AIB Please help!!!!

Question

I can't rmove this crud from my computer.  Please help me, I appreciate your efforts!!!  Here's my log:   Logfile of HijackThis v1.99.1 Scan saved at 12:06:57 PM, on 6/16/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\system32\svchost.exe C:\WINNT\system32
vsvc32.exe C:\WINNT\system32egsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\D-Link\Air Utility\AirCFG.exe C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Lexmark X74-X75\lxbbbmon.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINNT\system32\wuauclt.exe C:\WINNT\system32\wisptis.exe C:\WINNT\system32undll32.exe C:\WINNT\explorer.exe c:\winnt\system32\jubmnl.exe c:\winnt\system32\packager.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CLQFST6R\HijackThis[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tradingday.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tradingday.com/ O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINNT\ceres.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Internet Explorer Hot Fix - {EE59EB5A-3608-4A50-929D-178EDD7C00D7} - C:\WINNT\system32\bcvgc.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file) O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Lexmark X74-X75] 'C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe' O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKLM\..\Run: [jubmnl] c:\winnt\system32\jubmnl.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe O4 - HKCU\..\Run: [WareOut] 'C:\Program Files\WareOut\WareOut.exe' O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409 O16 - DPF: {7CEEAB76-D59E-11D3-8394-00C04F7BDF10} (Application Class) - https://www.tradestation.com/tscom/ClientPlugIn/tsTemp.cab O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{2EB55295-DDAF-4D49-9E6D-08EF15C2DF55}: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CCS\Services\Tcpip\..\{C15D290C-8826-41F4-A75F-BC83273A5560}: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CS1\Services\Tcpip\..\{2EB55295-DDAF-4D49-9E6D-08EF15C2DF55}: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37 O20 - Winlogon Notify: style2 - C:\WINNT\q86338347_disk.dll O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32
vsvc32.exe

zbestwun2001 · Answer

Hi and welcome

-

Be sure to look this solution over before you begin. There are a some item(s) I'm not familar with. If you recognze any, then just omit them from this fix.

Go to Add/Remove programs and remove(uninstall) the following, if present:

BetterInternet

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

If you don't already have it, let's go to Lavasoft's VX2 Cleaner web-page, and follow the instructions to download and install the utility.

-

Next, run AdAware SE Personal, then:

1. Click " Add-Ons".
2. Double-click " VX2 Cleaner"
3. Click " Ok", to " Execute this tool".
4. If nothing is found, click " Ok", then exit the program.

(or)

4. If VX2 has been found on your system, click " Clean System"
5. Then when it's complelely done, reboot your computer.
6. Repeat steps 1-4 again.

Be sure to follow any instructions it might give while using it.

Run HiJackThis then:

1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"

-

Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

c:\winnt\system32\jubmnl.exe

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.

Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

regsvr32 /u ceres.dll
regsvr32 /u bcvgc.dll

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save on the typing.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINNT\ceres.dll
O2 - BHO: Internet Explorer Hot Fix - {EE59EB5A-3608-4A50-929D-178EDD7C00D7} - C:\WINNT\system32\bcvgc.dll

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [jubmnl] c:\winnt\system32\jubmnl.exe
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
... (Unless you've set these with a anti-spyware program like SpyBot's Immunize feature, have HiJackThis fix this.)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409

O17 - HKLM\System\CCS\Services\Tcpip\..\{2EB55295-DDAF-4D49-9E6D-08EF15C2DF55}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{C15D290C-8826-41F4-A75F-BC83273A5560}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CS1\Services\Tcpip\..\{2EB55295-DDAF-4D49-9E6D-08EF15C2DF55}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37
...( Verify that these ip addresses are for your isp's DNS Servers, if so, don't 'fix' these.)

Now, with all windows closed except HiJackThis, click " Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...
C:\Program Files\WareOut

files...
c:\winnt\system32\jubmnl.exe
C:\WINNT\ceres.dll
C:\WINNT\system32\bcvgc.dll

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

files...

c:\winnt\system32\jubmnl.exe
C:\WINNT\ceres.dll
C:\WINNT\system32\bcvgc.dll
C:\Program Files\WareOut\WareOut.exe

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Reboot and post back a new log, and let me know how everything goes.

Steve

zbestwun2001 · Answer

First of all I need a fresh HJT log to see what is causing that, thanks Steve

kennington · Answer

Steve,

Thanks for your wonderfully contructed reply to my computer problem. How about my system, after it down, now seems to have another issue. I ran Microsoft's antispyware to try and eliminate the abi problem but after restarting my computer it seems to be in a perpetual loop. The message I keep getting after logging on is a program error box with the words explorer.exe has generated errors will be closed by windows. You will need to restart the program. An error log is being created. Cancel. When I go to hit the cancel button/ok button another window with the exact same message appears. This process keeps repeating itself and it seems there's nothing that I can do. Box after box pops up with the exact same message. I also tried starting in the safe mode and going to the task manager to try and fix the problem but the same problematic loop keeps repeating itself. Thanks in advance for any advise on how to solve this.

kennington · Answer

Steve,

That's my problem, I can't seem to get into my system. After I type in my pasword to log on to Windows, the administrator, internet explorer box error after box error pop up and I never am able to get any further, it's like I'm stuck at that point. Any suggestion on how to get beyond that? Thanks again!!!

zbestwun2001 · Answer

What does the error say?

zbestwun2001 · Answer

From the computer you are posting from NOW log on to this, I am there now till 2:15 PDT

Online Assistance.
Just click on the link (left click) and save it to your desktop, or
right-click and select "Save Link As..." or "Save Target As...".
Double-click the downloaded program, it to start it up (you'll need
.NET installed for it to run properly), then just enter your Dell forum
name (mine is "zbestwun2001").

Message Edited by zbestwun2001 on 06-16-2005 01:36 PM

Message Edited by zbestwun2001 on 06-16-2005 01:51 PM

zbestwun2001 · Answer

Let's try this.

Ignore the error message, don't click on anything. See if you can bring the Task Manager up, (Ctrl-Alt-Del).
If you can END Task explore.exe

Click on File>New Task, type in cmd. Hit Enter. Have him type the following:

copy C:\i386\explorer.exe C:\WINNT\

NOTE: there is a space in between "copy" and "C:\i386\explorer.exe". And a space in between "C:\i386\explorer.exe" and "C:\WINNT\".

Hit enter. Press Y to overwrite. Exit the command box.

Click File>New Task in the Task Manager. Type in explorer. Hit enter.

See if this works.

Steve

Message Edited by zbestwun2001 on 06-16-2005 04:26 PM

Virus & Spyware

AIB Please help!!!!

Was this post helpful?