1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Help with HJT log

Discussion in 'Malware and Virus Removal Archive' started by Bucksone, 2005/11/26.

  1. 2005/11/26
    Bucksone

    Bucksone Well-Known Member Thread Starter

    Joined:
    2003/07/28
    Messages:
    507
    Likes Received:
    2
    My in-laws' computer is in trouble yet again. Their homepage has been hijacked. They have the AVG free virus software. When you open Internet Explorer, a box says, "Virus detected when opening file C:\Windows\Temp\SE.DLL Trojan horse StartPage 19J. When I run a virus scan, however, it comes up with nothing. I ran and deleted a bunch of spyware with Ad-Aware. I deleted cookies and temporary internet files. Below is a Hijack This log. Their computer is an older machine, running Windows 98. Any assistance will be appreciated.

    Logfile of HijackThis v1.99.1
    Scan saved at 1:46:20 PM, on 11/26/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v5.00 (5.00.2614.3500)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    c:\windows\SYSTEM\KB891711\KB891711.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\CSAFE\AUTOCHK.EXE
    C:\IBMTOOLS\APTEZBTN\APTEZBP.EXE
    C:\WINDOWS\SYSTEM\PELMICED.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
    C:\WINDOWS\SYSTEM\LEXBCES.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\LEXPPS.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {F2B19AA1-5602-11DA-A3B0-00080C0C8D6F} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
    O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\Run: [LexStart] lexstart.exe
    O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\SYSTEM\intell32.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exe
    O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
    O18 - Filter: text/html - {1E3921EC-5E7B-11DA-A3B0-000803BCCB14} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O18 - Filter: text/plain - {1E3921EC-5E7B-11DA-A3B0-000803BCCB14} - C:\WINDOWS\SYSTEM\BOEP.DLL
     
    Bucksone,
    #1
  2. 2005/11/27
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    use hjt to remove these items:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {F2B19AA1-5602-11DA-A3B0-00080C0C8D6F} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O18 - Filter: text/html - {1E3921EC-5E7B-11DA-A3B0-000803BCCB14} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O18 - Filter: text/plain - {1E3921EC-5E7B-11DA-A3B0-000803BCCB14} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\SYSTEM\intell32.exe

    Find these files and delete them:
    se.dll
    boep.dll
    intell32.exe
    delete all files in c/windows/temp
     
    TonyT,
    #2


  3. to hide this advert.

  4. 2005/11/27
    Bucksone

    Bucksone Well-Known Member Thread Starter

    Joined:
    2003/07/28
    Messages:
    507
    Likes Received:
    2
    Thanks for the reply. Since the computer is at my in-laws' house, it will have to wait until the next time I am over there.
     
    Bucksone,
    #3
  5. 2005/12/08
    Bucksone

    Bucksone Well-Known Member Thread Starter

    Joined:
    2003/07/28
    Messages:
    507
    Likes Received:
    2
    I followed the above instructions. The only hitch I ran into was in deleting boep.dll. It said "cannot delete BOEP. The specified file is being used by Windows." Also, intell32.exe, it said not found.

    The problem still exists.

    I ran an Ad-Aware scan and found about 21 entries for CoolWebSearch, which I deleted. I have done this in the past, but it comes back.

    I noticed that they no longer have their Zone Alarm firewall, so I downloaded the free version, but when I tried to install it I got the following message. "Validation failed for C:\WINDOWS\TEMP\VSINIT.DLL. You are probably missing a necessary root certificate. "

    Below is the latest HJT log.Logfile of HijackThis v1.99.1
    Scan saved at 4:46:04 PM, on 12/8/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v5.00 (5.00.2614.3500)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    c:\windows\SYSTEM\KB891711\KB891711.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\CSAFE\AUTOCHK.EXE
    C:\IBMTOOLS\APTEZBTN\APTEZBP.EXE
    C:\WINDOWS\SYSTEM\PELMICED.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
    C:\WINDOWS\SYSTEM\LEXBCES.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\LEXPPS.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {27FAEEE9-6806-11DA-A3B0-0008A7C4C553} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
    O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\Run: [LexStart] lexstart.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exe
    O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
    O18 - Filter: text/html - {27FAEEFB-6806-11DA-A3B0-0008C4B7E6B3} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O18 - Filter: text/plain - {27FAEEFB-6806-11DA-A3B0-0008C4B7E6B3} - C:\WINDOWS\SYSTEM\BOEP.DLL

    Thanks for any assistance. The delays in my replying to any posts are because I have to wait until the next time I come to my in-laws house for something to work on their computer each time.
     
    Bucksone,
    #4
  6. 2005/12/10
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Fix these:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {27FAEEE9-6806-11DA-A3B0-0008A7C4C553} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O18 - Filter: text/html - {27FAEEFB-6806-11DA-A3B0-0008C4B7E6B3} - C:\WINDOWS\SYSTEM\BOEP.DLL
    O18 - Filter: text/plain - {27FAEEFB-6806-11DA-A3B0-0008C4B7E6B3} - C:\WINDOWS\SYSTEM\BOEP.DLL

    next:
    reboot the computer and press the F8 key to get the boot menu and select DOS. At the DOS prompt type:
    Code:
    del C:\WINDOWS\SYSTEM\BOEP.DLL
    and next type:
    Code:
    del C:\WINDOWS\TEMP\*.*
    next:
    press control-alt-delkete keys to reboot the computer.

    go here and download CWShredder and use it to clean out remaining Cool Web Search spyware: (it may or may not find remnants but best to try)
    http://www.intermute.com/spysubtract/cwshredder_download.html

    next:
    update avg antivirus and perform a full scan.

    next:
    go to Windows Update and get the security updates for the computer. The comp has a networking process running C:\WINDOWS\SYSTEM\RPCSS.EXE which may need to be updated.

    re zone alarm error:
    This is caused by missing root certificates, or damaged Internet Explorer.

    uninstall Zone Alarm using this method:
    http://nh3.nohold.net/noHoldCust25/Prod_1/Articles55646/CompleteUninstallNonNT.html
    & reboot computer

    Go to start/programs/accessories/system tools/system information
    click the Tools Menu and select repair Internet Explorer.
    computer will reboot

    next:
    download zone alarm and install again. If no joy after install, repeat above steps and get a better different firewall.
     
    TonyT,
    #5
  7. 2005/12/10
    sparrow

    sparrow Inactive

    Joined:
    2004/03/21
    Messages:
    2,282
    Likes Received:
    0
    In Win98, hold ctrl key down while booting to access the boot menu.
     
    sparrow,
    #6
  8. 2005/12/10
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Why? Another method? F8 works for win98.
     
    TonyT,
    #7
  9. 2005/12/10
    sparrow

    sparrow Inactive

    Joined:
    2004/03/21
    Messages:
    2,282
    Likes Received:
    0
    Thanks. Live and learn. :D
     
    sparrow,
    #8
  10. 2005/12/13
    Bucksone

    Bucksone Well-Known Member Thread Starter

    Joined:
    2003/07/28
    Messages:
    507
    Likes Received:
    2
    I followed TonyT's instructions and it seems to have resolved the problem. The only thing I have left to do is to take care of some Windows Updates. I did the critical updates, but ran out of time to do the 43 others. I think they had to re-install Windows a while back, and they never went to the Windows Update site to download updates.
    Thanks again for the help.
     
    Bucksone,
    #9
  11. 2005/12/13
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    good to hear all is now well.
     
    TonyT,
    #10

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...