Problems in Safe Mode

Hi. I think I may be infected with a variant of sp.html, and have tried to follow your instructions on how to remove this thing, however, when I try to run about:buster in safe mode it crashes. It can run fine in normal mode, but whatever it deletes comes back. Why doesn't the prog work? Would it work if I re-downloaded and reinstalled the program (I have access to a computer that is un-infected for which to do this).

Thanks for your time

-WanderingCanadian

 

http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Thanks for the info. Will do, as soon as I return to my home computer.

 

Will be awaiting your log!

 

Here's my log... hope ye can be of service

 

Don't mean to interrupt, but to save you some time, you should prolly download the newer version of HijackThis from the link bj gave you at the beginning. He'll come along and get you to anyway probably. Good Luck!

 

First:
Please update your version of Hijack This.

• Hijack This 1.99.1

Second:
Download this file: SpSeHjfix109

Unzip it to your desktop or to a folder.

Boot into Safe Mode

Start SpSeHjfix, click on " Desinfecton starten" (the other button means close) then it will reboot and finish the cleaning.

Run SpSeHjfix one more time.

Reboot in Normal mode.

Run HijackThis again and post a new log. Also post the log from SpSeHjfix, the log should be on your desktop or the same folder as SpSeHjfix.

 

Here's the logs from both; the thinger is still there I'm afraid. I'm off to bed though, got tons of stuff to do tomorrow. Thanks for the help.

 

Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOZE\mjptw.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOZE\mjptw.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOZE\mjptw.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOZE\mjptw.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOZE\mjptw.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOZE\mjptw.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOZE\mjptw.dll/sp.html#12047

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;127.0.0.1;

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {CEC67669-6FEE-3D11-CA3D-61EDE19A9B55} - C:\WINDOZE\SYSTEM\ATLEJ32.DLL

O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

O9 - Extra button: Acez.com - Download Free Screen Savers - {88E50F1D-4790-4C6B-BEE3-D54E46B6EEF6} - C:\WINDOZE\acezlink.htm (file missing)
O9 - Extra button: Corel Network monitor worker - {F90D86E0-35E0-11D9-85DE-0050BAB23928} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {F90D86E0-35E0-11D9-85DE-0050BAB23928} - (no file)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -%windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Corel Network monitor worker - {F90D86E0-35E0-11D9-85DE-0050BAB23928} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {F90D86E0-35E0-11D9-85DE-0050BAB23928} - (no file) (HKCU)

O16 - DPF: ConferenceRoom Java Client - http://mail.igl.net:8000/java/cr.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) -http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOZE\mjptw.dll

C:\WINDOZE\SYSTEM\ATLEJ32.DLL

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After doing ALL of the above,
Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Ok, thanks for all the help. Everything worked fine except for this:

Spybot, as well as fixing something, came up with this message:

Error during check!
Z-Demon (Ungultiger Datentyp fur ")

(there was an umalaut over the second u in the word Ungultiger and over the word fur)

... other than that everything worked fine, and I didn't get attacked by spyware demons upon loading Internet Explorer. Here's my log. Thanks for the help.

 

Have HJT fix this entry:

O9 - Extra button: Acez.com - Download Free Screen Savers - {88E50F1D-4790-4C6B-BEE3-D54E46B6EEF6} - C:\WINDOZE\acezlink.htm (file missing)

After you fix this entry, your log will be clean!

Are you having any further problems?

 

Ok, that's done. No other problems as far as I can tell; though Ad_Aware did delete a whole whack of things... anyway, here's my log again just to make sure that I'm not missing anything. Thanks for the help.

 

Reboot into Safe Mode

Scan with HJT and have it fix this entry:

O9 - Extra button: Acez.com - Download Free Screen Savers - {88E50F1D-4790-4C6B-BEE3-D54E46B6EEF6} - C:\WINDOZE\acezlink.htm (file missing)

 

Ok, I fixed that line (all my Internet Explorer windows were closed, as were my Windows Explorer windows. only thing I had open was a notepad file... also yahoo messenger was running, but no windows were open) but it keeps showing up every time I scan again. I think it may have to do with the fact that I have the newest MSN messenger on my comp (from the official site). I haven't been getting any pop-ups and my browser looks like its doing fine.... perhaps if I ran hijack this while unplugged from the internet, or in safe mode? Is it serious, that line? Here's my log. Thanks again for your help.

 

Crap... obviously I can't read. I didn't reboot into safe mode before scanning. *smacks self in head* read your post again just now. trying again

 

Will be awaiting results!

 

OK, hijackthis!.log is from just after I deleted that line in safe mode, and hijackthis!!.log is from normal mode, just after that. The line is still there, unfortunately. Hope that a) you can help or b) that it isn't really that serious =P. Awaiting diagnosis.

 

whoops. still new at this. here's the logs.

 

It says "file missing" so its not a real big deal as the file isnt there anymore.

Also, be sure you follow the steps in this sticky thread:

How to Protect yourself from malware!

 

Thanks alot for the help man. I owe you a breadtangle of pizza or something.

 

Your Welcome!