Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
I've run Spybot S&D 1.3 TODAY...and Adaware SE Personal, Build 1.05.
The pop-ups are INCREDIBLE! Also, I get a UMonitor error message when I boot.
Here's my hjt log...please help!
Logfile of HijackThis v1.99.0
Scan saved at 11:47:34 AM, on 1/18/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
We need to clean up some crude before tackling the worst of those nasties
Try to stay off the internet as much as possible untill we are finished.
Start Hijackthis and place a check next to ONLY these items for now,
Close all browser windows and shut down all other programs that show in the taskbar. (even Folders)
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
Restart your PC
Set windows to show hidden extensions file's and folder's. >click here for instructions<.
find and delete (ONLY THESE EXACT) files and folder's (If present)
C:\Program Files\SED
C:\WINNT\SYSTEM32\n20050308.exe
C:\winnt\system32\kalvtcr32.exe
C:\Program Files\AutoUpdate
C:\WINNT\system32\gluhlpr.exe
C:\WINNT\system32\gcdr815s.exe Important
Delete the contents of all your temp folders, as in. Open C:\ then >
C:\documents and settings\(all your pc users)\local settings\temp Note: Some systems have temporary internet files, Application Data and History in that temp, if so leave them and delete all other folders and files inside that temp..
Delete the contents of the C:\windows\temp folder
Clear Internet Explorers's cache
1. In Control Panel, open Internet Options.
2. Click the General tab, and then under Temporary Internet files, click Delete Files.
3. In the Delete Files dialog box, click to select the Delete all offline content check box.
4. wait for the hourglass to disapear
5. Click OK.
Make and post the results of this batch file
=============
Launch Notepad, and copy/paste the bolded below into a new text file. Save it as Findkalv.bat and save it on your Desktop.
dir C:\winnt\system32\kalv?????.exe /a h > files.txt
notepad files.txt
Locate Findkalv.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text here.
=================
Next:
Download Find-qoologic.zip from here http://forums.skads.org/index.php?showtopic=89
Unzip the the files open the qoologic folder, Then run qoologic.bat from there wait for it to finish.
it will take awhile wait untill the dos box disapears and disk activity stops at text will open, post that back here please along with a new hijackthis log.
Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F
Directory of C:\winnt\system32
Directory of C:\Documents and Settings\adudley\Desktop
----------------------------------------------------------
text from goologic:
C:\Documents and Settings\adudley\My Documents\qoologic
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINNT\SYSTEM32\eieeis.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\hlhhlx.exe: updates.qoologic.com
C:\WINNT\SYSTEM32\clccli.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\pwppwg.dat: .aspack
C:\WINNT\SYSTEM32\wvwwvq.exe: .aspack
Files Found in all users startup Folder............
------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe: .aspack
Files Found in all users windows Folder............
------------------------
Finished
----------------------------------------------------------
new hjt log:
Logfile of HijackThis v1.99.0
Scan saved at 2:24:00 PM, on 1/18/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Please copy this to a text for referance
Is this something you know of ?
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
If not add it to the list below
[1] Download Pocket Killbox.version 2.0.0.76
If you already have Killbox ensure its this version
[2] Unzip the contents of KillBox.zip to a convenient location.
[3] Close all Browsers and programs that show in the windows taskbar
[4] Double-click on KillBox.exe.
[5] Click "Delete on Reboot"
[6] Copy/Paste this file into the top "Full Path of File to Delete" box.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe
[7] Click the "Delete File" button which looks like a stop sign.
[8] Click "Yes" at the Replace on Reboot prompt.
[9] Click "No" at the Pending Operations prompt.
[10] Repeat steps 5-9 above for these files.
C:\WINNT\SYSTEM32\eieeis.dll
C:\WINNT\SYSTEM32\hlhhlx.exe
C:\WINNT\SYSTEM32\clccli.dll
C:\WINNT\SYSTEM32\pwppwg.dat
C:\WINNT\SYSTEM32\wvwwvq.exe
C:\winnt\system32\kalvtcr32.exe
C:\WINNT\EliteToolBar\EliteToolBar.dll
[11] Use the browse Button (folder icon) to look in all users startup>
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Id you see a similur file to those we have just marked for deletion add it to.
[12] Exit Killbox, restart your PC
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
Once posted do not restart your pc untill suggested
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F
Directory of C:\winnt\system32
Directory of C:\Documents and Settings\adudley\Desktop
----------------------------------------------------------------
new hjt log:
Logfile of HijackThis v1.99.0
Scan saved at 3:19:41 PM, on 1/18/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
These are the registry keys present
*************************************************************************** *******
Winlogon/notify:
Windows Registry Editor Version 5.00
*************************************************************************** *******
useragent:
*************************************************************************** *******
Windows Registry Editor Version 5.00
Ok. do this, Note to others do not use the L2mfix tool without assistance please, they will all be slightly differant
Close any programs you have open since this step requires a reboot.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread,
in the l2mfix folder rightclick on the Cleanup.reg file choose open with, choose notepad and copy that here to.
IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.PeacockATbeyondlogic.org
Killing PID 1276 'explorer.exe'
Killing PID 1276 'explorer.exe'
Error 0x5 : Access is denied.
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.PeacockATbeyondlogic.org
Killing PID 1280 'rundll32.exe'
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for really "Everyone"
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
deleting local copy: NHLANUI.DLL
deleting local copy: ir02l5do1.dll
deleting local copy: gpp8l37u1.dll
deleting local copy: mvrsl9971.dll
deleting local copy: i0lola331d.dll
deleting local copy: i0nmla511d.dll
deleting local copy: enrul1991.dll
The following Is the Current Export of the Winlogon notify key:
*************************************************************************** *
Windows Registry Editor Version 5.00
The following are the files found:
*************************************************************************** *
C:\WINNT\system32\NHLANUI.DLL
C:\WINNT\system32\ir02l5do1.dll
C:\WINNT\system32\gpp8l37u1.dll
C:\WINNT\system32\mvrsl9971.dll
C:\WINNT\system32\i0lola331d.dll
C:\WINNT\system32\i0nmla511d.dll
C:\WINNT\system32\enrul1991.dll
Registry Entries to be Deleted:
Please verify that the listing looks ok. It shouldn't be longer than 13 lines
If approved by helper double click the cleanup.reg in the l2mfix folder.
*************************************************************************** *
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{A591C55F-C50C-4D3A-B52F-9EE834F91A68}"=-
*************************************************************************** *
Desktop.ini Contents:
*************************************************************************** *
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{A591C55F-C50C-4D3A-B52F-9EE834F91A68}</IDone>
<IDtwo>AD</IDtwo>
<VERSION>200</VERSION>
*************************************************************************** *
Classid's found from regsearch:
*************************************************************************** *
The problem: there is NO cleanup.reg file in the folder!!! how can that be?
Not to worry, download to your desktop this attachment "omytooFixMereg.txt"
Rightclick and choose rename, rename to omytooFixMereg.REG save and exit
run the reg file by double clicking it answer yes to the prompt, you should recieve a suceed message did you ?
Open the system32 folder
C:\winnt\system32\ sort by date Look for kalvtcr32.exe
and tell us what other files are there beside it? they will be of a sililur name
like kal****32.exe where * is any character
?
Post a New hijackthis log and mention it if there are any problems.
Delete C:\WINNT\system32\kalv???32.exe <these file's
(where ??? indicates random characters).
Delete C:\WINNT\EliteToolBar
Delete the entire contents of all Temp folders.
Delete the error32.dat file in System32.
Run HijackThis and fix all related items (still in Safe Mode).
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar.dll
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
Ok, ran the omytoofixmereg.reg...did all the rest...kept looking for a kalv(anything).exe file in winnt/system32...and it simply isn't there...nothing even remotely like it...and yet, as you'll see, it shows up in my hjt log over and over again...
Logfile of HijackThis v1.99.0
Scan saved at 9:47:11 AM, on 1/19/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
You looked for C:\WINNT\system32\kalv???32.exe <these file's
While in safe mode correct ?
Since you mention a winlogon error, delete your L2mfix redownload, they have changed it slightly. same instructions basicly.
I think its gone but just want to be sure.
Download L2mfix from one of these two locations:
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
Once posted do not restart your pc untill suggested
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Note to others, do not use this tool without assistance, the infection is always slightly differant.
==================
L2MFIX find log 1.01
These are the registry keys present
*************************************************************************** *******
Winlogon/notify:
Windows Registry Editor Version 5.00
*************************************************************************** *******
Files Found are not all bad files:
C:\WINNT\SYSTEM32\
shdocvw.dll Thu Nov 11 2004 11:20:56p A.... 1,332,224 1.27 M
ogbc32gt.dll Wed Jan 19 2005 9:17:56a ..S.R 222,578 217.36 K
dusrslvr.dll Tue Jan 18 2005 4:19:02p A.... 222,550 217.33 K
mwrtedit.dll Tue Jan 18 2005 4:16:56p A.... 222,550 217.33 K
dcmrtp.dll Tue Jan 18 2005 4:37:58p A.... 222,550 217.33 K
urlmon.dll Mon Oct 25 2004 10:39:52a A.... 450,048 439.50 K
mshtml.dll Mon Oct 25 2004 10:39:16a A.... 2,693,120 2.57 M
sysfile.dll Wed Dec 29 2004 10:35:14a A.... 378 0.37 K
booknew.dll Tue Dec 28 2004 1:52:22p A.... 327,680 320.00 K
pop5.dll Tue Dec 28 2004 1:52:22p A.... 53,760 52.50 K
wxhtcpip.dll Tue Jan 18 2005 4:35:04p A.... 222,550 217.33 K
eieeis.dll Tue Jan 18 2005 5:56:06p A.... 24,576 24.00 K
clccli.dll Tue Jan 18 2005 5:56:08p A.... 5,632 5.50 K
iwrop.dll Wed Jan 19 2005 9:28:46a A.... 222,578 217.36 K
exact.dll Wed Dec 22 2004 3:45:02p A.... 380,928 372.00 K
akcore.dll Tue Jan 4 2005 8:57:36a A.... 188,416 184.00 K
akupd.dll Tue Jan 4 2005 8:57:34a A.... 155,648 152.00 K
akrules.dll Tue Jan 4 2005 8:57:38a A.... 110,592 108.00 K
aklsp.dll Tue Jan 4 2005 8:57:38a A.... 196,608 192.00 K
tv2.dll Wed Dec 29 2004 10:35:18a A.... 393,216 384.00 K
casync.dll Mon Jan 10 2005 12:47:50p A.... 114,688 112.00 K
sporder.dll Tue Jan 4 2005 8:57:38a A.... 8,464 8.27 K
cacore.dll Tue Jan 18 2005 9:43:00a A.... 151,552 148.00 K
carules.dll Tue Jan 4 2005 9:57:34a A.... 45,056 44.00 K
h44m0e~1.dll Wed Jan 19 2005 8:49:52a ..S.R 222,694 217.47 K
hypertrm.dll Tue Nov 16 2004 5:47:02a A.... 576,784 563.27 K
ciodm.dll Thu Nov 4 2004 11:41:52p A.... 68,880 67.27 K
user32.dll Wed Dec 29 2004 4:14:10a A.... 380,688 371.77 K
sp3res.dll Thu Dec 2 2004 9:27:18a A.... 6,272,512 5.98 M
fp6003~1.dll Wed Jan 19 2005 9:17:56a ..S.R 222,641 217.42 K
l06ola~1.dll Tue Jan 18 2005 3:42:14p ..S.R 223,910 218.66 K
31 items found: 31 files (4 H/S), 0 directories.
Total of file sizes: 15,936,051 bytes 15.20 M
Locate .tmp files:
No matches found.
*************************************************************************** *******
Directory Listing of system files:
Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F
C:\Documents and Settings\adudley\My Documents\qoologic
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINNT\SYSTEM32\eieeis.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\hlhhlx.exe: updates.qoologic.com
C:\WINNT\SYSTEM32\clccli.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\pwppwg.dat: .aspack
C:\WINNT\SYSTEM32\wvwwvq.exe: .aspack
Files Found in all users startup Folder............
------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe: .aspack
Files Found in all users windows Folder............
------------------------
Finished
Close any programs you have open since this step requires a reboot.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. close it for now.
IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
=====================
Now restart into safe mode
find and delete (ONLY THESE EXACT) files and folder's
C:\WINNT\SYSTEM32\eieeis.dll
C:\WINNT\SYSTEM32\hlhhlx.exe
C:\WINNT\SYSTEM32\clccli.dll
C:\WINNT\SYSTEM32\pwppwg.dat
C:\WINNT\SYSTEM32\wvwwvq.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe
C:\WINNT\system32\wsxsvc
C:\WINNT\system32\vmss
C:\Program Files\se
C:\winnt\system32\kalvtcr32.exe
Delete C:\winnt\system32\kalv???32.exe <these file's
(where ??? indicates random characters).
Delete C:\winnt\EliteToolBar
C:\winnt\bundles is there delete it.
C:\winnt\SYSTEM32\DRIVERS\etc\hosts < its the file with no extension
Delete the entire contents of all Temp folders.
Restart the PC back to a normal windows session post a new hijackthis log and the log.txt thats in the l2mfix folder
