox

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
F3 - REG:win.ini: run=C:\WINDOWS\inet20001\winlogon.exe
O4 - HKLM\..\Run: [4b3a3792.exe] C:\WINDOWS\system32\4b3a3792.exe
O4 - HKLM\..\Run: [NopeZ] clamav.exe
O4 - HKLM\..\Run: [dmhnl.exe] C:\WINDOWS\system32\dmhnl.exe
O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS
O4 - HKCU\..\Run: [4b3a3792.exe] C:\Documents and Settings\Amanda\Local Settings\Application Data\4b3a3792.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{6112E05C-7F47-45EF-9722-8D6123F7AB96}: NameServer = 85.255.115.235,85.255.112.171
O20 - Winlogon Notify: 20242402reg - C:\Documents and Settings\All Users\Documents\Settings\20242402.dll (file missing)
O20 - Winlogon Notify: sw4dll - sw4dll.dll (file missing)
O20 - Winlogon Notify: winm32 - winm32.dll (file missing)
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

clamav.exe
sw4dll.dll
winm32.dll
c:\secure32.html
C:\Documents and Settings\All Users\Documents\Settings\20242402.dll
C:\Documents and Settings\Amanda\Local Settings\Application Data\4b3a3792.exe
C:\Documents and Settings\Amanda\Local Settings\Temp\h91746.exe
C:\Documents and Settings\Nick\Local Settings\Application Data\4b3a3792.exe
C:\Documents and Settings\Nick\Local Settings\Temp\AGLanguage.ini
C:\Documents and Settings\Owner\loaded.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\4b3a3792.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\d6886e2f.exe
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\1100.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\1464.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\1636.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\164.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\1900.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\2028.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\2148.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\2456.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\2688.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\2764.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\2956.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3000.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3016.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3284.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3608.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3648.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3728.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3940.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3948.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3956.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\3968.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4020.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4032.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4084.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4092.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4208.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4452.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4800.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4828.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\488.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4896.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4944.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\4996.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\500.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\01808300\824.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\6.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\B.tmp
C:\Documents and Settings\Owner\Local Settings\Temp\h91746.exe
C:\Documents and Settings\Owner\Local Settings\Temp\her.pt
C:\Documents and Settings\Owner\Local Settings\Temp\qvxt2.game
C:\Documents and Settings\Owner\Local Settings\Temp\qvxt4.game
C:\Documents and Settings\Owner\Local Settings\Temp\vx1.game
C:\Documents and Settings\Owner\Local Settings\Temp\vx2.game
C:\Documents and Settings\Owner\Local Settings\Temp\vx4.game
C:\Documents and Settings\Owner\Local Settings\Temp\vxt2.game
C:\Documents and Settings\Owner\Local Settings\Temp\vxt4.game
C:\Program Files\secure32.html
c:\windows\rdt.ini
C:\WINDOWS\inet20001\winlogon.exe
c:\windows\system32\1024\ld81C0.tmp
C:\WINDOWS\system32\4b3a3792.exe
C:\WINDOWS\system32\dfcpr.dll
C:\WINDOWS\system32\dmhnl.exe
C:\WINDOWS\system32\gdwxp3.dll
c:\windows\system32\ld100.tmp
c:\windows\system32\ot.ico
C:\WINDOWS\system32\prsvc.exe
c:\windows\system32\r.exe
c:\windows\system32\drivers\zpmodemnt.sys
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

clamav.exe <<=== Delete the File
sw4dll.dll <<=== Delete the File
winm32.dll <<=== Delete the File
c:\secure32.html <<=== Delete the File
C:\Documents and Settings\All Users\Documents\Settings\20242402.dll <<=== Delete the File
C:\Documents and Settings\Amanda\Local Settings\Application Data\4b3a3792.exe <<=== Delete the File
C:\Documents and Settings\Amanda\Local Settings\Temp\h91746.exe <<=== Delete the File
C:\Documents and Settings\Nick\Local Settings\Application Data\4b3a3792.exe <<=== Delete the File
C:\Documents and Settings\Nick\Local Settings\Temp\AGLanguage.ini <<=== Delete the File
C:\Documents and Settings\Owner\loaded.exe <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Application Data\4b3a3792.exe <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Application Data\d6886e2f.exe <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\01808300 <<=== Delete the Folder
C:\Documents and Settings\Owner\Local Settings\Temp\6.tmp <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\B.tmp <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\h91746.exe <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\her.pt <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\qvxt2.game <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\qvxt4.game <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\vx1.game <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\vx2.game <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\vx4.game <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\vxt2.game <<=== Delete the File
C:\Documents and Settings\Owner\Local Settings\Temp\vxt4.game <<=== Delete the File
C:\Program Files\secure32.html <<=== Delete the File
c:\windows\rdt.ini <<=== Delete the File
C:\WINDOWS\inet20001 <<=== Delete the Folder
c:\windows\system32\1024 <<=== Delete the Folder
C:\WINDOWS\system32\4b3a3792.exe <<=== Delete the File
C:\WINDOWS\system32\dfcpr.dll <<=== Delete the File
C:\WINDOWS\system32\dmhnl.exe <<=== Delete the File
C:\WINDOWS\system32\gdwxp3.dll <<=== Delete the File
c:\windows\system32\ld100.tmp <<=== Delete the File
c:\windows\system32\ot.ico <<=== Delete the File
C:\WINDOWS\system32\prsvc.exe <<=== Delete the File
c:\windows\system32\r.exe <<=== Delete the File
c:\windows\system32\drivers\zpmodemnt.sys <<=== Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Follow the directions for Running WinPfind by OldTimer.

Post WinPFind.txt and fresh HijackThis log.

benodictine · Jul 25, 2006

Everything seemed to work except WinPfind. Everytime I ran it it just disappeared after 2 to 3mins. Once it froze on me, went to task manager and it was not responding.

I never saw a message in the titlebar saying 'Not responding' only in the task manager.

Whether it froze or just shutdown the hard drive light wasn't flashing afterward.

I did however run hijackthis and attached the log.

Thanks a million.

Shadow_Puter_Dude · Jul 25, 2006

You did not rename hijackthis.exe to analyse.exe as requested; it is critical that you do so.

Follow the directions for Using GetRunKey and Using ShowNew.

Post runkeys.txt, newfiles.txt, and a fresh HijackThis log from the renamed hijackthis.exe.

benodictine · Aug 1, 2006

Shadow_Puter_Dude, I can't thank you enough for all your help. This was my friends PC and he couldn't wait any longer and took it back. So thanks again I really appreciated it.

Till next time,
benodictine

Shadow_Puter_Dude · Aug 1, 2006

You're welcome.

Sorry your freind couldn't wait, the computer wasn't clean.

Log in or Sign up

HJT Log

benodictine Private E-2

Attached Files:

hijackthis.log

Activescan.txt

bdscan.txt

benodictine Private E-2

benodictine Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

benodictine Private E-2

Attached Files:

smitfiles.txt

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

benodictine Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

benodictine Private E-2

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

benodictine Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter