ABI Network spyware - Log files

Question

Logfile of HijackThis v1.99.1 Scan saved at 7:29:12 PM, on 7/12/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS.0\System32\smss.exe C:\WINDOWS.0\system32\winlogon.exe C:\WINDOWS.0\system32\services.exe C:\WINDOWS.0\system32\lsass.exe C:\WINDOWS.0\system32\svchost.exe C:\WINDOWS.0\System32\svchost.exe C:\WINDOWS.0\system32\LEXBCES.EXE C:\WINDOWS.0\system32\LEXPPS.EXE C:\WINDOWS.0\system32\spoolsv.exe C:\ewido\security suite\ewidoctrl.exe C:\WINDOWS.0\System32\svchost.exe C:\WINDOWS.0\system32undll32.exe C:\WINDOWS.0\Explorer.EXE C:\WINDOWS.0\System32\keyhook.exe C:\WINDOWS.0\SOUNDMAN.EXE C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe C:\WINDOWS.0\System32\pctspk.exe C:\WINDOWS.0\System32\LXSUPMON.EXE C:\WINDOWS.0\System32\uujmra.exe C:\WINDOWS.0\System32\krnidc32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Cas\Client\casclient.exe C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\Bin\HPOstr05.exe C:\WINDOWS.0\system32\sistray.exe C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\bin\HPOVDX05.EXE C:\WINDOWS.0\System32\wuauclt.exe C:\WINDOWS.0\system\grbrcb.exe C:\DOCUME~1\RAGHU~1.ECS\LOCALS~1\Temp\sysnet.exe C:\WINDOWS.0\knmgdll.exe C:\WINDOWS.0\knmgenc.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS.0\cfgmgr52.dll O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS.0\System32ichedtr.dll O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - (no file) O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS.0\System32\keyhook.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS.0\SiSUSBrg.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS.0\System32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [PSof1] C:\WINDOWS.0\System32\PSof1.exe O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS.0\System32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS.0\System32\wintask.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS.0\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [richup] C:\WINDOWS.0\System32ichup.exe O4 - HKLM\..\Run: [C:\WINDOWS.0\VCMnet11.exe] C:\WINDOWS.0\VCMnet11.exe O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS.0\wupdt.exe O4 - HKLM\..\Run: [checkrun] C:\windows.0\system32\eliteswb32.exe O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS.0\System32\uujmra.exe reg_run O4 - HKLM\..\Run: [q3mS3Fg] krnidc32.exe O4 - HKLM\..\Run: [AutoUpdater] 'C:\Program Files\AutoUpdate\AutoUpdate.exe' O4 - HKLM\..\Run: [version] C:\WINDOWS.0\System32\Zqmgao.exe O4 - HKLM\..\Run: [secure] C:\WINDOWS.0\System32\Essqxm.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [Nsv] C:\WINDOWS.0\System32
svsvc
svsvc.exe O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS.0\System32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin
ls.exe O4 - HKLM\..\Run: [aymqus] c:\windows.0\system32\kxduzd.exe r O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\RAGHU~1.ECS\LOCALS~1\Temp\sysnet.exe O4 - HKLM\..\Run: [knmgdll] C:\WINDOWS.0\knmgdll.EXE O4 - HKLM\..\Run: [knmgenc] C:\WINDOWS.0\knmgenc.EXE O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe' -quiet O4 - HKCU\..\Run: [CAS Client] 'C:\Program Files\Cas\Client\casclient.exe' O4 - HKCU\..\Run: [180ClientStubInstall] 'C:	emp\stubinstaller6480.exe' O4 - HKCU\..\Run: [CMAPP] 'C:\Program Files\CMAPP\Client\cmappclient.exe' O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O4 - Global Startup: HP OfficeJet Series 700 Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\Bin\HPOstr05.exe O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS.0\system32\sistray.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin
pjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin
pjpi142_06.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.kumudam.com/wfplayer/tdserver.cab O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\CMAPP\Client\cmappmf.dll O20 - Winlogon Notify: SMDEn - C:\WINDOWS.0\system32\mwlbui.dll O23 - Service: ewido security suite control - ewido networks - C:\ewido\security suite\ewidoctrl.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS.0\system32\LEXBCES.EXE O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS.0\daqvsvc.exe -

raghusr · Answer

Can someone help me with this? My home computer is not usable till I fix this. Thanks for any guidance!

RKinner · Answer

Download to your desktop: UnhookExec.inf from: http://securityresponse.symantec.com/avcenter/venc/data/tool.to.reset.shellopencommand.registry.keys.html and then right click on it and Install. Also Download to your desktop: DelDomain.inf from:   http://www.mvps.org/winhelp2002/restricted.htm  and then right click on it and Install. Also download and install ccleaner.exe from http://www.ccleaner.com. Don't let it clean anything yet.   Download the Hoster from: http://www.funkytoad.com/ Unpack to your desktop and run it.  If you see green text then press the Restore Original Hosts button and OK. If you see red text then press the Make Hosts Writable button then the Restore Original Hosts button and OK. Download it and unpack it and make sure it is uptodate but don't let it clean anything yet. Run HijackThis and just do a Scan only. Check the following - then Pay Attention!  These are the good guys - Press the Add To Ignore List Button: O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS.0\System32\keyhook.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS.0\SiSUSBrg.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS.0\System32\LXSUPMON.EXE RUN O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe' -quiet O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O4 - Global Startup: HP OfficeJet Series 700 Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\Bin\HPOstr05.exe O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS.0\system32\sistray.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin
pjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin
pjpi142_06.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O23 - Service: ewido security suite control - ewido networks - C:\ewido\security suite\ewidoctrl.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS.0\system32\LEXBCES.EXE   Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC maker's logo. Keep tapping until it tells you it is going to Safe Mode or you see the Safe Mode menu. Select the top option. Do a HijackThis Scan and check everything that shows up then it Fix Checked.   Wait 60 seconds and repeat the scan. Did anything come back? IF so leave HijackThis up and right click on the clock and select Task Manager. Then Processes. Find Explorer.exe, right click on it and select End Process. The desktop will disappear but HijackThis should still be there. IF you don't see it switch to Applications in Task Manager and highlight it there then press Switch To or just double click on it. Check and Fix Checked the above again. Restart Explorer by Task Manager, File, New Task(Run), explorer.exe, OK.   Run ccleaner.exe, uncheck everything on the first page except the two entries with Temporary and then Run Cleaner. Reboot into regular mode,then run another HijackThis log and post it as a reply. Let's see how we did.   Ron

raghusr · Answer

Thanks Ron, I will post my result.

raghusr · Answer

Hi Ron,

Followed your instructions. Following is the log after the cleanup.
Thanks in advance for your help.
-raghu

Logfile of HijackThis v1.99.1
Scan saved at 10:54:55 PM, on 7/15/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\LEXBCES.EXE
C:\WINDOWS.0\system32\LEXPPS.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\rundll32.exe
C:\WINDOWS.0\Explorer.EXE
c:\windows.0\system32\gkmofl.exe
C:\WINDOWS.0\System32\keyhook.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS.0\System32\pctspk.exe
C:\WINDOWS.0\System32\LXSUPMON.EXE
C:\WINDOWS.0\system\grbrcb.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\Bin\HPOstr05.exe
C:\WINDOWS.0\system32\sistray.exe
C:\Program Files\sder\dees.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\bin\HPOVDX05.EXE
C:\WINDOWS.0\System32\llrojn.exe
C:\WINDOWS.0\System32\wuauclt.exe
C:\hijackthis\HijackThis.exe

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS.0\systb.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [qbfanyw] c:\windows.0\system32\gkmofl.exe r
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS.0\wupdt.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS.0\System32\llrojn.exe reg_run
O20 - Winlogon Notify: DateTime - C:\WINDOWS.0\system32\mhuni11.dll
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS.0\svcproc.exe

RKinner · Answer

Start, Run, services.msc, OK (This should bring up the Services windows which can also be reached by Start, rightclick on My Computer, Manage, Services and Applications, Services.)

Scroll down in the right pane until you find

System Startup Service (SvcProc)

Doubleclick on it and STOP it. THen set the Startup Type: to Disabled. OK.

Run HijackThis in Safe Mode again.

Check & Fixed Checked everything EXCEPT

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto (You can add MsConfig to the Ignore list)

Use Killbox to delete On reboot (and Unregister .dll where appropriate):

C:\WINDOWS.0\systb.dll
C:\WINDOWS.0\svcproc.exe
C:\WINDOWS.0\wupdt.exe

Then reboot.

Download Find_Qoologic2.zip save it to your Desktop.

http://forums.net-integration.net/index.php?act=Attach&type=post&id=134981

Extract (unzip) the files inside into their own folder called FindQ.
Open the FindQ folder.

Locate and double-click the Find-Qoologic.bat file to run it. Wait until a text opens, post it in a reply to your thread.

You might find you get an error message when first running this file, if so close it and run again and wait until file.txt opens on desktop

Ignore the first list that opens with a long list of files and wait for FILE.TXT to pop up.

It normally takes somewhere between 10 to 15 minutes depending on your computer. Post the list as part of a reply.

Also let's try l2mfix:

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe.
Click the Install button to extract the files and follow the prompts,
then open the newly added l2mfix folder on your desktop. Double click
l2mfix.bat and select option #1 for Run Find Log by typing 1 and then
pressing enter. This will scan your computer and it may appear nothing
is happening, then, after a minute or 2, notepad will open with a log.
Copy the contents of that log and paste it into a reply.

Ron

raghusr · Answer

I will work this tonight and post results. Thanks for your help.

One quick question: After the first round of cleaning, I still see the ABI service and once I start browsing, I get the annoying IE windows. It would be helpful to know which of these steps would remove the ABI Service. There is no way to uninstall it.

RKinner · Answer

Usually ABI consists of nail.exe, a DLL and an exe file plus a service:

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS.0\svcproc.exe

In your case the nail is missing so I did not call for the ABI removal tool. You can try it
and see if it works but I suspect we are looking at a new version of ABI.

http://forum.hijackthis.de/showthread.php?t=3172

How are you detecting this as the ABI service? Does Ewido tell you that?

Add

C:\WINDOWS.0\system32\mhuni11.dll

to the list of file for killbox to delete on reboot.

Ron

raghusr · Answer

Followed instructions in your last two posts.

Regarding how I know ABI is there, I see it in the Add/Remove dialog.

All steps executed in the SAFE mode.
When I ran FindQoologic and l2mfix, I got an error about this being a 16-bit application, I followed the readme in FindQ and downloaded the fix. But I still got the error. The following log is with those errors.

LOg from FindQoologic:
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
some examples are MRT.EXE NTDLL.DLL.
»»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»»

(fstarts by IMM - test ver. 0.001) NOT using address check -- 0x77f7ecc3

Global Startup:
C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup
.
..
Adobe Reader Speed Launch.lnk
cckt.exe
desktop.ini
HP OfficeJet Series 700 Startup.lnk
Utility Tray.lnk

User Startup:
C:\Documents and Settings\Raghu.ECS-7JA0WPFC23U\Start Menu\Programs\Startup
.
..
desktop.ini
----------------End Findq log-------------------

L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{E22A54EA-0F58-9445-A775-BC1BB80974EF}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{5464D816-CF16-4784-B9F3-75C0DB52B499}"="Yahoo! Mail"
"{8FE76C9F-27AF-486C-B180-3E92B286EB89}"=""
"{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}"=""
"{DD1902B0-6531-4DA1-86A1-D1081230FBA4}"=""
"{70A7BB3B-6FF2-45AB-99B2-37033144E959}"=""
"{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}"=""
"{1D389DF2-8924-4CDD-9474-B84D20D01646}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8FE76C9F-27AF-486C-B180-3E92B286EB89}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8FE76C9F-27AF-486C-B180-3E92B286EB89}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8FE76C9F-27AF-486C-B180-3E92B286EB89}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8FE76C9F-27AF-486C-B180-3E92B286EB89}\InprocServer32]
@="C:\\WINDOWS.0\\system32\\mwlbui.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}\InprocServer32]
@="C:\\WINDOWS.0\\system32\\nJrrhook.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DD1902B0-6531-4DA1-86A1-D1081230FBA4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DD1902B0-6531-4DA1-86A1-D1081230FBA4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DD1902B0-6531-4DA1-86A1-D1081230FBA4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DD1902B0-6531-4DA1-86A1-D1081230FBA4}\InprocServer32]
@="C:\\WINDOWS.0\\system32\\onbccr32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{70A7BB3B-6FF2-45AB-99B2-37033144E959}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{70A7BB3B-6FF2-45AB-99B2-37033144E959}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{70A7BB3B-6FF2-45AB-99B2-37033144E959}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{70A7BB3B-6FF2-45AB-99B2-37033144E959}\InprocServer32]
@="C:\\WINDOWS.0\\system32\\oxmanage.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}\InprocServer32]
@="C:\\WINDOWS.0\\system32\\iksecsnp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1D389DF2-8924-4CDD-9474-B84D20D01646}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1D389DF2-8924-4CDD-9474-B84D20D01646}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1D389DF2-8924-4CDD-9474-B84D20D01646}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1D389DF2-8924-4CDD-9474-B84D20D01646}\InprocServer32]
@="C:\\WINDOWS.0\\system32\\mbrclr40.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 34D5-8D14

Directory of C:\WINDOWS.0\System32

07/15/2005 11:10 PM 417,792 mbrclr40.dll
07/15/2005 10:52 PM 417,792 kidbu.dll
07/15/2005 09:58 PM 417,792 mhuni11.dll
07/15/2005 09:57 PM 417,792 lwakgf.dll
07/13/2005 01:03 PM 401,408 n?lookup.exe
07/12/2005 08:21 PM 417,792 mjd32.dll
07/12/2005 07:40 PMMicrosoft
07/12/2005 07:27 PM 417,792 pdd.dll
07/10/2005 06:32 PM 417,792 ttflog.dll
07/02/2005 09:17 PM 417,792 guard.tmp
07/02/2005 09:07 PM 417,792 mwlbui.dll
07/02/2005 09:06 PMdllcache
06/29/2005 08:33 AM 401,408 ??xplore.exe
11 File(s) 4,562,944 bytes
2 Dir(s) 32,868,847,616 bytes free

RKinner · Answer

OK.  Looks like l2mfix found something.  Run the l2mfix.bat again and this time select option #2.  This should remove the files and the bad registry entries.  It will reboot during the process and finish with a logfile.  Copy the log file and paste it into a reply.  Then run a new HijackThis log and add it to the reply.   Ron

raghusr · Answer

Assuming I have to do it in the SAFE mode.

raghusr · Answer

I got 2 logs runnning l2mfix: First when I ran it in the SAFE mode and then the one in the regular mode.

Hijack log shows Nail.exe back and some of the items I removed has come back (O23) and ABI is still there - I am still seeing popus.

I wish they would pass the law making any intrusion illegal!

Thanks for your continuous help.

LOg from regular mode:

L2Mfix 1.03a

Running From:
C:\Documents and Settings\Raghu.ECS-7JA0WPFC23U\Desktop\l2mfix

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting up for Reboot

Starting Reboot!

C:\Documents and Settings\Raghu.ECS-7JA0WPFC23U\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Raghu.ECS-7JA0WPFC23U\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1636 'explorer.exe'
Killing PID 1636 'explorer.exe'
Killing PID 1636 'explorer.exe'
Killing PID 1636 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Error, Cannot find a process with an image name of rundll32.exe

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS.0\system32\kidbu.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\kidbu.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\lwakgf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\lwakgf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mbrclr40.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mbrclr40.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mhuni11.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mhuni11.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mjd32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mjd32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mwlbui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\mwlbui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\pdd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\pdd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\ttflog.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\ttflog.dll
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS.0\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS.0\system32\kidbu.dll
Successfully Deleted: C:\WINDOWS.0\system32\kidbu.dll
deleting: C:\WINDOWS.0\system32\kidbu.dll
Successfully Deleted: C:\WINDOWS.0\system32\kidbu.dll
deleting: C:\WINDOWS.0\system32\lwakgf.dll
Successfully Deleted: C:\WINDOWS.0\system32\lwakgf.dll
deleting: C:\WINDOWS.0\system32\lwakgf.dll
Successfully Deleted: C:\WINDOWS.0\system32\lwakgf.dll
deleting: C:\WINDOWS.0\system32\mbrclr40.dll
Successfully Deleted: C:\WINDOWS.0\system32\mbrclr40.dll
deleting: C:\WINDOWS.0\system32\mbrclr40.dll
Successfully Deleted: C:\WINDOWS.0\system32\mbrclr40.dll
deleting: C:\WINDOWS.0\system32\mhuni11.dll
Successfully Deleted: C:\WINDOWS.0\system32\mhuni11.dll
deleting: C:\WINDOWS.0\system32\mhuni11.dll
Successfully Deleted: C:\WINDOWS.0\system32\mhuni11.dll
deleting: C:\WINDOWS.0\system32\mjd32.dll
Successfully Deleted: C:\WINDOWS.0\system32\mjd32.dll
deleting: C:\WINDOWS.0\system32\mjd32.dll
Successfully Deleted: C:\WINDOWS.0\system32\mjd32.dll
deleting: C:\WINDOWS.0\system32\mwlbui.dll
Successfully Deleted: C:\WINDOWS.0\system32\mwlbui.dll
deleting: C:\WINDOWS.0\system32\mwlbui.dll
Successfully Deleted: C:\WINDOWS.0\system32\mwlbui.dll
deleting: C:\WINDOWS.0\system32\pdd.dll
Successfully Deleted: C:\WINDOWS.0\system32\pdd.dll
deleting: C:\WINDOWS.0\system32\pdd.dll
Successfully Deleted: C:\WINDOWS.0\system32\pdd.dll
deleting: C:\WINDOWS.0\system32\ttflog.dll
Successfully Deleted: C:\WINDOWS.0\system32\ttflog.dll
deleting: C:\WINDOWS.0\system32\ttflog.dll
Successfully Deleted: C:\WINDOWS.0\system32\ttflog.dll
deleting: C:\WINDOWS.0\system32\guard.tmp
Successfully Deleted: C:\WINDOWS.0\system32\guard.tmp
deleting: C:\WINDOWS.0\system32\guard.tmp
Successfully Deleted: C:\WINDOWS.0\system32\guard.tmp

Zipping up files for submission:
adding: kidbu.dll (164 bytes security) (deflated 48%)
adding: lwakgf.dll (164 bytes security) (deflated 48%)
adding: mbrclr40.dll (164 bytes security) (deflated 48%)
adding: mhuni11.dll (164 bytes security) (deflated 48%)
adding: mjd32.dll (164 bytes security) (deflated 48%)
adding: mwlbui.dll (164 bytes security) (deflated 48%)
adding: pdd.dll (164 bytes security) (deflated 48%)
adding: ttflog.dll (164 bytes security) (deflated 48%)
adding: guard.tmp (164 bytes security) (deflated 48%)
adding: clear.reg (164 bytes security) (deflated 58%)
adding: echo.reg (164 bytes security) (deflated 9%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 83%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 64%)
adding: test.txt (164 bytes security) (deflated 86%)
adding: test2.txt (164 bytes security) (deflated 39%)
adding: test3.txt (164 bytes security) (deflated 39%)
adding: test5.txt (164 bytes security) (deflated 39%)
adding: xfind.txt (164 bytes security) (deflated 83%)
adding: backregs/1D389DF2-8924-4CDD-9474-B84D20D01646.reg (164 bytes security) (deflated 70%)
adding: backregs/70A7BB3B-6FF2-45AB-99B2-37033144E959.reg (164 bytes security) (deflated 70%)
adding: backregs/8FE76C9F-27AF-486C-B180-3E92B286EB89.reg (164 bytes security) (deflated 70%)
adding: backregs/BAA54271-16D9-40D2-9CF1-2EBE06E8D45A.reg (164 bytes security) (deflated 70%)
adding: backregs/DD1902B0-6531-4DA1-86A1-D1081230FBA4.reg (164 bytes security) (deflated 70%)
adding: backregs/EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: kidbu.dll
deleting local copy: kidbu.dll
deleting local copy: lwakgf.dll
deleting local copy: lwakgf.dll
deleting local copy: mbrclr40.dll
deleting local copy: mbrclr40.dll
deleting local copy: mhuni11.dll
deleting local copy: mhuni11.dll
deleting local copy: mjd32.dll
deleting local copy: mjd32.dll
deleting local copy: mwlbui.dll
deleting local copy: mwlbui.dll
deleting local copy: pdd.dll
deleting local copy: pdd.dll
deleting local copy: ttflog.dll
deleting local copy: ttflog.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

The following are the files found:
****************************************************************************
C:\WINDOWS.0\system32\kidbu.dll
C:\WINDOWS.0\system32\kidbu.dll
C:\WINDOWS.0\system32\lwakgf.dll
C:\WINDOWS.0\system32\lwakgf.dll
C:\WINDOWS.0\system32\mbrclr40.dll
C:\WINDOWS.0\system32\mbrclr40.dll
C:\WINDOWS.0\system32\mhuni11.dll
C:\WINDOWS.0\system32\mhuni11.dll
C:\WINDOWS.0\system32\mjd32.dll
C:\WINDOWS.0\system32\mjd32.dll
C:\WINDOWS.0\system32\mwlbui.dll
C:\WINDOWS.0\system32\mwlbui.dll
C:\WINDOWS.0\system32\pdd.dll
C:\WINDOWS.0\system32\pdd.dll
C:\WINDOWS.0\system32\ttflog.dll
C:\WINDOWS.0\system32\ttflog.dll
C:\WINDOWS.0\system32\guard.tmp
C:\WINDOWS.0\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{8FE76C9F-27AF-486C-B180-3E92B286EB89}"=-
"{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}"=-
"{DD1902B0-6531-4DA1-86A1-D1081230FBA4}"=-
"{70A7BB3B-6FF2-45AB-99B2-37033144E959}"=-
"{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}"=-
"{1D389DF2-8924-4CDD-9474-B84D20D01646}"=-
[-HKEY_CLASSES_ROOT\CLSID\{8FE76C9F-27AF-486C-B180-3E92B286EB89}]
[-HKEY_CLASSES_ROOT\CLSID\{BAA54271-16D9-40D2-9CF1-2EBE06E8D45A}]
[-HKEY_CLASSES_ROOT\CLSID\{DD1902B0-6531-4DA1-86A1-D1081230FBA4}]
[-HKEY_CLASSES_ROOT\CLSID\{70A7BB3B-6FF2-45AB-99B2-37033144E959}]
[-HKEY_CLASSES_ROOT\CLSID\{EBB0C6FE-A4E0-4BF8-9429-FFDCE6651372}]
[-HKEY_CLASSES_ROOT\CLSID\{1D389DF2-8924-4CDD-9474-B84D20D01646}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************

When I first ran L2Mfix SAFE Mode:

L2Mfix 1.03a

Running From:
C:\Documents and Settings\Raghu.ECS-7JA0WPFC23U\Desktop\l2mfix

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting up for Reboot

Starting Reboot!

Logfile of HijackThis v1.99.1
Scan saved at 7:44:05 PM, on 7/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\Explorer.exe
c:\windows.0\system32\odwhjr.exe
C:\WINDOWS.0\System32\llrojn.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS.0\Nail.exe
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS.0\systb.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [winsync] C:\WINDOWS.0\System32\llrojn.exe reg_run
O4 - HKLM\..\Run: [C:\WINDOWS.0\VCMnet11.exe] C:\WINDOWS.0\VCMnet11.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS.0\wupdt.exe
O4 - HKLM\..\Run: [second] C:\Documents and Settings\Raghu.ECS-7JA0WPFC23U\Desktop\l2mfix\second.bat
O4 - HKLM\..\Run: [dcvocd] c:\windows.0\system32\odwhjr.exe r
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows.0\SvcProc.exe

RKinner · Answer

OK.    Looks like l2mfix is not quite done so just reboot once and let's see if its entry goes away.    Then get ABIRemover from:   http://forum.hijackthis.de/attachment.php?attachmentid=177   and unpack it to your desktop.   Then boot into Safe Mode.   Run ABIRemover.  It will reboot when done but you must make sure you boot back into Safe Mode then run HijackThis and check/Fix Checked the usual suspects.   Then reboot and run HijackThis and see what survives.   Ron

raghusr · Answer

Looks like the ABIRemover fixed it! Don't see the random windows. I will wait for the day before declaring victory!

Here are the log files before and after.

Two questions:
1) Is this harmful:
O4 - HKLM\..\Run: [C:\WINDOWS.0\VCMnet11.exe] C:\WINDOWS.0\VCMnet11.exe

2) My system startup has these entries: Should I disable them?
keyhook
SisUSBrg
Soundman
pctspk
VCMnet11

AFTER running ABIRemover:
Logfile of HijackThis v1.99.1
Scan saved at 8:07:11 AM, on 7/23/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\LEXBCES.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\system32\LEXPPS.EXE
C:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\System32\keyhook.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS.0\System32\pctspk.exe
C:\WINDOWS.0\System32\LXSUPMON.EXE
C:\WINDOWS.0\system\grbrcb.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\Bin\HPOstr05.exe
C:\WINDOWS.0\system32\sistray.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\bin\HPOVDX05.EXE
C:\WINDOWS.0\System32\wuauclt.exe
C:\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [C:\WINDOWS.0\VCMnet11.exe] C:\WINDOWS.0\VCMnet11.exe

BEFORE running ABIREMOVER:
Logfile of HijackThis v1.99.1
Scan saved at 7:52:09 AM, on 7/23/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\NOTEPAD.EXE
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS.0\systb.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [winsync] C:\WINDOWS.0\System32\llrojn.exe reg_run
O4 - HKLM\..\Run: [C:\WINDOWS.0\VCMnet11.exe] C:\WINDOWS.0\VCMnet11.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS.0\wupdt.exe
O4 - HKLM\..\Run: [khrhfuj] c:\windows.0\system32\emxhefu.exe r
O4 - Global Startup: cckt.exe

RKinner · Answer

You want to get rid of vcmnet11.exe:   http://www.bleepingcomputer.com/forums/How_to_remove_AFA_Internet_Enhancement_or_Vcmnet11exe-t19277.html   The others are OK.   Ron

raghusr · Answer

I will try your suggestion.

My rosy prediction of a clean computer came part in the first 15 mins of surfing. It was not ABI, but I had numerous IE windoes opening up. In frustration, I shut my system down.

I will repeat the steps I took in the last few posts and will post logs.

Virus & Spyware

ABI Network spyware - Log files

Was this post helpful?