Can't get rid of URL Logic Pop up generator

Question

shahss 0 Newbie Poster

19 Years Ago

I am having a really hard time trying to get URL logic off of my computer. It keeps poping up ads as I surf the web. I have sweeped my system with Spy Sweeper but it cannot find and remove the spyware. I have tried also tried to use hijack this to try and remove stuff myself but have gotten really confused as to what is good and what isn't. I've pasted the hijackthis log below. I'd really appreciate anyone's help:

Logfile of HijackThis v1.99.1
Scan saved at 1:12:00 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Stanford\PC-Leland\krbcc32s.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\WebRoot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stanford\PC-Leland\pcleland.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\iowkur.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\strings.exe
C:\WINDOWS\system32\find.exe
C:\Documents and Settings\Sam the man\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.stanford.edu/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\iowkur.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\WebRoot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: PC-Leland.lnk = ?
O4 - Global Startup: strings.exe
O4 - Global Startup: uphngt.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - https://a248.e.akamai.net/7/248/11498/v1/www.moveonpac.org/content/qt/qtplugin.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.com/players/english/5.2/win/PulsePlayer5.2AxWin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) - http://64.106.242.160/0664/FileOpen.CAB
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\irr6l59s1.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

windows-virus

3 Contributors
5 Replies
320 Views
2 Days Discussion Span
Latest Post 19 Years Ago Latest Post by shahss

DMR 152 Wombat At Large

19 Years Ago

At the least, you have the Narrator/qoologic infection, which HijackThis alone is not going to be able to fix. Please do the following:

Download finditnt2000xp.zip.

http://www.thatcomputerguy.us/downloads/finditnt2000xp.zip

1. Unzip the contents of finditnt2000xp.zip

2. Open the resulting "Find It NT-2K-XP" folder

3. Double-click on find.bat.

A command prompt will open and it will search your computer for malicious files.

(it may take several minutes for the script to run ... please be patient)

Once it has finished a Notepad window will pop up with output.txt.

4. Copy the entire contents of output.txt into your next post.

DMR 152 Wombat At Large

19 Years Ago

Bear with us here- this isn't going to fun or easy. :mad:

Please do not reboot your computer unless instructed to do so during the course of this; the malicious files will morph and multiply if you do.

1. Delete this file:
C:\WINDOWS\System32\saie_kyf.dat.tmp

2. Download L2Mfix and save it to your desktop. Double-click l2mfix.exe and follow the prompts to extract the utility; the installation process will create a new L2M folder on your desktop.
Do not do anything further with the utility at the moment; we'll be using later on.

3. Download Pocket Killbox.

- Unzip the contents of KillBox.zip to a convenient location.
- Close all Browsers and programs that show in the windows taskbar.
- Double-click on KillBox.exe.
- Click "Delete on Reboot"
- Copy/Paste this file into the top "Full Path of File to Delete" box:

C:\\WINDOWS\system32\irr6l59s1.dll

- Click the "Delete File" button which looks like a stop sign.
- Click "Yes" at the Replace on Reboot prompt.
- Click "No" at the Pending Operations prompt.
- Repeat the above steps for each of the following files, but at the Pending Operations prompt you get after the last file (iowkur.exe), click Yes to reboot the system; this will complete the deletion process:

C:\WINDOWS\system32\oueapb.dll
C:\WINDOWS\system32\yzcpuo.dll
C:\WINDOWS\system32\zmhquw.exe
C:\WINDOWS\system32\aypvub.dat
C:\WINDOWS\system32\iowkur.exe

4. After the system has rebooted:

A) Run FindIt's find.bat program again. Save the new FindIt log and post the contents here.

B) Here's where L2Mfix comes in:

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

shahss 0 Newbie Poster · Answer 1 · 2005-03-19T05:02:23+00:00

I downloaded the file and ran it, I've pasted the results below. What should I do now? Thanks!

>>


Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.


Find.bat is running from: C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\Find It NT-2K-XP\Find It NT-2K-XP


------- System Files in System32 Directory -------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32


03/18/2005  01:35 PM           233,306 dnsetup.dll
03/18/2005  01:35 PM           235,156 p0n8la5u1d.dll
03/18/2005  12:10 PM           233,306 zecommdb.dll
03/18/2005  12:10 PM           235,266 r06ulaj91do.dll
03/18/2005  01:52 AM           233,248 fysrch.dll
03/18/2005  01:50 AM           233,306 irr6l59s1.dll
03/17/2005  12:14 AM           233,306 mxaatext.dll
03/16/2005  01:46 AM           233,248 dkband.dll
03/16/2005  01:43 AM           233,248 pJn8lg5u16.dll
03/16/2005  01:43 AM           233,706 l8n40i5qe8.dll
03/15/2005  11:26 AM           232,736 oamanage.dll
03/15/2005  11:26 AM           233,039 fp0o03d3e.dll
03/14/2005  09:51 PM           232,736 rtchost.dll
03/14/2005  09:51 PM           224,996 phchdprf.dll
03/14/2005  09:51 PM           223,081 n64slgh7164.dll
03/12/2005  06:01 PM           224,996 lv4u09h9e.dll
03/10/2005  08:35 AM           224,147 h82olif3182.dll
03/03/2005  09:05 AM           222,857 lvn8095ue.dll
03/01/2005  12:49 PM           223,620 fp6s03j7e.dll
02/28/2005  09:44 AM           226,069 fprm0391e.dll
02/23/2005  08:27 AM           222,903 o0rola931d.dll
02/23/2005  08:10 AM           225,273 jtn2075oe.dll
02/22/2005  06:19 PM           226,005 lv8u09l9e.dll
02/22/2005  06:04 PM           225,299 fp8203loe.dll
02/22/2005  03:07 PM           225,016 p6n8lg5u16.dll
02/22/2005  09:24 AM           226,030 l0j8la1u1d.dll
02/12/2005  11:43 AM           222,920 ir24l5fq1.dll
02/08/2005  05:42 PM    <DIR>          dllcache
02/07/2005  08:31 AM           223,446 dzeml.dll
02/07/2005  08:25 AM           222,342 u4ru0e99eh.dll
02/05/2005  07:45 PM           222,342 wewfaxui.dll
02/05/2005  07:37 PM           226,273 cStsrvut.dll
02/05/2005  07:00 PM           224,839 dtcpcsvc.dll
02/05/2005  04:34 PM           223,081 irfosoft.dll
02/04/2005  12:50 PM           224,839 nwmsapi.dll
02/03/2005  02:20 AM           223,081 wL2time.dll
02/02/2005  11:47 PM           224,839 dGtaclen.dll
02/02/2005  06:28 PM           222,808 mvpbde40.dll
02/01/2005  05:28 PM           224,839 kjdhela2.dll
02/01/2005  01:17 PM           222,808 mdgsvc.dll
02/01/2005  09:33 AM           223,717 ly0u09d9e.dll
01/30/2005  11:06 PM           222,808 iamui.dll
01/29/2005  07:58 PM           222,991 AWHPRXY.DLL
01/29/2005  05:24 PM           222,808 dunet.dll
01/29/2005  12:41 PM           225,392 ifsecsvc.dll
01/29/2005  10:19 AM           223,065 dmrpsetu.dll
01/29/2005  09:33 AM           225,392 wvashext.dll
01/29/2005  09:31 AM           222,993 t88u0il9e8q.dll
01/28/2005  05:59 PM           224,814 rgoc3260.dll
01/27/2005  04:55 PM           224,814 cLtsrvps.dll
01/27/2005  03:21 PM           222,993 kzdkaz.dll
01/26/2005  04:58 PM           225,733 pTpgasvc.dll
01/26/2005  02:31 PM           223,206 rLsser.dll
01/25/2005  09:36 PM           225,733 adcups.dll
01/25/2005  05:44 PM           223,206 wkcsvc.dll
01/25/2005  04:07 PM           225,733 uarv80a.dll
01/25/2005  01:29 PM           223,908 ksdlt1.dll
01/25/2005  12:51 PM           225,733 lsvesnth.dll
01/25/2005  11:41 AM           223,908 mpvidctl.dll
01/24/2005  10:43 PM           223,120 jsbexec.dll
01/24/2005  08:32 PM           222,577 iNsacct.dll
01/24/2005  07:28 PM           223,120 kxd101c.dll
01/24/2005  04:32 PM           222,577 wedap32.dll
01/24/2005  02:06 PM           225,921 ixetmib1.dll
01/24/2005  11:19 AM           224,757 aai3duag.dll
01/24/2005  12:34 AM           225,921 Csnmhook.dll
01/23/2005  08:01 PM           224,757 mhrdim.dll
01/23/2005  02:07 AM           225,921 qgery.dll
01/22/2005  07:44 PM           224,757 CMA.DLL
01/20/2005  11:11 AM           224,757 ksdsmsno.dll
01/19/2005  09:57 AM           225,921 meaatext.dll
01/18/2005  08:35 AM           224,757 sbi.dll
01/17/2005  06:05 PM           225,921 mevcrt.dll
01/16/2005  08:40 AM           224,757 uerlbva.dll
01/13/2005  03:56 PM           225,921 vphelper.dll
01/11/2005  09:38 AM           224,757 tLpi3.dll
01/10/2005  06:50 PM           225,921 njptools.dll
01/09/2005  02:30 AM           224,757 awl.dll
01/08/2005  05:14 PM           225,921 xtnroll.dll
01/07/2005  02:54 PM           224,757 csvfat.dll
01/06/2005  07:53 PM           225,921 vhinit.dll
01/06/2005  07:48 PM           224,757 cpbcatex.dll
01/05/2005  08:18 PM           225,921 mbminst.dll
01/05/2005  05:27 PM           224,757 wgavideo.dll
01/04/2005  09:19 PM           225,921 smdocvw.dll
01/03/2005  05:20 PM           224,757 qlartz.dll
01/02/2005  11:08 PM           225,921 mchtmled.dll
01/01/2005  02:42 PM           225,921 ksdkor.dll
12/16/2004  04:44 PM           224,757 kadfr.dll
12/16/2004  11:54 AM           225,921 mdrle32.dll
12/14/2004  10:39 PM           224,757 svclient.dll
12/13/2004  02:47 PM           224,757 chvfat.dll
12/11/2004  09:16 AM           225,411 slorage.dll
12/09/2004  07:04 PM           224,757 rRsauto.dll
12/09/2004  06:56 PM           224,757 kzduk.dll
12/09/2004  06:54 PM           224,757 lvp4097qe.dll
12/08/2004  01:07 PM           224,757 qyv.dll
12/07/2004  11:52 AM           224,757 aitiveds.dll
12/07/2004  01:34 AM           224,757 mid32.dll
12/06/2004  06:23 PM           224,757 mdisip.dll
12/06/2004  01:19 PM           224,757 ozbcji32.dll
12/06/2004  12:47 PM           224,757 k080lalm1dqa.dll
12/06/2004  11:55 AM           226,182 en86l1ls1.dll
12/06/2004  11:38 AM           224,757 nzshrui.dll
07/31/2004  06:32 PM    <DIR>          Microsoft
103 File(s)     23,248,109 bytes
2 Dir(s)   2,195,996,672 bytes free


------- Hidden Files in System32 Directory -------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32


03/18/2005  01:35 PM               890 vsconfig.xml
02/08/2005  05:42 PM    <DIR>          dllcache
02/05/2005  07:34 PM             4,212 zllictbl.dat
04/18/2004  07:49 PM               488 WindowsLogon.manifest
04/18/2004  07:49 PM               488 logonui.exe.manifest
04/18/2004  07:48 PM               749 sapi.cpl.manifest
04/18/2004  07:48 PM               749 wuaucpl.cpl.manifest
04/18/2004  07:48 PM               749 cdplayer.exe.manifest
04/18/2004  07:48 PM               749 nwc.cpl.manifest
04/18/2004  07:48 PM               749 ncpa.cpl.manifest
9 File(s)          9,823 bytes
1 Dir(s)   2,195,992,576 bytes free


------------ Files Named "Guard" ---------------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32



------ Temp Files in System32 Directory ------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32


12/06/2004  11:45 AM           474,920 saie_kyf.dat.tmp
09/22/2004  05:46 PM            20,480 setb4.tmp
08/18/2001  04:00 AM             2,577 CONFIG.TMP
3 File(s)        497,977 bytes
0 Dir(s)   2,195,992,576 bytes free


------------------ User Agent ----------------


REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7F54D3B9-49D5-8D4D-D6E4-8F6871E11C09}"=""



------------- Keys Under Notify -------------


REGEDIT4


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reliability]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\irr6l59s1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001



------------- Locate.com Results -------------


C:\WINDOWS\SYSTEM32\
aai3duag.dll   Mon Jan 24 2005  11:19:48a  ..S.R        224,757   219.49 K
adcups.dll     Tue Jan 25 2005   9:36:36p  ..S.R        225,733   220.44 K
awhprxy.dll    Sat Jan 29 2005   7:58:14p  ..S.R        222,991   217.76 K
awl.dll        Sun Jan  9 2005   2:30:46a  ..S.R        224,757   219.49 K
cltsrvps.dll   Thu Jan 27 2005   4:55:54p  ..S.R        224,814   219.54 K
cma.dll        Sat Jan 22 2005   7:44:38p  ..S.R        224,757   219.49 K
cpbcatex.dll   Thu Jan  6 2005   7:48:32p  ..S.R        224,757   219.49 K
csnmhook.dll   Mon Jan 24 2005  12:34:26a  ..S.R        225,921   220.63 K
cstsrvut.dll   Sat Feb  5 2005   7:37:06p  ..S.R        226,273   220.97 K
csvfat.dll     Fri Jan  7 2005   2:54:26p  ..S.R        224,757   219.49 K
dgtaclen.dll   Wed Feb  2 2005  11:47:28p  ..S.R        224,839   219.57 K
dkband.dll     Wed Mar 16 2005   1:46:54a  ..S.R        233,248   227.78 K
dmrpsetu.dll   Sat Jan 29 2005  10:19:26a  ..S.R        223,065   217.84 K
dnsetup.dll    Fri Mar 18 2005   1:35:24p  ..S.R        233,306   227.84 K
dtcpcsvc.dll   Sat Feb  5 2005   7:00:54p  ..S.R        224,839   219.57 K
dunet.dll      Sat Jan 29 2005   5:24:38p  ..S.R        222,808   217.59 K
dzeml.dll      Mon Feb  7 2005   8:31:02a  ..S.R        223,446   218.21 K
fp0o03~1.dll   Tue Mar 15 2005  11:26:18a  ..S.R        233,039   227.57 K
fp6s03~1.dll   Tue Mar  1 2005  12:49:34p  ..S.R        223,620   218.38 K
fp8203~1.dll   Tue Feb 22 2005   6:04:04p  ..S.R        225,299   220.02 K
fprm03~1.dll   Mon Feb 28 2005   9:44:20a  ..S.R        226,069   220.77 K
fysrch.dll     Fri Mar 18 2005   1:52:08a  ..S.R        233,248   227.78 K
h82oli~1.dll   Thu Mar 10 2005   8:35:54a  ..S.R        224,147   218.89 K
iamui.dll      Sun Jan 30 2005  11:06:54p  ..S.R        222,808   217.59 K
ifsecsvc.dll   Sat Jan 29 2005  12:41:48p  ..S.R        225,392   220.11 K
insacct.dll    Mon Jan 24 2005   8:32:12p  ..S.R        222,577   217.36 K
ir24l5~1.dll   Sat Feb 12 2005  11:43:44a  ..S.R        222,920   217.70 K
irfosoft.dll   Sat Feb  5 2005   4:34:24p  ..S.R        223,081   217.85 K
irr6l5~1.dll   Fri Mar 18 2005   1:50:12a  ..S.R        233,306   227.84 K
ixetmib1.dll   Mon Jan 24 2005   2:06:40p  ..S.R        225,921   220.63 K
jsbexec.dll    Mon Jan 24 2005  10:43:14p  ..S.R        223,120   217.89 K
jtn207~1.dll   Wed Feb 23 2005   8:10:02a  ..S.R        225,273   219.99 K
kjdhela2.dll   Tue Feb  1 2005   5:28:44p  ..S.R        224,839   219.57 K
ksdkor.dll     Sat Jan  1 2005   2:42:40p  ..S.R        225,921   220.63 K
ksdlt1.dll     Tue Jan 25 2005   1:29:38p  ..S.R        223,908   218.66 K
ksdsmsno.dll   Thu Jan 20 2005  11:11:14a  ..S.R        224,757   219.49 K
kxd101c.dll    Mon Jan 24 2005   7:28:50p  ..S.R        223,120   217.89 K
kzdkaz.dll     Thu Jan 27 2005   3:21:20p  ..S.R        222,993   217.77 K
l0j8la~1.dll   Tue Feb 22 2005   9:24:20a  ..S.R        226,030   220.73 K
l8n40i~1.dll   Wed Mar 16 2005   1:43:30a  ..S.R        233,706   228.23 K
lsvesnth.dll   Tue Jan 25 2005  12:51:26p  ..S.R        225,733   220.44 K
lv4u09~1.dll   Sat Mar 12 2005   6:01:42p  ..S.R        224,996   219.72 K
lv8u09~1.dll   Tue Feb 22 2005   6:19:58p  ..S.R        226,005   220.71 K
lvn809~1.dll   Thu Mar  3 2005   9:05:18a  ..S.R        222,857   217.63 K
ly0u09~1.dll   Tue Feb  1 2005   9:33:18a  ..S.R        223,717   218.47 K
mbminst.dll    Wed Jan  5 2005   8:18:04p  ..S.R        225,921   220.63 K
mchtmled.dll   Sun Jan  2 2005  11:08:26p  ..S.R        225,921   220.63 K
mdgsvc.dll     Tue Feb  1 2005   1:17:56p  ..S.R        222,808   217.59 K
meaatext.dll   Wed Jan 19 2005   9:57:28a  ..S.R        225,921   220.63 K
mevcrt.dll     Mon Jan 17 2005   6:05:52p  ..S.R        225,921   220.63 K
mhrdim.dll     Sun Jan 23 2005   8:01:44p  ..S.R        224,757   219.49 K
mpvidctl.dll   Tue Jan 25 2005  11:42:00a  ..S.R        223,908   218.66 K
mvpbde40.dll   Wed Feb  2 2005   6:28:36p  ..S.R        222,808   217.59 K
mxaatext.dll   Thu Mar 17 2005  12:14:06a  ..S.R        233,306   227.84 K
n64slg~1.dll   Mon Mar 14 2005   9:51:08p  ..S.R        223,081   217.85 K
njptools.dll   Mon Jan 10 2005   6:50:54p  ..S.R        225,921   220.63 K
nwmsapi.dll    Fri Feb  4 2005  12:50:34p  ..S.R        224,839   219.57 K
o0rola~1.dll   Wed Feb 23 2005   8:27:50a  ..S.R        222,903   217.68 K
oamanage.dll   Tue Mar 15 2005  11:26:18a  ..S.R        232,736   227.28 K
p0n8la~1.dll   Fri Mar 18 2005   1:35:24p  ..S.R        235,156   229.64 K
p6n8lg~1.dll   Tue Feb 22 2005   3:07:06p  ..S.R        225,016   219.74 K
phchdprf.dll   Mon Mar 14 2005   9:51:08p  ..S.R        224,996   219.72 K
pjn8lg~1.dll   Wed Mar 16 2005   1:43:30a  ..S.R        233,248   227.78 K
ptpgasvc.dll   Wed Jan 26 2005   4:58:46p  ..S.R        225,733   220.44 K
qgery.dll      Sun Jan 23 2005   2:07:36a  ..S.R        225,921   220.63 K
qlartz.dll     Mon Jan  3 2005   5:20:04p  ..S.R        224,757   219.49 K
r06ula~1.dll   Fri Mar 18 2005  12:11:00p  ..S.R        235,266   229.75 K
rgoc3260.dll   Fri Jan 28 2005   5:59:06p  ..S.R        224,814   219.54 K
rlsser.dll     Wed Jan 26 2005   2:31:02p  ..S.R        223,206   217.97 K
rtchost.dll    Mon Mar 14 2005   9:51:22p  ..S.R        232,736   227.28 K
sbi.dll        Tue Jan 18 2005   8:35:20a  ..S.R        224,757   219.49 K
smdocvw.dll    Tue Jan  4 2005   9:19:16p  ..S.R        225,921   220.63 K
t88u0i~1.dll   Sat Jan 29 2005   9:31:12a  ..S.R        222,993   217.77 K
tlpi3.dll      Tue Jan 11 2005   9:38:52a  ..S.R        224,757   219.49 K
u4ru0e~1.dll   Mon Feb  7 2005   8:25:06a  ..S.R        222,342   217.13 K
uarv80a.dll    Tue Jan 25 2005   4:07:24p  ..S.R        225,733   220.44 K
uerlbva.dll    Sun Jan 16 2005   8:40:52a  ..S.R        224,757   219.49 K
vhinit.dll     Thu Jan  6 2005   7:53:42p  ..S.R        225,921   220.63 K
vphelper.dll   Thu Jan 13 2005   3:56:16p  ..S.R        225,921   220.63 K
vsconfig.xml   Fri Mar 18 2005   1:35:08p  A..H.            890     0.87 K
wedap32.dll    Mon Jan 24 2005   4:32:38p  ..S.R        222,577   217.36 K
wewfaxui.dll   Sat Feb  5 2005   7:45:32p  ..S.R        222,342   217.13 K
wgavideo.dll   Wed Jan  5 2005   5:27:30p  ..S.R        224,757   219.49 K
wkcsvc.dll     Tue Jan 25 2005   5:44:58p  ..S.R        223,206   217.97 K
wl2time.dll    Thu Feb  3 2005   2:20:16a  ..S.R        223,081   217.85 K
wvashext.dll   Sat Jan 29 2005   9:33:34a  ..S.R        225,392   220.11 K
xtnroll.dll    Sat Jan  8 2005   5:14:06p  ..S.R        225,921   220.63 K
zecommdb.dll   Fri Mar 18 2005  12:11:00p  ..S.R        233,306   227.84 K
zllictbl.dat   Sat Feb  5 2005   7:34:56p  ...H.          4,212     4.11 K


89 items found:  89 files, 0 directories.
Total of file sizes:  19,653,856 bytes     18.74 M


-------- Strings.exe Qoologic Results --------


C:\WINDOWS\system32\oueapb.dll: updates.qoologic.com
C:\WINDOWS\system32\yzcpuo.dll: updates.qoologic.com
C:\WINDOWS\system32\zmhquw.exe: updates.qoologic.com


--------- Strings.exe Aspack Results ---------


C:\WINDOWS\system32\aypvub.dat: .aspack
C:\WINDOWS\system32\iowkur.exe: .aspack
C:\WINDOWS\system32\ntdll.dll: .aspack


-------------- HKLM Run Key ----------------


REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2005-03-19T11:26:42+00:00

Hi shahss. DMR has requested that I take a quick peek at your problem. First up we will need to rid you of the VX2 infection.

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!

Please go here and download Find_qoologic.zip by baskar1234. Unzip the folder and go to the new qoologic folder and doubleclick on qoologic.bat to run it. It will take a few minutes to scan your drive so be patient. When it has finished, open My Computer, doubleclick on C: and copy and paste the contents of the below logs in this thread.

C:\log.txt
C:\win.txt
C:\start.txt

Post another Find_it log too please.

shahss 0 Newbie Poster · Answer 3 · 2005-03-21T03:43:36+00:00

Thank you for all of your help. I ran l2mfix, findqoologic and hijackthis and have pasted the logs below. I also used pocket killbox to delete the files mentioned in the previous note. I have another question about spysweeper, as I was funning the mentioned programs I was receiving spysweeper alerts and didn't know what to do about them. Should I just turn spy sweeper off during this process?

After running Findqoologic this is what I got in the start.txt, log.txt, and win.txt files:

start.txt - The file was empty.

win.txt:

C:\WINDOWS\system32\ntdll.dll: .aspack

log.txt:

C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\findqoologic


PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\system32\ntdll.dll: .aspack


Files Found in all users startup Folder............
------------------------



l2mfix log:



Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.


Find.bat is running from: C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\Find It NT-2K-XP\Find It NT-2K-XP


------- System Files in System32 Directory -------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32


03/18/2005  05:34 PM           235,156 llexpand.dll
03/18/2005  05:26 PM           233,306 e6202gfmg62a2.dll
03/18/2005  01:35 PM           233,306 dnsetup.dll
03/18/2005  01:35 PM           235,156 p0n8la5u1d.dll
03/18/2005  12:10 PM           233,306 zecommdb.dll
03/18/2005  12:10 PM           235,266 r06ulaj91do.dll
03/18/2005  01:52 AM           233,248 fysrch.dll
03/17/2005  12:14 AM           233,306 mxaatext.dll
03/16/2005  01:46 AM           233,248 dkband.dll
03/16/2005  01:43 AM           233,248 pJn8lg5u16.dll
03/16/2005  01:43 AM           233,706 l8n40i5qe8.dll
03/15/2005  11:26 AM           232,736 oamanage.dll
03/15/2005  11:26 AM           233,039 fp0o03d3e.dll
03/14/2005  09:51 PM           232,736 rtchost.dll
03/14/2005  09:51 PM           224,996 phchdprf.dll
03/14/2005  09:51 PM           223,081 n64slgh7164.dll
03/12/2005  06:01 PM           224,996 lv4u09h9e.dll
03/10/2005  08:35 AM           224,147 h82olif3182.dll
03/03/2005  09:05 AM           222,857 lvn8095ue.dll
03/01/2005  12:49 PM           223,620 fp6s03j7e.dll
02/28/2005  09:44 AM           226,069 fprm0391e.dll
02/23/2005  08:27 AM           222,903 o0rola931d.dll
02/23/2005  08:10 AM           225,273 jtn2075oe.dll
02/22/2005  06:19 PM           226,005 lv8u09l9e.dll
02/22/2005  06:04 PM           225,299 fp8203loe.dll
02/22/2005  03:07 PM           225,016 p6n8lg5u16.dll
02/22/2005  09:24 AM           226,030 l0j8la1u1d.dll
02/12/2005  11:43 AM           222,920 ir24l5fq1.dll
02/08/2005  05:42 PM    <DIR>          dllcache
02/07/2005  08:31 AM           223,446 dzeml.dll
02/07/2005  08:25 AM           222,342 u4ru0e99eh.dll
02/05/2005  07:45 PM           222,342 wewfaxui.dll
02/05/2005  07:37 PM           226,273 cStsrvut.dll
02/05/2005  07:00 PM           224,839 dtcpcsvc.dll
02/05/2005  04:34 PM           223,081 irfosoft.dll
02/04/2005  12:50 PM           224,839 nwmsapi.dll
02/03/2005  02:20 AM           223,081 wL2time.dll
02/02/2005  11:47 PM           224,839 dGtaclen.dll
02/02/2005  06:28 PM           222,808 mvpbde40.dll
02/01/2005  05:28 PM           224,839 kjdhela2.dll
02/01/2005  01:17 PM           222,808 mdgsvc.dll
02/01/2005  09:33 AM           223,717 ly0u09d9e.dll
01/30/2005  11:06 PM           222,808 iamui.dll
01/29/2005  07:58 PM           222,991 AWHPRXY.DLL
01/29/2005  05:24 PM           222,808 dunet.dll
01/29/2005  12:41 PM           225,392 ifsecsvc.dll
01/29/2005  10:19 AM           223,065 dmrpsetu.dll
01/29/2005  09:33 AM           225,392 wvashext.dll
01/29/2005  09:31 AM           222,993 t88u0il9e8q.dll
01/28/2005  05:59 PM           224,814 rgoc3260.dll
01/27/2005  04:55 PM           224,814 cLtsrvps.dll
01/27/2005  03:21 PM           222,993 kzdkaz.dll
01/26/2005  04:58 PM           225,733 pTpgasvc.dll
01/26/2005  02:31 PM           223,206 rLsser.dll
01/25/2005  09:36 PM           225,733 adcups.dll
01/25/2005  05:44 PM           223,206 wkcsvc.dll
01/25/2005  04:07 PM           225,733 uarv80a.dll
01/25/2005  01:29 PM           223,908 ksdlt1.dll
01/25/2005  12:51 PM           225,733 lsvesnth.dll
01/25/2005  11:41 AM           223,908 mpvidctl.dll
01/24/2005  10:43 PM           223,120 jsbexec.dll
01/24/2005  08:32 PM           222,577 iNsacct.dll
01/24/2005  07:28 PM           223,120 kxd101c.dll
01/24/2005  04:32 PM           222,577 wedap32.dll
01/24/2005  02:06 PM           225,921 ixetmib1.dll
01/24/2005  11:19 AM           224,757 aai3duag.dll
01/24/2005  12:34 AM           225,921 Csnmhook.dll
01/23/2005  08:01 PM           224,757 mhrdim.dll
01/23/2005  02:07 AM           225,921 qgery.dll
01/22/2005  07:44 PM           224,757 CMA.DLL
01/20/2005  11:11 AM           224,757 ksdsmsno.dll
01/19/2005  09:57 AM           225,921 meaatext.dll
01/18/2005  08:35 AM           224,757 sbi.dll
01/17/2005  06:05 PM           225,921 mevcrt.dll
01/16/2005  08:40 AM           224,757 uerlbva.dll
01/13/2005  03:56 PM           225,921 vphelper.dll
01/11/2005  09:38 AM           224,757 tLpi3.dll
01/10/2005  06:50 PM           225,921 njptools.dll
01/09/2005  02:30 AM           224,757 awl.dll
01/08/2005  05:14 PM           225,921 xtnroll.dll
01/07/2005  02:54 PM           224,757 csvfat.dll
01/06/2005  07:53 PM           225,921 vhinit.dll
01/06/2005  07:48 PM           224,757 cpbcatex.dll
01/05/2005  08:18 PM           225,921 mbminst.dll
01/05/2005  05:27 PM           224,757 wgavideo.dll
01/04/2005  09:19 PM           225,921 smdocvw.dll
01/03/2005  05:20 PM           224,757 qlartz.dll
01/02/2005  11:08 PM           225,921 mchtmled.dll
01/01/2005  02:42 PM           225,921 ksdkor.dll
12/16/2004  04:44 PM           224,757 kadfr.dll
12/16/2004  11:54 AM           225,921 mdrle32.dll
12/14/2004  10:39 PM           224,757 svclient.dll
12/13/2004  02:47 PM           224,757 chvfat.dll
12/11/2004  09:16 AM           225,411 slorage.dll
12/09/2004  07:04 PM           224,757 rRsauto.dll
12/09/2004  06:56 PM           224,757 kzduk.dll
12/09/2004  06:54 PM           224,757 lvp4097qe.dll
12/08/2004  01:07 PM           224,757 qyv.dll
12/07/2004  11:52 AM           224,757 aitiveds.dll
12/07/2004  01:34 AM           224,757 mid32.dll
12/06/2004  06:23 PM           224,757 mdisip.dll
12/06/2004  01:19 PM           224,757 ozbcji32.dll
12/06/2004  12:47 PM           224,757 k080lalm1dqa.dll
12/06/2004  11:55 AM           226,182 en86l1ls1.dll
12/06/2004  11:38 AM           224,757 nzshrui.dll
07/31/2004  06:32 PM    <DIR>          Microsoft
104 File(s)     23,483,265 bytes
2 Dir(s)   2,187,149,312 bytes free


------- Hidden Files in System32 Directory -------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32


03/18/2005  05:34 PM               890 vsconfig.xml
02/08/2005  05:42 PM    <DIR>          dllcache
02/05/2005  07:34 PM             4,212 zllictbl.dat
04/18/2004  07:49 PM               488 WindowsLogon.manifest
04/18/2004  07:49 PM               488 logonui.exe.manifest
04/18/2004  07:48 PM               749 sapi.cpl.manifest
04/18/2004  07:48 PM               749 wuaucpl.cpl.manifest
04/18/2004  07:48 PM               749 cdplayer.exe.manifest
04/18/2004  07:48 PM               749 nwc.cpl.manifest
04/18/2004  07:48 PM               749 ncpa.cpl.manifest
9 File(s)          9,823 bytes
1 Dir(s)   2,187,145,216 bytes free


------------ Files Named "Guard" ---------------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32



------ Temp Files in System32 Directory ------


Volume in drive C has no label.
Volume Serial Number is 289D-6B83


Directory of C:\WINDOWS\System32


09/22/2004  05:46 PM            20,480 setb4.tmp
08/18/2001  04:00 AM             2,577 CONFIG.TMP
2 File(s)         23,057 bytes
0 Dir(s)   2,187,153,408 bytes free


------------------ User Agent ----------------


REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7F54D3B9-49D5-8D4D-D6E4-8F6871E11C09}"=""



------------- Keys Under Notify -------------


REGEDIT4


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\p0n8la5u1d.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001



------------- Locate.com Results -------------


C:\WINDOWS\SYSTEM32\
aai3duag.dll   Mon Jan 24 2005  11:19:48a  ..S.R        224,757   219.49 K
adcups.dll     Tue Jan 25 2005   9:36:36p  ..S.R        225,733   220.44 K
awhprxy.dll    Sat Jan 29 2005   7:58:14p  ..S.R        222,991   217.76 K
awl.dll        Sun Jan  9 2005   2:30:46a  ..S.R        224,757   219.49 K
cltsrvps.dll   Thu Jan 27 2005   4:55:54p  ..S.R        224,814   219.54 K
cma.dll        Sat Jan 22 2005   7:44:38p  ..S.R        224,757   219.49 K
cpbcatex.dll   Thu Jan  6 2005   7:48:32p  ..S.R        224,757   219.49 K
csnmhook.dll   Mon Jan 24 2005  12:34:26a  ..S.R        225,921   220.63 K
cstsrvut.dll   Sat Feb  5 2005   7:37:06p  ..S.R        226,273   220.97 K
csvfat.dll     Fri Jan  7 2005   2:54:26p  ..S.R        224,757   219.49 K
dgtaclen.dll   Wed Feb  2 2005  11:47:28p  ..S.R        224,839   219.57 K
dkband.dll     Wed Mar 16 2005   1:46:54a  ..S.R        233,248   227.78 K
dmrpsetu.dll   Sat Jan 29 2005  10:19:26a  ..S.R        223,065   217.84 K
dnsetup.dll    Fri Mar 18 2005   1:35:24p  ..S.R        233,306   227.84 K
dtcpcsvc.dll   Sat Feb  5 2005   7:00:54p  ..S.R        224,839   219.57 K
dunet.dll      Sat Jan 29 2005   5:24:38p  ..S.R        222,808   217.59 K
dzeml.dll      Mon Feb  7 2005   8:31:02a  ..S.R        223,446   218.21 K
e6202g~1.dll   Fri Mar 18 2005   5:26:10p  ..S.R        233,306   227.84 K
fp0o03~1.dll   Tue Mar 15 2005  11:26:18a  ..S.R        233,039   227.57 K
fp6s03~1.dll   Tue Mar  1 2005  12:49:34p  ..S.R        223,620   218.38 K
fp8203~1.dll   Tue Feb 22 2005   6:04:04p  ..S.R        225,299   220.02 K
fprm03~1.dll   Mon Feb 28 2005   9:44:20a  ..S.R        226,069   220.77 K
fysrch.dll     Fri Mar 18 2005   1:52:08a  ..S.R        233,248   227.78 K
h82oli~1.dll   Thu Mar 10 2005   8:35:54a  ..S.R        224,147   218.89 K
iamui.dll      Sun Jan 30 2005  11:06:54p  ..S.R        222,808   217.59 K
ifsecsvc.dll   Sat Jan 29 2005  12:41:48p  ..S.R        225,392   220.11 K
insacct.dll    Mon Jan 24 2005   8:32:12p  ..S.R        222,577   217.36 K
ir24l5~1.dll   Sat Feb 12 2005  11:43:44a  ..S.R        222,920   217.70 K
irfosoft.dll   Sat Feb  5 2005   4:34:24p  ..S.R        223,081   217.85 K
ixetmib1.dll   Mon Jan 24 2005   2:06:40p  ..S.R        225,921   220.63 K
jsbexec.dll    Mon Jan 24 2005  10:43:14p  ..S.R        223,120   217.89 K
jtn207~1.dll   Wed Feb 23 2005   8:10:02a  ..S.R        225,273   219.99 K
kjdhela2.dll   Tue Feb  1 2005   5:28:44p  ..S.R        224,839   219.57 K
ksdkor.dll     Sat Jan  1 2005   2:42:40p  ..S.R        225,921   220.63 K
ksdlt1.dll     Tue Jan 25 2005   1:29:38p  ..S.R        223,908   218.66 K
ksdsmsno.dll   Thu Jan 20 2005  11:11:14a  ..S.R        224,757   219.49 K
kxd101c.dll    Mon Jan 24 2005   7:28:50p  ..S.R        223,120   217.89 K
kzdkaz.dll     Thu Jan 27 2005   3:21:20p  ..S.R        222,993   217.77 K
l0j8la~1.dll   Tue Feb 22 2005   9:24:20a  ..S.R        226,030   220.73 K
l8n40i~1.dll   Wed Mar 16 2005   1:43:30a  ..S.R        233,706   228.23 K
llexpand.dll   Fri Mar 18 2005   5:34:38p  ..S.R        235,156   229.64 K
lsvesnth.dll   Tue Jan 25 2005  12:51:26p  ..S.R        225,733   220.44 K
lv4u09~1.dll   Sat Mar 12 2005   6:01:42p  ..S.R        224,996   219.72 K
lv8u09~1.dll   Tue Feb 22 2005   6:19:58p  ..S.R        226,005   220.71 K
lvn809~1.dll   Thu Mar  3 2005   9:05:18a  ..S.R        222,857   217.63 K
ly0u09~1.dll   Tue Feb  1 2005   9:33:18a  ..S.R        223,717   218.47 K
mbminst.dll    Wed Jan  5 2005   8:18:04p  ..S.R        225,921   220.63 K
mchtmled.dll   Sun Jan  2 2005  11:08:26p  ..S.R        225,921   220.63 K
mdgsvc.dll     Tue Feb  1 2005   1:17:56p  ..S.R        222,808   217.59 K
meaatext.dll   Wed Jan 19 2005   9:57:28a  ..S.R        225,921   220.63 K
mevcrt.dll     Mon Jan 17 2005   6:05:52p  ..S.R        225,921   220.63 K
mhrdim.dll     Sun Jan 23 2005   8:01:44p  ..S.R        224,757   219.49 K
mpvidctl.dll   Tue Jan 25 2005  11:42:00a  ..S.R        223,908   218.66 K
mvpbde40.dll   Wed Feb  2 2005   6:28:36p  ..S.R        222,808   217.59 K
mxaatext.dll   Thu Mar 17 2005  12:14:06a  ..S.R        233,306   227.84 K
n64slg~1.dll   Mon Mar 14 2005   9:51:08p  ..S.R        223,081   217.85 K
njptools.dll   Mon Jan 10 2005   6:50:54p  ..S.R        225,921   220.63 K
nwmsapi.dll    Fri Feb  4 2005  12:50:34p  ..S.R        224,839   219.57 K
o0rola~1.dll   Wed Feb 23 2005   8:27:50a  ..S.R        222,903   217.68 K
oamanage.dll   Tue Mar 15 2005  11:26:18a  ..S.R        232,736   227.28 K
p0n8la~1.dll   Fri Mar 18 2005   1:35:24p  ..S.R        235,156   229.64 K
p6n8lg~1.dll   Tue Feb 22 2005   3:07:06p  ..S.R        225,016   219.74 K
phchdprf.dll   Mon Mar 14 2005   9:51:08p  ..S.R        224,996   219.72 K
pjn8lg~1.dll   Wed Mar 16 2005   1:43:30a  ..S.R        233,248   227.78 K
ptpgasvc.dll   Wed Jan 26 2005   4:58:46p  ..S.R        225,733   220.44 K
qgery.dll      Sun Jan 23 2005   2:07:36a  ..S.R        225,921   220.63 K
qlartz.dll     Mon Jan  3 2005   5:20:04p  ..S.R        224,757   219.49 K
r06ula~1.dll   Fri Mar 18 2005  12:11:00p  ..S.R        235,266   229.75 K
rgoc3260.dll   Fri Jan 28 2005   5:59:06p  ..S.R        224,814   219.54 K
rlsser.dll     Wed Jan 26 2005   2:31:02p  ..S.R        223,206   217.97 K
rtchost.dll    Mon Mar 14 2005   9:51:22p  ..S.R        232,736   227.28 K
sbi.dll        Tue Jan 18 2005   8:35:20a  ..S.R        224,757   219.49 K
smdocvw.dll    Tue Jan  4 2005   9:19:16p  ..S.R        225,921   220.63 K
t88u0i~1.dll   Sat Jan 29 2005   9:31:12a  ..S.R        222,993   217.77 K
tlpi3.dll      Tue Jan 11 2005   9:38:52a  ..S.R        224,757   219.49 K
u4ru0e~1.dll   Mon Feb  7 2005   8:25:06a  ..S.R        222,342   217.13 K
uarv80a.dll    Tue Jan 25 2005   4:07:24p  ..S.R        225,733   220.44 K
uerlbva.dll    Sun Jan 16 2005   8:40:52a  ..S.R        224,757   219.49 K
vhinit.dll     Thu Jan  6 2005   7:53:42p  ..S.R        225,921   220.63 K
vphelper.dll   Thu Jan 13 2005   3:56:16p  ..S.R        225,921   220.63 K
vsconfig.xml   Fri Mar 18 2005   5:34:24p  A..H.            890     0.87 K
wedap32.dll    Mon Jan 24 2005   4:32:38p  ..S.R        222,577   217.36 K
wewfaxui.dll   Sat Feb  5 2005   7:45:32p  ..S.R        222,342   217.13 K
wgavideo.dll   Wed Jan  5 2005   5:27:30p  ..S.R        224,757   219.49 K
wkcsvc.dll     Tue Jan 25 2005   5:44:58p  ..S.R        223,206   217.97 K
wl2time.dll    Thu Feb  3 2005   2:20:16a  ..S.R        223,081   217.85 K
wvashext.dll   Sat Jan 29 2005   9:33:34a  ..S.R        225,392   220.11 K
xtnroll.dll    Sat Jan  8 2005   5:14:06p  ..S.R        225,921   220.63 K
zecommdb.dll   Fri Mar 18 2005  12:11:00p  ..S.R        233,306   227.84 K
zllictbl.dat   Sat Feb  5 2005   7:34:56p  ...H.          4,212     4.11 K


90 items found:  90 files, 0 directories.
Total of file sizes:  19,889,012 bytes     18.96 M


-------- Strings.exe Qoologic Results --------



--------- Strings.exe Aspack Results ---------


C:\WINDOWS\system32\ntdll.dll: .aspack


-------------- HKLM Run Key ----------------


REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"



Hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 1:41:04 PM, on 3/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Stanford\PC-Leland\krbcc32s.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\hijackthis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =


http://www.stanford.edu/
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program


Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common


Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop


Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\WebRoot\Spy


Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active


Desktop Calendar\ADC.exe
O4 - Global Startup: PC-Leland.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -


C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program


Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -


{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -


http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -


https://a248.e.akamai.net/7/248/11498/v1/www.moveonpac.org/content/qt/qtplugin.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware


Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) -


http://www.pulse3d.com/players/english/5.2/win/PulsePlayer5.2AxWin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) -


https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) -


http://64.106.242.160/0664/FileOpen.CAB
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES


Client\BESClient.exe
O23 - Service: DefWatch - Symantec Corporation -


C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation


- C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. -


C:\WINDOWS\system32\ZoneLabs\vsmon.exe