My HIJACKTHIS Log -- Please Respond! :)

Question

Logfile of HijackThis v1.99.1 Scan saved at 2:09:21 PM, on 8/8/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\VHJpc2hhIFJheQAA\command.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe C:\WINDOWS	askbar.exe C:\WINDOWS\seeve.exe C:\WINDOWS\system32\vidctrl\vidctrl.exe C:\WINDOWS\system32\exp.exe C:\WINDOWS\system32\wintask.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\system32undll32.exe C:\Program Files\Rebate Retriever\RebateRetriever.exe C:\WINDOWS\etb\pokapoka62.exe C:\WINDOWS\system32\hmunkn.exe C:\WINDOWS\system32
svsvc
svsvc.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\Program Filesdso\eetu.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cardinal.wju.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp3\winampa.exe' O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [ulszkf] c:\windows\system32\ulszkf.exe O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe O4 - HKLM\..\Run: [Search Bar] C:\WINDOWS	askbar.exe O4 - HKLM\..\Run: [seeve] C:\WINDOWS\seeve.exe O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [ttupt] C:\WINDOWS	tupt.exe O4 - HKLM\..\Run: [mmtask] 'C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe' O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C O4 - HKLM\..\Run: [Rebate Retriever] C:\Program Files\Rebate Retriever\RebateRetriever.exe O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exe O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32
svsvc
svsvc.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) O10 - Broken Internet access because of LSP provider 'c:\program files
ewdotnet
ewdotnet6_30.dll' missing O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O15 - Trusted Zone: *.media-motor.net O15 - Trusted Zone: *.popuppers.com O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/198f28ea773f06d4e822/netzip/RdxIE2.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\owexl32.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VHJpc2hhIFJheQAA\command.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)

RKinner · Answer

Download the Hoster from: http://www.funkytoad.com/ Unpack to your desktop and run it.  If you see green text then press the Restore Original Hosts button and OK.If you see red text then press the Make Hosts Writable button then the Restore Original Hosts button and OK. Also Download to your desktop: DelDomain.inf from: http://www.mvps.org/winhelp2002/restricted.htm  and then right click on it and Install. Also download and install ccleaner.exe from http://www.ccleaner.com. Don't letit clean anything yet. If your desktop is messed up also:Get smitfraud.reg from http://www.bleepingcomputer.com/files/reg/smitfraud.regYou can run it but it might be immediately overwritten.    Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PCmaker's logo.Keep tapping until it tells you it is going to Safe Mode or you see the SafeMode menu. Select the top option. Do a HijackThis Scan and check the following then Fix Checked. O4 - HKLM\..\Run: [ulszkf] c:\windows\system32\ulszkf.exeO4 - HKLM\..\Run: [Search Bar] C:\WINDOWS	askbar.exeO4 - HKLM\..\Run: [seeve] C:\WINDOWS\seeve.exeO4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exeO4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exeO4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exeO4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exeO4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRunO4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16O4 - HKLM\..\Run: [ttupt] C:\WINDOWS	tupt.exeO4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318CO4 - HKLM\..\Run: [Rebate Retriever] C:\Program Files\Rebate Retriever\RebateRetriever.exeO4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exeO4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_runO4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exeO4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32
svsvc
svsvc.exeO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)O10 - Broken Internet access because of LSP provider 'c:\program files
ewdotnet
ewdotnet6_30.dll' missingO15 - Trusted Zone: *.media-motor.netO15 - Trusted Zone: *.popuppers.comO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/198f28ea773f06d4e822/netzip/RdxIE2.cabO18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\Cas\Client\casmf.dllO20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\owexl32.dllO23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VHJpc2hhIFJheQAA\command.exeO23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing) If your desktop was messed up: Run smitfraud.reg and let it install. Run ccleaner.exe, uncheck everything on the first page except the two entrieswith Temporary and then Run Cleaner. Rerun the hoster and reinstall  deldomain.inf just to be sure.   Reboot into regular mode.   If the desktop was messed up then: Start, Control Panel , Display, Background and set the wall paper for something you like.  Then press the Web tab and make sure the Enable Web CoOntent button is not selected.   Run a new Hijackthis log and post it as a reply to this post.  Let's see how we did.   Ron

RayRay705 · Answer

Ron, I'm not sure if the problem is fixed or not. I'm still receiving pop-ups, and I was not able to perform some of the functions that you recommended, due to the 'security settings' on my computer. So if the security settings on this computer are SUPPOSIVELY so high, then why does it allow unnecessary information (the pop-ups) through, yet not the information that is actually important is blocked? It doesn't make sense to me. Thanks so much for your help, though! Please respond. Thanks. :) -Kacie   Logfile of HijackThis v1.99.1 Scan saved at 1:09:40 PM, on 8/10/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\VHJpc2hhIFJheQAA\command.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\system32\hmunkn.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\HJT\hijackthis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cardinal.wju.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp3\winampa.exe' O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe O4 - HKLM\..\Run: [mmtask] 'C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe' O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files
ewdotnet
ewdotnet6_30.dll' missing O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\baowser.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VHJpc2hhIFJheQAA\command.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)

RKinner · Answer

Please tell me exactly which happens when you can't download something or can't run a program. I have other links that might work and other ways to get things done.

Start then Right click on My Computer and select Manage then Services and Applications then Services.
In the right pane scroll down until you see Task Scheduler.
Double click on it and then change the Startup type to disabled and STOP it. I am seeing a lot of spyware
installing jobs in the task scheduler that reinstall them if they are removed so I want to be sure that doesn't happen.

Now while still in the services pane, find

Command Service (cmdService)

and disable him and stop him the same way. This one is malware and we will not be turning him back on.

Close the services window.

See if you are able to download killbox.exe from:

Download the Killbox.

http://www.downloads.subratam.org/KillBox.exe

Save it to the desktop

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.

Run HijackThis again and check/ Fix Checked

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\baowser.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VHJpc2hhIFJheQAA\command.exe

Double-click Killbox.exe to run it.

Select "Delete on Reboot".
Place the following line in the "Full Path of File to Delete" box in Killbox:

C:\WINDOWS\system32\baowser.dll

check the unregister dll box and then hit the red button. Agree you want to delete it but don't let it reboot yet.

Repeat for:

C:\WINDOWS\VHJpc2hhIFJheQAA\command.exe

without the unregister dll box.

C:\WINDOWS\system32\hmunkn.exe

C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\

and this time press the DELTREE box.

C:\WINDOWS\VHJpc2hhIFJheQAA

press the DELTREE box.

Let it reboot this time and boot into regular mode.

Post a new HJT scan as a reply.

Do you have a (non dialup) fast link? If you still see the

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run

you can get mwav.exe from:

http://www.spywareinfo.dk/download/mwav.exe
and install it and check for updates then

reboot into Safe Mode (F8) and run the escan(mwav) program. Select all options and let it run for a few hours. It will eventually create a log file. It will remove anything it finds that it considers a virus or try to. Adware it just flags in the log. You have to go through the log for entries like:
Fri Jul 29 10:25:26 2005 => File C:\WINDOWS\System32\06wu29rd.exe tagged as not-a-virus:AdWare.F1Organizer.g. No Action Taken.

(hint use Notepad's Edit, Find to search for: not-a-virus)

then use killbox to clean the adware manually. Double-click Killbox.exe to run it.
Select "Delete on Reboot".
Place the full path in the "Full Path of File to Delete" box in Killbox:
example: C:\WINDOWS\System32\06wu29rd.exe
Press the red button, agree you want to delete the file but do not let it reboot yet. Repeat for every not-a-virus entry then let it reboot after the last one.

Ron

RayRay705 · Answer

Logfile of HijackThis v1.99.1 Scan saved at 3:42:49 PM, on 8/10/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startuptcp.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\HJT\hijackthis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cardinal.wju.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp3\winampa.exe' O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe O4 - HKLM\..\Run: [mmtask] 'C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe' O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files
ewdotnet
ewdotnet6_30.dll' missing O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\baowser.dll O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)

RKinner · Answer

We still have 2 left:

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run

O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\baowser.dll

and I'm going to add this one to the list. It's in an odd place.

O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

Check/Fix Checked these again and then:

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe.
Click the Install button and follow the prompts,
doubleclick on the l2mfix folder on your desktop.
Double click l2mfix.bat and select option #2

It will reboot your system and present you with a log file.
Post the log file and a new HJT log
in your next reply.

Ron

RayRay705 · Answer

Ron, in the 'l2mfix folder' there isn't anything that says 'l2mfix.bat'   Also, just to let you know...one of the main problems we're having is a pop-up for 'Win-Fix.' It just keeps coming back. Have you ever heard of that? -Kacie

RKinner · Answer

XP is hiding the extensions from you.  On your PC you will only see: l2mfix so double click on it.   win fix is quite common these days.  I think we are on the right track to kill it.   Ron

RayRay705 · Answer

Here is the l2mfix log..... Setting Directory C:\Documents and Settings\Kacie Ray Setting Directory C:\Documents and Settings\Kacie Ray System Rebooted!   Running From: C:\Documents and Settings\Kacie Ray   killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 820 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Error, Cannot find a process with an image name of rundll32.exe   Scanning First Pass. Please Wait!   Setting Directory C:\Documents and Settings\Kacie Ray System Rebooted!   Running From: C:\Documents and Settings\Kacie Ray   killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 564 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Error, Cannot find a process with an image name of rundll32.exe Setting Directory C:\Documents and Settings\Kacie Ray System Rebooted!   Running From: C:\Documents and Settings\Kacie Ray   killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 552 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Error, Cannot find a process with an image name of rundll32.exe   Scanning First Pass. Please Wait!   First Pass Completed   Second Pass Scanning   Second pass Completed! Backing Up: C:\WINDOWS\system32\baowser.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\baowser.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\mijter35.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\mijter35.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\mlyuv.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\mlyuv.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\ocbcjt32.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\ocbcjt32.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\owexl32.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\owexl32.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32	Kembed.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32	Kembed.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\vkmdbg.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\vkmdbg.dll         1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp         1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp         1 file(s) copied. deleting: C:\WINDOWS\system32\baowser.dll  Successfully Deleted: C:\WINDOWS\system32\baowser.dll deleting: C:\WINDOWS\system32\baowser.dll  Successfully Deleted: C:\WINDOWS\system32\baowser.dll deleting: C:\WINDOWS\system32\mijter35.dll  Successfully Deleted: C:\WINDOWS\system32\mijter35.dll deleting: C:\WINDOWS\system32\mijter35.dll  Successfully Deleted: C:\WINDOWS\system32\mijter35.dll deleting: C:\WINDOWS\system32\mlyuv.dll  Successfully Deleted: C:\WINDOWS\system32\mlyuv.dll deleting: C:\WINDOWS\system32\mlyuv.dll  Successfully Deleted: C:\WINDOWS\system32\mlyuv.dll deleting: C:\WINDOWS\system32\ocbcjt32.dll  Successfully Deleted: C:\WINDOWS\system32\ocbcjt32.dll deleting: C:\WINDOWS\system32\ocbcjt32.dll  Successfully Deleted: C:\WINDOWS\system32\ocbcjt32.dll deleting: C:\WINDOWS\system32\owexl32.dll  Successfully Deleted: C:\WINDOWS\system32\owexl32.dll deleting: C:\WINDOWS\system32\owexl32.dll  Successfully Deleted: C:\WINDOWS\system32\owexl32.dll deleting: C:\WINDOWS\system32	Kembed.dll  Successfully Deleted: C:\WINDOWS\system32	Kembed.dll deleting: C:\WINDOWS\system32	Kembed.dll  Successfully Deleted: C:\WINDOWS\system32	Kembed.dll deleting: C:\WINDOWS\system32\vkmdbg.dll  Successfully Deleted: C:\WINDOWS\system32\vkmdbg.dll deleting: C:\WINDOWS\system32\vkmdbg.dll  Successfully Deleted: C:\WINDOWS\system32\vkmdbg.dll deleting: C:\WINDOWS\system32\guard.tmp  Successfully Deleted: C:\WINDOWS\system32\guard.tmp deleting: C:\WINDOWS\system32\guard.tmp  Successfully Deleted: C:\WINDOWS\system32\guard.tmp     Zipping up files for submission:   adding: baowser.dll (140 bytes security) (deflated 48%)   adding: mijter35.dll (140 bytes security) (deflated 48%)   adding: mlyuv.dll (140 bytes security) (deflated 48%)   adding: ocbcjt32.dll (140 bytes security) (deflated 48%)   adding: owexl32.dll (140 bytes security) (deflated 48%)   adding: tKembed.dll (140 bytes security) (deflated 48%)   adding: vkmdbg.dll (140 bytes security) (deflated 48%)   adding: guard.tmp (140 bytes security) (deflated 48%)   adding: clear.reg (140 bytes security) (deflated 2%)   adding: lo2.txt (140 bytes security) (deflated 87%)   adding: test.txt (140 bytes security) (deflated 84%)   adding: test2.txt (140 bytes security) (stored 0%)   adding: test3.txt (140 bytes security) (stored 0%)   adding: test5.txt (140 bytes security) (stored 0%)   adding: xfind.txt (140 bytes security) (deflated 81%)   Restoring Registry Permissions:   RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de) This program is Freeware, use it on your own risk! Revoking access for predefined group 'Administrators' Inherited ACE can not be revoked here! Inherited ACE can not be revoked here!   Registry permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI)    ALLOW  Full access  NT AUTHORITY\SYSTEM (IO)    ALLOW  Full access  NT AUTHORITY\SYSTEM (NI)    ALLOW  Full access  NT AUTHORITY\SYSTEM (IO)    ALLOW  Full access  NT AUTHORITY\SYSTEM (ID-NI) ALLOW  Read         BUILTIN\Users (ID-IO) ALLOW  Read         BUILTIN\Users (ID-NI) ALLOW  Full access  BUILTIN\Administrators (ID-IO) ALLOW  Full access  BUILTIN\Administrators (ID-NI) ALLOW  Full access  NT AUTHORITY\SYSTEM (ID-IO) ALLOW  Full access  NT AUTHORITY\SYSTEM (ID-IO) ALLOW  Full access  CREATOR OWNER Restoring Sedebugprivilege:    Granting SeDebugPrivilege to Administrators   ... successful   deleting local copy: baowser.dll   deleting local copy: baowser.dll   deleting local copy: mijter35.dll   deleting local copy: mijter35.dll   deleting local copy: mlyuv.dll   deleting local copy: mlyuv.dll   deleting local copy: ocbcjt32.dll   deleting local copy: ocbcjt32.dll   deleting local copy: owexl32.dll   deleting local copy: owexl32.dll   deleting local copy: tKembed.dll   deleting local copy: tKembed.dll   deleting local copy: vkmdbg.dll   deleting local copy: vkmdbg.dll   deleting local copy: guard.tmp   deleting local copy: guard.tmp     The following Is the Current Export of the Winlogon notify key: **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] 'Asynchronous'=dword:00000000 'DllName'='' 'Impersonate'=dword:00000000 'Logon'='WinLogon' 'Logoff'='WinLogoff' 'Shutdown'='WinShutdown'   The following are the files found: **************************************************************************** C:\WINDOWS\system32\baowser.dll C:\WINDOWS\system32\baowser.dll C:\WINDOWS\system32\mijter35.dll C:\WINDOWS\system32\mijter35.dll C:\WINDOWS\system32\mlyuv.dll C:\WINDOWS\system32\mlyuv.dll C:\WINDOWS\system32\ocbcjt32.dll C:\WINDOWS\system32\ocbcjt32.dll C:\WINDOWS\system32\owexl32.dll C:\WINDOWS\system32\owexl32.dll C:\WINDOWS\system32	Kembed.dll C:\WINDOWS\system32	Kembed.dll C:\WINDOWS\system32\vkmdbg.dll C:\WINDOWS\system32\vkmdbg.dll C:\WINDOWS\system32\guard.tmp C:\WINDOWS\system32\guard.tmp   Registry Entries that were Deleted: Please verify that the listing looks ok.  If there was something deleted wrongly there are backups in the backreg folder. **************************************************************************** REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] 'SV1'='' **************************************************************************** Desktop.ini Contents: **************************************************************************** ****************************************************************************   and here is the HiJackThis log..... Logfile of HijackThis v1.99.1 Scan saved at 5:42:11 PM, on 8/11/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\system32\hmunkn.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\HJT\hijackthis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cardinal.wju.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~1\mm_tray.exe O4 - HKLM\..\Run: [mmtask] 'C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe' O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_run O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files
ewdotnet
ewdotnet6_30.dll' missing O12 - Plugin for .aif: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)   Thanks! :)

RKinner · Answer

Sorry for the delay.  Somehow I didn't notice your response.   l2mfix did a good job and got rid of the infection it was designed to fix but we still have a qoologic infection.   O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hmunkn.exe reg_ru   I have had good luck with qoologic with mwav (see my earlier post) run in safe mode but it does take a long time to download on a dialup and then it takes an hour to two or three to run.  However, if you have a DSL or cable modem then I'd suggest you try it.  Don't try and post the log.  It will be enormous.  After running it reboot and run HijackTHis if the KavSvc line is no longer present or at least says file missing then it worked.   An alternative is to get two programs and run them in SAFE MODE and post the logs.   First track qoo   http://www.geekstogo.com/downloads/Trackqoo.zip   Right Click the Zip Folder and Select 'Extract All' to your desktop   and second:   winpfind   http://www.bleepingcomputer.com/files/winpfind.php   Right Click the Zip Folder and Select 'Extract All' to your desktop.  It should create a folder called winpfind. Don't use it yet! Restart in Safe Mode Doubleclick on winpfind folder and then Doubleclick WinPFind.exe and Click 'Start Scan' It will scan the entire System, so please be patient!  (~ 30 minutes or so) Once the Scan is Complete-> Locate WinPFind.txt in the WinPFind Folder and post it in the next reply.   Also locate the extracted trackqoo.vbs  file and run it.    If the logs are too big to post easily you can send them directly to my email:  rkinner AT att DOT net   Please use DellForum RayRay705 as the subject.   We also have the remnants of a newdotnet infection:   O10 - Broken Internet access because of LSP provider 'c:\program files
ewdotnet
ewdotnet6_30.dll' missing Doesn't appear to be hurting anything but we can get rid of it with lspfix.exe from:   http://www.cexx.org/LSPFix.exe   Just save it to your desktop and run it.  When it comes up check the box where it says 'I know What I am Doing'   then locate any instances of newdotnet6_30.dll in the left pane, highlight them and only them and move them to the right pane, then Finish.   Ron

Virus & Spyware

My HIJACKTHIS Log -- Please Respond! :)

Was this post helpful?