need help..unable to access net

You PC is VERY BADLY INFECTED. In addition your Windows and IE versions are way out of date and this is a major security risk and has also contributed to the reason why your PC is in such bad shape. You are overrun with malware.

I'm very curious why your system shell (the explorer.exe file is your system shell) which is in C:\windows shows that it was recently changed. Here is what I see in the newfiles.txt log.

explorer.exe 12 Aug 2006 1000960 "explorer.exe"

Did you change something lately that would cause this to have changed on August 12th?

Let's see what we can do to get you cleaned up. This is going to take a bunch of work. I will probably post the fixes in stages.

So let's begin here!

First goto Add/Remove programs and uninstall the below:
LinkOptimizer
SafeCast Shared Components
Safety Bar


Now Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach that log in your next reply.

Note: process.exe ( which is used my SmitFraudFIx ) is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. The below is a link to what process.exe is.

http://www.beyondlogic.org/consulting/proc...processutil.htm


IMPORTANT: Do NOT run any other options until you are asked to do so!

 

Now after complete the steps in my last message continue here.

Download the attach malfix.zip file into the same folder where you extracted ShowNew to. (This was C:\Spyware tools\ShowNew ) Then extract both files from the malfix.zip file into this folder with ShowNew. The locate the malfix.bat file and run it by double clicking on it. When it finishes, there should be a fix1log.txt file in the same folder. Attach the fix1log.txt log file here.

Note we are not done yet! We have a lot more to do. This is just a beginning. And after I get the previously requested log from SmitFraudFix and the above log, we will continue.

 

When you try to uninstall Link Optimizer, do you get any error messages?

PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting.

Please print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. Again, if there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer into Safe Mode per the safe directions in the READ & RUN ME.

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach this log along in your next reply.

After doing the above and attach the new rapport.txt log, also attach a new HJT log and a new log from ShowNew!

 

Run the steps in message # 6 and then use the below tool to uninstall Link Optimizer

Your Uninstaller! 2006

 

Okay I see Your Installer installed but I still see Link Optimizer installed. Did you get the ShowNew log before uninstalling Link Optimizer or did Your Uninstaller fail to remove it?

Now install the current version of Sun Java from: Sun Java Runtime Environment

Then uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 7


Now Click on Start, then Run ... and type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to SmartFinder Uninstall ... then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

SmartFinder_Uninstall

If you receive any error messages just ignore them and continue.

Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.


Now download - Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - Default URLSearchHook is missing
O2 - BHO: Class - {102852BB-BD3B-F1C9-3B15-B010CA370C1F} - C:\WINDOWS\dgmgk1.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeinst.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.filelodge.com/ImageUploader3.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - (no file)

After clicking Fix, exit HJT.


Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
Now back on Killbox's main window, Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note some of the files listed below may not exist but we need to check for them anyway.

C:\Documents and Settings\Ravat\Local Settings\Temporary Internet Files\Content.IE5\89GPYVC1\SFUninstaller[1].exe
C:\Documents and Settings\Ravat\Local Settings\Temp\h91746.exe
C:\Documents and Settings\Ravat\\Local Settings\Application Data\8660d7ae.exe
c:\program files\common files\system32.dll
C:\Program Files\FreeGames4Rest\Eastern Mahjong\VVSNInst.exe
C:\WINDOWS\Downloaded Program Files\gdnGB2218.exe
C:\WINDOWS\TEMP\dtbn1.exe
C:\WINDOWS\System32\8660d7ae.exe
C:\WINDOWS\system32\lpaa.dll
C:\WINDOWS\system32\m96pk.dll
C:\WINDOWS\system32\ofpl6.dll
c:\windows\system32\uk.exe
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Desktop.htt
c:\windows\help\SPAlert.chm
C:\WINDOWS\addnk.exe
C:\WINDOWS\apiwu32.exe
C:\WINDOWS\sysvc.exe
C:\Downloads\MahjonggSetup-dm[1].exe
C:\Spyware tools\Quarantine\986F4330-D596-4829-ABDF-DE4225\B579F6BC-12AA-42C8-888C-33DE4C
C:\Spyware tools\Quarantine\986F4330-D596-4829-ABDF-DE4225\F17683DB-609D-484C-91D2-38486C


If Killbox does not reboot or if you get a Pending Operations type error message just click OK to continue and then just reboot your PC yourself.

After reboot locate the below folder and delete it if found:
c:\program files\common files\Download

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\TEMP\
C:\Documents and Settings\Ravat\Local Settings\Temp\

Now attach a new HJT log and tell me how the steps went.

Also attach a new log from ShowNew and a new log from GetRunKey.

Make sure you tell me how things are working now!

 

Not according to the newfiles.txt log. It shows it still installed:
"DisplayName"="LinkOptimizer"

Is your copy of MS Antispyware still actually working? Microsoft has dicontinued it and has replace it with Windows Defender (only for update Window's Operations Systems like WinXP SP2 and Win 2000 SP4)

Did you forget to fix the below lines last time? Try again but MAKE SURE no browsers are running when you click Fix checked?
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {102852BB-BD3B-F1C9-3B15-B010CA370C1F} - C:\WINDOWS\dgmgk1.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

Attach a new HJT log afterwards.

Try giving the below a run:

XP TCP/IP Repair

 

Are you sure it did uninstall before? If it did, then where did you go surfing and what did you download that caused it to come back. You must have been surfing somewhere because now you have a few new problems including a WareOut infection. You now need to run this: WareOut Removal and attach the requested log.

Uninstall Your Uninstaller since you cannot use it anymore.

Try using this: Add/Remove Program Cleaner

Did it work?

It shows right in your Add/Remove programs list as Microsoft Antispyware. I also recommend uninstalling it since it is no longer supported or functional.

Okay one last thing to try!

WinSock XP Fix


If this problems still persists you will have to work it in the Software Forum. This is not a malware problem (but could have been caused by malware). You may need to uninstall your network adapter, reboot and reinstall (possibly even re-installing the drivers for the network card).

 

You are now loaded with even more malware. This is all happening because you PC is so out of date with Windows Update and because you have inadequate protection. It may also be due to where you are surfing inbetween fixes here at MGs.

We need to try to slow down the spread of malware on your system. You need to add a software firewall immediately and make sure you block any unknown processes from enter or leaving your PC. Please install the below now:

ZoneAlarmFree

After installing ZoneAlarm, continue onto the below.

Now download - Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - Default URLSearchHook is missing
O2 - BHO: Class - {102852BB-BD3B-F1C9-3B15-B010CA370C1F} - C:\WINDOWS\dgmgk1.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O4 - HKLM\..\Run: [dmxsg.exe] C:\WINDOWS\System32\dmxsg.exe
O4 - HKLM\..\Run: [msserv] C:\WINDOWS\System32\lvsrev.exe
O4 - HKLM\..\Run: [useful-soft] C:\WINDOWS\System32\winspsrv.exe

After clicking Fix, exit HJT.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Windows\System32\drivers\InvisibleDrvNT.sys
C:\WINDOWS\SYSTEM32\CSPZO.EXE
C:\WINDOWS\SYSTEM32\DMCPL.EXE
C:\WINDOWS\SYSTEM32\DMTLB.EXE
C:\WINDOWS\System32\lvsrev.exe
C:\WINDOWS\System32\winspsrv.exe
C:\WINDOWS\system32\{53A58C6B-AFDA-4A4B-8A63-D24370DC60C9}.dll
C:\WINDOWS\system32\{3DF9A214-6795-4F1D-9E98-DAF93228A020}.exe
C:\WINDOWS\system32\{62977E7D-6A27-4837-9AAC-80D532D3D6D2}.exe
C:\WINDOWS\system32\{CB146516-3B1E-40E4-AEF1-0B677DF7A606}.exe
C:\WINDOWS\system32\{C3D88AEF-9A05-4C51-9DA8-DC9B68077F4D}.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Now attach a new HJT log and tell me how the steps went.
Also attach a new log from ShowNew and a new log from GetRunKey.
Make sure you tell me how things are working now!

 

After completing all the steps in message number 16, continue with the below:

Now download Blacklight Beta

• Download blbeta.exe and save it to the Desktop.
• Once saved... double click blbeta.exe to install the program.
• Click accept agreement and Click scan
  This app too may fire off a warning from antivirus. Let the driver load.
  Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please post contents of the BlackLight log.

 

Okay then use either one (but only one) of the below:

• Outpost Firewall Free

• Sygate Personal Firewall Free

 

Run this which may fixed your debug priviledges and allow you to run BlackLight

Look2Me VX2 Removal

Try running BlackLight afterwards.

Note: Your copies of GetRunKey and ShowNew are out of date. Download and use the current versions to get new logs.

You also MUST RENAME HijackThis.exe as specified in step 7 of the READ ME. This is very important!!!

 

Did you download and use the below?

Run Pocket Killbox and select File, Cleanup, Delete All Backups!

Now in Killbox, choose Tools > Delete Temp Files and click Delete Selected Temp Files. Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\246172160121.exe
C:\vbsys2.dll
c:\WINDOWS\dgmgk1.dll
c:\WINDOWS\system32\drivers\poremst2.sys
C:\WINDOWS\system32\lvsrev.exe
C:\WINDOWS\system32\apigrab.dll
C:\WINDOWS\system32\userid.dll

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Now attach new logs from the below:

• Blacklight
• ShowNew
• HJT

Make sure you tell me if you had any problems while doing the above and also tell me how things are working now!

 

Looks like Killbox was not able to find and delete those two files hidden by the rootkit. The below files still exist:

c:\WINDOWS\dgmgk1.dll
c:\WINDOWS\system32\drivers\poremst2.sys

If you look for them (make sure hidden and system file viewing is enabled per the READ ME), can you see them. If you run BlackLight and tell it to fix these files, what happens?


Does your Norton Antivirus application actually have a firewall? I see the below, but it just says it is a firewall monitor.
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Spyware tools\IWP\NPFMntor.exe



Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: Class - {102852BB-BD3B-F1C9-3B15-B010CA370C1F} - C:\WINDOWS\dgmgk1.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete (if found):
C:\WINDOWS\dgmgk1.dll
C:\winstall.exe
C:\WINDOWS\System32\vbsys2.dll

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot in normal mode and continue with the below.

• Download Gromozon Removal Tool from Pevx1 to your desktop.
• Disconnect from the internet by unplugging the cable and disable your antivrus
• Run prevxremovaltool.exe from the Desktop by double clicking on it.
• Click the scan and follow the intructions on screen,
• once complete reboot and make sure you AV is re-enabled

Attach a log showing the results of the scan!

Now post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Okay it looks like the Gromozon removal tool worked okay!

You should uninstall ALL of your Norton/Symantec AV stuff if it has expired and then while doing the steps in the below (your final steps) install a new antivirus. Do not do install the new AV until Norton has been removed. Make sure you get your out-of date Windows OS updated very soon or you will get infected again rather easily.

If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!