Hi Jason05216...

My name is dobhar and I will be looking over your log. Please give me some time to go look it over. I will post back as soon as possible.

If you have any questions post them back in this thread. Do not start another.

Just a quick look shows me that you are infected with an About Blank. I will try to post a "FIX" later tonight.

Thanks,

Message Edited by dobhar on 06-22-2005 10:40 AM

Thanks, I'll get to work on this after I get off work. I looked through the steps, everything seems straight forward enough. I do have couple of questions

1.  I ran cwshredder before and it would cause my machine to reboot. Is this normal?

2. Before I start I should reboot with all startup items rather than the selective startup I'm using?

I'll post any other questions as they arise. Thanks again.

Jason

Hi Jason...

1. No CWShredder 2.15 should not cause your PC to reboot. Remove\delete the one you have now and download a new version per my instructions. Lets see a freshly dowloaded copy does.

2. Not at this time...or I will have to ammend my fixes. I don't mind doing that for you but I will need a brand new HJT log with all the "Startup" items turned on. I will then analyze your log and re-post a new round of fixes as HijackThis entries might have changed. So if your game, forget the fixes I just posted, give me a new HijackThis log ASAP after rebooting with Startup items enabled. I will go through the log, ammend my fixes, and post back later tonight but I need your new log right away as it's 05:10 PM central here right now.

If not then run the fixes with selective then at the end, per the last Step, enable all startup items, reboot, and give me a new log. It's your choice...just let me know how you want to handle it.
______________________________________

Note, I forgot to add a step...You need to disable Microsoft Antispyware and Counterspy while your running the fixes as they could interfer with the fixes. Re-anable them when your done the round of fixes.

Thanks,

Kent

KO...

I should be back on around 9:30 \ 10:00 PM tonight for a couple hours. Just going home from work. If you can get me a new log tonight I'll see if I can post the next round (if there is) of fixes. It may takes 2 or 3 kicks at the can to get you all clean but we'll get it done.

Cya later,

Kent

Kent,

I'll go ahead with the fixes as you have them. I don't want to make this any more difficult than necessary. I'm also central time, so I'll work on this tonight and post the logs. I'm just now getting a chance to start and I'll probably have some kid duty tonight that will slow my progress.

Jason

Hi Jason...

1. No problem, continuing with steps was correct

2. Correct

3. No problem

4. All I want you to do is cleanout the Temp folders, Temporary Internet Folders, Recycle Bin...etc. If Clean Sweep does that then Yes that is OK

5. You need to allow the SR (Silent Runners) script to work. If you notice in Step 12, Line 3 I say "If your antivirus complains, tell it to allow this script". So please run SR again (insafe mode) and allow it to run. We need to run SR as it checks for Hidden nasties. There is no uninstall for SR...it's just a script that runs a scan no so uninstall. When you are all clean you can just delete the Silent Runners folder I got you to create.

Go back into "Safe Mode" run SR and continue on with the rest of the steps.

Keep up the good work... :)

Message Edited by dobhar on 06-23-2005 07:49 AM

I wasn't trying to remove silent runners, I was trying to remove Symantec. I was patient, I let the thing go for about 30 min. then looked at the task manager. Seeing no activity I assumed that Symantec had completely stopped the script because the pop up message didn't give an option to let the script run you could only acknowledge it by clicking OK. I'll run home and start SR and let it run this morning.

Morning,

Ran into several issues with the fix last night.

1. Step 5 The file C:\WINDOWS\system32\msnu.exe wasn't present. I went on to step 6.

2. Step 8. C:\WINDOWS\system32\sdopl.dll wasn't present. C:\WINDOWS\ntzj32.exe wasn't present. Two files were present ntzj32.exe.tcf and ntjz32.exe.dll.tcf were there and I deleted them. C:\WINDOWS\system32\winpy32.exe wasn't present. C:\WINDOWS\system32\msnu.exe and C:\WINDOWS\ipqu.exe weren't present. I deleted what ws there and went on to the next step.

3. Step 9.None of the R1 items were there.

4. Disk cleanup hung at the beginning where it calculates disk space. I emptied the folders with Norton clean sweep. I don't know if that will work as well.

5. Step 12. When silent runners started the following message popped up - Symantec Script Blocking has prevented a script action that could be harmful to you. I went into Norton Antivirus and turned off script blocking but the message kept coming up. I also rebooted into safe mode and still the same thing. I was going to uninstall the software but I can't find an uninstall for it. Any ideas? It appears that silent runners is stopped. If you open the task manager after the message pops up the file shows as being open but there is no activity in the processes. It nevers shows anything but system idle.

I was able to run rkfiles. This is where I stopped. I ran a program removal tool in clean sweep and it shows the antivirus stuff as being removable. I didn't do this yet. Wanted to get your thoughts. I booted into normal mode to see if I could get the script blocking fixed. I figure I will go through the steps again in safe mode.

AAAHHHH!

Sorry, Jason...my bad. I misunderstood you. The written word can be a pain sometimes.

I think that you can just disable script blocking in NAV so disable that first then run SR...Note that MS Antispyware may pop up also.

Thanks,

Kent