jrcotts,

Welcome to the Dell Community Forum (DCF).
We aren't deleting them.

Put your winXP firewall on - BEFORE going back on the net - or you will get infected.
Then get your windows updates and AV updates.

Details for the firewall on my website - link below.
==================
You may need to show us a hijackthis log to get you clean - Or do a fresh install - activate the firerwall before going online, then get updates to keep clean.

Hey lets delete this thread as well, go ahead and delete it admin

I don't think that is called for - we here trying to help people.

If you have a problem, post it in what you think is the right board, and people will try to help.

Such outbursts as yours ARE often deleted - and rightly so.

Be aware that the only employees of Dell on this whole forum are the Dell Mods, ALL others are other Dell users doing thier best to help each other. Its a User to User forum.

Hi Chris

 Thank you for the response. I dont seem to be having any trouble with finding my posts now. I surely did'nt mean to insult anyone My appologies. As far as the new little virus which by the way I ca'nt believe I got just minutes after my comp. format reinstall. But your right, I did'nt have the firewall enabled but i do now and hopefully I've gotton all my windows and A.V.updates completed. I'm going to try another hijack log,which by the way was somewhat difficult finding where to go to download the program. Any way Norton had me delete the two windows files. And I'm hoping that maybe I can do without them. One of the things that I did lose on one of my post was how to put the H.J. file into a permanant folder. I think whoever it was that helped me with that, had me go to a win zip site or something that helped me to unzip the program? Could you help me with the specifics on this. And should I start a new post with the new log?   Thank You very much.

                                                  Jrcott

 

My normal post - look at the botton and Texruss FAQ - he has links on there to tutorials:-

Use these to remove Malware (Virus, Spyware and Adware).

First :-
Spybot S&D and Ad-aware using the settings and links provided
Here

Failing those solving your problems a post of a hijackthis log for the experts to advise.
HijackThis From Here
or one of these other links:-
http://www.merijn.org/files/hijackthis.zip
http://www.aluriasoftware.com/tools/hijackthis.zip
http://mjc1.com/mirror/hjt/

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. Unzip HijackThis into this folder. (See this link for graphical instructions)
Then run, scan, save log, then in notepad copy the FULL log by copy and paste as a reply to this post and an expert with HijackThis Knowldge, will have a go at giving advice. A lot of posters make mistakes here in copying and pasting so reread the left info sidebar called Copy and Paste
Please note the list of experts names below, very few forum regulars here have had this training.

DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.

Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.

TomCoyote (of http://tomcoyote.org/forums/index.php fame)
YoKenny (Expert at TomCoyotes, Trusted Advisor Spywareinfo)
baskar1234 (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
ChrisRLG (Classroom Coordinator at TomCoyotes, Trusted Advisor Spywareinfo)
Tuxedo Jack (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
Yellowhammer (Trusted Advisor at Net-Integration, First Responder at Computer Cops)
tashi (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
therock247uk (In Training at TomCoyotes and Spywareinfo)
irelynmisses (In Training at TomCoyotes and Spywareinfo)
Texruss (Spyware Fighter at Wildersecurity, In Training at TomCoyotes)
PGPhantom (Trusted Advisor at Spywareinfo)

You could also go to one of the more specalist forums where more experts will be able to help.
http://tomcoyote.com/forums/index.php
http://forums.spywareinfo.com/index.php
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi (Home of Spybot S&D)
http://boards.cexx.org/index.php
http://www.wilderssecurity.com/index.php
Do read the sites FAQ before posting, and advise your problem and what steps you have already done to try to cure your problem.

I, and the other hijack experts mentioned above, are in all those sites (and more) with the same login names. You might get one of us at those sites also to anwser your log, but other experts will also be available.

Hi Chris, Thank You again for the quick response. I think I got every thing done. You sure do know how to make things easy.

Here is my HiJackThis.log

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.us.dell.com/content/default.aspx?c=us&cs=04&l=en&s=bsd
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Configuration Loader] waudclt.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [Configuration Loader] waudclt.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.dll

 

I am missing the header to your log which tells me important information like the version of Windows, but since you have a bad worm I will try to help.

A new (May 11) variant of the Gaobot worm  is infecting your computer.

Edit May 15th:
****************************************************************************
I was wrong... missed a letter, but your embedded file is a worm so I'll not sweat so much...the Symantec Gaobot worm I thought you had is spelled differently (wauclt.exe) and the one you have (waudclt.exe) is even rarer ...and a different worm. It's this one mentioned only by Sophos... see this link:  W32/Agobot-AN.  That name waudclt.exe is not mentioned on that Sophos page for some reason as a dropper file, but can be seen here on Google referencing the Sophos page:   

One thing to be careful!!! The legitimate file wuaclt.exe is also in that System32 subfolder and it is the Microsoft Windows Autoupdate Client file. Don't delete it by mistake please. It's easy to get them confused...so be careful.
*****************************************************************************

We will squash that worm and fix your HOSTS file it may have infected.

Run Hijackthis and scan. Check the box to the left of the following line entries:

O4 - HKLM\..\Run: [Configuration Loader] waudclt.exe
O4 - HKLM\..\RunServices: [Configuration Loader] waudclt.exe

With no other windows open click on fix checked button in Hijackthis.

Exit Hijackthis and reboot in Safe Mode.  See FAQ 8 at:

http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

Very Important! Enable Hidden Files option: Same link above FAQ 9

Now open the Windows File Manager (type explorer at Start button/Run dialog box). Navigate down your directory structure to the Windows folder and click into it. Click into the System32 subfolder. Find and delete the worm file waudclt.exe (right button click on it and select Delete with a left button click).   Here is the folder path for that worm:

C:\Windows\System32\waudclt.exe

Now we need to rename your HOSTS file in case it is infected and when you reboot into normal Windows a new HOSTS file will be created by Windows, reversing the worm damage. Don't worry, it is safe to do this.

Click into the Drivers subfolder of System32 folder and then into the ETC subfolder. In that folder right button click on HOSTS file and left button click on Rename.  Type this for the new name: HOSTS.OLD

The folder path for the HOSTS file is C:\Windows\System32\Drivers\ETC\HOSTS    (it has no extension letters).

Now reboot into normal mode Windows and run Disk Cleanup:

Type cleanmgr at Start/Run button. Scan all drives and clean all temp files. I remove all files it finds in all categories.

Now...you have more work...you were infected by Gaobot because your machine is missing vital Microsoft critical updates: Look in my message (about 5 or 6 down in the following thread) and download and install the three Hotfixes. If you don't you will continue to be vulnerable and Gaobot and others will strike again.

http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=11254

When you finish run a new HJT log (get the full header this time) and post it here so we can see how you are progressing.

All the best,

Texruss

 

Message Edited by Texruss on 05-15-2004 04:31 PM

 As far as the windows files, as I wrote up,above Norton picked them up And I deleted them long ago. The 2 file names that I deleted are c:\Windows\system32\waudelt.exe and   C:\Windows\System32\winhlpp32.exe Now what i need to know is can i operater with out these? I also tried to reboot in safe mode and in the middle of it it shut down and went to a blue screen that said  Fatal Ststem Error The Session Manager Initialization system process terminated unexectedly with a status of Oxc0000034

  Here is another Hijack log since I've fixed the two entries that you asked me to. Thank You again, 

 

Logfile of HijackThis v1.97.7
Scan saved at 7:02:42 AM, on 5/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.us.dell.com/content/default.aspx?c=us&cs=04&l=en&s=bsd
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.dll

 

Message Edited by jrcotts on 05-15-2004 08:03 AM

Hi Tex, Thank You for the quick response.

   Now,to start with, I ran the hijack fixed the two lines (waudelt)

Than I rebooted in safe mode .But, as It was doing that, it shut down quickly and a blue screen came on saying that Fatal System Error the session manager initialization ststem process terminated unexpectedly with a status of Oxc0000034.Please Help

                         Thank You,

                                Jrcott

                                  

 

---

.

Message Edited by jrcotts on 05-15-2004 08:13 AM

Hi Tex,

One other thing was that when I typed explore in the run box it said unable to find . so than I right clicked on the start menu and hit the explore option that took me to the files tree but when I clicked on windows it just had an empty file in it. And I did uncheck all the hidden file extensions and hidden folders before that. But I'm not sure if I had done that before i submitted the first hijack log but I think I did because at first the hijack file read like this hijackthis than after I changed it, it read like this hijackthis.exe. So, back to the windows files thing.... So than, I hit the search option of the start menu and found them like that. And when I looked through the windows\32 file I did'nt see anything like waudelt in there. And finally, After doing my initial format reinstall I realized i had'nt got any of my windows updates, But I did do that yesterday off of one of the links I got in here. Did I maybe not get all of them that I needed than,like I said it was just yesterday 5/13 that I did that. Should I go and try it again? Thank You for your help

                                Jrcott 

 

Message Edited by jrcotts on 05-15-2004 08:31 AM

Message Edited by jrcotts on 05-15-2004 08:54 AM

>One other thing was that when I typed explore in the run box it said unable to find

A little file trivia is in order: *;-)

The executable file is explorer with an r.

explorer.exe = Windows Explorer   (or right click on Start button and click on word explore)

iexplore.exe  = Internet Explorer (MSIE or IE for short).

>hijack file read like this hijackthis than after I changed it, it read like this hijackthis.exe.

You enabled file extensions to be displayed.

>And finally, After doing my initial format reinstall I realized i had'nt got any of my windows updates, But I did do that yesterday off of one of the links I got in here. Did I maybe not get all of them that I needed than

Might be a good idea to run updates again...a failed update is mentioned in the KB link I referenced as a possible cause of your Fatal System error.

 Please post a fresh Hijackthis log.

Texruss

Message Edited by Texruss on 05-15-2004 05:23 PM

Now what i need to know is can i operate with out these?
Yes...those needed to go away...worm files.
http://www.f-secure.com/v-descs/agobot_p.shtml
Agobot

Your error message is a tough nut to troubleshoot...you can see here for Microsoft's take on it.

Texruss

Hey Tex

   Thank You So much for your help. That was kinda  funny about the explorer huh? Tells ya what a rookie I am does'nt it. HE HE. I looked into the microsoft take on the "Stop 0xc000021A" error. I'm not sure where to start . It said something about Dr. Watson but its said something about Windows NT so I'm not sure if I should get started with that or not What do you think I should do. How bad do I need the start in safe mode option to copmlete the debugging. Thank you so much again for your help.

                                              Jrcott

Here is another hijacklog-----I'm not sure it will be any different though I browsed for a little while after I downloaded the hotfixes but I still did'nt see them listed in the programs with the others.

now that I'm looking at the platform it says WinNT so thats probably what I saw at Microsoft huh?

 

Logfile of HijackThis v1.97.7
Scan saved at 8:57:39 AM, on 5/16/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.us.dell.com/content/default.aspx?c=us&cs=04&l=en&s=bsd
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.dll