Ran tests for about.blank and malware: what next?

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following: your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message.(Do NOT copy/paste the log into your post).

Yes you will need to upgrade your system but let's see what we can fix first.

 

Also please do the following:

Download: "StartDreck", from here:
http://www.niksoft.at/_data/startdreck.zip

Unzip to its own folder and start the program,
Press 'Config'
Press 'Unmark All'
Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'
Press 'Save' and select the location to save the log file
(default is the same folder as the application)

Please attach the log in this thread.

 

Make sure you have about:Buster downloaded from the READ ME FIRST. And make sure you have UPDATED the database for about:buster. I believe it is up to number 23. The download only comes with version 19 which is out of date. You must update.

You need to print or save these instructions locally because after this reading this sentence you will need to physically unplug your connection from your cable, ADSL, or dial-up modem to your PC and then you MUST exit all browsers and DO NOT run any again until requested.

Okay, unplug your internet connection and exit browsers now!!!!
Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.

C:\WINDOWS\SYSTEM\NTON32.EXE

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\brkcf.dll/sp.html#12345
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {538B9FE6-4A93-9D99-7433-815C211C7184} - C:\WINDOWS\SYSTEM\APIDR.DLL
O4 - HKLM\..\Run: [winmain] winmain.exe
O4 - HKLM\..\Run: [IPGA.EXE] C:\WINDOWS\IPGA.EXE
O4 - HKLM\..\RunServices: [NTON32.EXE] C:\WINDOWS\SYSTEM\NTON32.EXE

Then exit HJT after clicking FIX

Run Windows Explorer and look for and try to delete (sort the listing in windows explorer by Modification dates and look for possibly other similarly name files from the same date - let me know if you find others - you may also see the same filenames but with .ini, .dat, .exe, or .dll extensions)
C:\WINDOWS\SYSTEM\APIDR.DLL
C:\WINDOWS\IPGA.EXE
C:\WINDOWS\SYSTEM\NTON32.EXE
C:\WINDOWS\winmain.exe or C:\WINDOWS\SYSTEM\winmain.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. If you cannot find or delete them, note which ones and continue (tell me the results when you come back here).

- Run about:Buster and save the log to ab1.log (make sure you let it do the second scan).

- NOW PULL THE POWER PLUG TO YOUR PC! Yes, that is what I said. This is very important! I do not want you to power down the normal way.

- After that wait a minute or two and then power up into safe mode (still with no internet connection available and do not open any browsers). Only run what I request.

- Empty your Recycle Bin. In fact as an additional measure do the following:
Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin
And Click OK.

- Run about:Buster again and save the log to ab2.log (let it do second scan)!

- Immediately after about:buster completes, reboot in normal mode. (you do not need to pull the powser plug here. Just reboot.)

- Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

- Plug your cable to the internet back in now.

- Open and close a couple of IE sessions and then with IE closed get a new HJT log.

- Now come back here and post both about:Buster logs and the new HJT log. And tell me what happened during the procedure.

Let me know anything else that you notice or had problems with.

 

Your problem is more than like going to come back (if if has not already) because of that NTON32.EXE file you were not able to delete. And now there is another process added to your log.

Here are the problem processes and startup entries in your HJT log:

C:\WINDOWS\SYSTEM\NTON32.EXE
C:\WINDOWS\SYSTEM\APPNW32.EXE
O4 - HKLM\..\Run: [APPNW32.EXE] C:\WINDOWS\SYSTEM\APPNW32.EXE
O4 - HKLM\..\RunServices: [NTON32.EXE] C:\WINDOWS\SYSTEM\NTON32.EXE

Let's see if we can fix it before it gets worse.

Please boot to an MS-DOS prompt and then delete the two files from the c:\windows\system folder. The procedure is below. You should print this so you can follow while offline.

Booting to MS-DOS mode

You click Start and then Shutdown and in the Window that comes up choose the one that says Restart the computer in MD-DOS mode.

When it boots you will be at the command prompt (full screen) enter the following commands each followed by the enter key and then when finished type win and hit enter which should bring you back to Windows where you can tell me what happened.

cd c:\windows\system
attrib -s -h -r APPNW32.EXE
del APPNW32.EXE

attrib -s -h -r NTON32.EXE
del NTON32.EXE

win

Now, why don't you move all thoes questionable files you listed in your last message into a holding folder (just incase). So make a folder called junk in the c:\windows\system folder and move all those files into the junk subfolder.

Let me know of any error messages you get while reboot or when you go to run IE or anything else. Post a new HJT log and if the problem is still there, DO NOT REBOOT or shutdown your PC until you hear from me.

 

Okay! Things more than likely respawned due to missing some of the files.

That APPLV32.EXE file you saw probably caused this.

Before we continue. I need to know that you have not rebooted since posting your HJT log.
If you have rebooted, I need to see a new HJT log and then do not reboot.

Also either way get a new StartDreck log and post it right now.

At the present time the "visible" problem lines in your HJT log are:


C:\WINDOWS\APPLV32.EXE
C:\WINDOWS\SYSTEM\SYSGY.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pilag.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pilag.dll/sp.html#12345
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {5FED7651-9344-A240-6171-67DD7DE0C463} - C:\WINDOWS\MFCZM.DLL
O4 - HKLM\..\Run: [APPNW32.EXE] C:\WINDOWS\SYSTEM\APPNW32.EXE
O4 - HKLM\..\Run: [SYSGY.EXE] C:\WINDOWS\SYSTEM\SYSGY.EXE
O4 - HKLM\..\RunServices: [NTON32.EXE] C:\WINDOWS\SYSTEM\NTON32.EXE
O4 - HKLM\..\RunServices: [APPLV32.EXE] C:\WINDOWS\APPLV32.EXE

 

Download ProcessExplorer from: ProcessExplorer for Win 9x/Me
Extract it to a folder named: C:\SysInternals

Print the below instructions or save locally because you need to unplug your cable to the internet and exit all browsers now and do not reconnect or run a browser again until told to.

OK! Unplug and Exit browsers now before continuing.

We are going to use it to kill processes. It does a better job than TaskManager or HJT's process manager. From now on use it to kill processes. Run the executable and use it to kill any of the below for processes if found:

C:\WINDOWS\SYSTEM\APPNW32.EXE
C:\WINDOWS\SYSTEM\SYSGY.EXE
C:\WINDOWS\SYSTEM\NTON32.EXE
C:\WINDOWS\APPLV32.EXE

Run HijackThis and have it fix the below lines:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pilag.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pilag.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pilag.dll/sp.html#12345
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {5FED7651-9344-A240-6171-67DD7DE0C463} - C:\WINDOWS\MFCZM.DLL
O4 - HKLM\..\Run: [APPNW32.EXE] C:\WINDOWS\SYSTEM\APPNW32.EXE
O4 - HKLM\..\Run: [SYSGY.EXE] C:\WINDOWS\SYSTEM\SYSGY.EXE
O4 - HKLM\..\RunServices: [NTON32.EXE] C:\WINDOWS\SYSTEM\NTON32.EXE
O4 - HKLM\..\RunServices: [APPLV32.EXE] C:\WINDOWS\APPLV32.EXE

Exit HJT and immediately boot to the MS-DOS command prompt.

Booting to MS-DOS mode

You click Start and then Shutdown and in the Window that comes up choose the one that says Restart the computer in MD-DOS mode.

When it boots you will be at the command prompt (full screen) enter the following commands each followed by the enter key and then when finished type win and hit enter which should bring you back to Windows where you can tell me what happened.

cd c:\windows\system
attrib -s -h -r APPNW32.EXE
del APPNW32.EXE

attrib -s -h -r SYSGY.EXE
del SYSGY.EXE

attrib -s -h -r NTON32.EXE
del NTON32.EXE

cd c:\windows
attrib -s -h -r APPLV32.EXE
del APPLV32.EXE

attrib -s -h -r MFCZM.DLL
del MFCZM.DLL

win

Now you will be returned to the Windows OS. Do not run any browsers or reconnect you cable to the internet yet. Just run HJT and make sure all the bad stufd is gone. If not repeat the above for whatever came back (note names may have changed).

Afterwards! Reconnect your cable and open and then close one browsers sesssion and then get a new HJT log. Now come back here and post the new log and let me know of any error messages you may have received while rebooting or when you tried to delete any of the above files.

 

You forgot the HJT log.

Those files should exist. Are you sure you are executing the attrib -s -h -r command properly? There are spaces between the -s , the -h , and the -r. Were there any error messages? Are you booting to an MS-DOS command prompt, where Windows is not running and your whole screen is just one big DOS window?

 

Okay! But more specifically my question was:

And not just opening an MS-DOS window while running Windows?

Were you able to go back and find those files now?

Your last log was clean! Are you still clean? Any problems?

Do you use the below applications?

VIEWPOINT MANAGER
RealDownload

 

You're welcome. Were am at appears to the top right side of each message I post.

You should now perform the steps (or the equivalent) in the below link to help avoid future issues:
How to Protect yourself from malware!

 

See my below post! You must have missed it.