DMVlite...geez...HJT log included

omytoo · 2005/01/18

Hello there...

I've run Spybot S&D 1.3 TODAY...and Adaware SE Personal, Build 1.05.

The pop-ups are INCREDIBLE! Also, I get a UMonitor error message when I boot.

Here's my hjt log...please help!

Logfile of HijackThis v1.99.0
Scan saved at 11:47:34 AM, on 1/18/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\system32\SxgTkBar.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\SED\SED.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\WINNT\system32\wvwwvq.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\WINNT\system32\gluhlpr.exe
C:\WINNT\system32\gcdr815s.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\Documents and Settings\adudley\My Documents\highjack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [sethook] cmd /c start /min cmd /c c:\dell\src_path.cmd
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe "
O4 - HKLM\..\Run: [DI2] "C:\DOCUME~1\adudley\LOCALS~1\Temp\27.exe\27.exe "
O4 - HKLM\..\Run: [ntechin] C:\WINNT\SYSTEM32\n20050308.exe
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe "
O4 - HKLM\..\Run: [p4mW37O] gluhlpr.exe
O4 - HKCU\..\Run: [Y356RXi7e] gcdr815s.exe
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: printkey.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4021/ftp.coupons.com/v3123/cpbrkpie.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {BAB3E70B-A847-4A88-ACFC-778FCCC00287} (CActSetupObj Object) - http://www.odysseusmarketing.com/actsetup.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: Win6l5oahder - Intel - (no file)

Lonny Jones · 2005/01/18

Hello

Welcome to the forum

We need to clean up some crude before tackling the worst of those nasties
Try to stay off the internet as much as possible untill we are finished.

Start Hijackthis and place a check next to ONLY these items for now,
Close all browser windows and shut down all other programs that show in the taskbar. (even Folders)
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php

O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe "
O4 - HKLM\..\Run: [DI2] "C:\DOCUME~1\adudley\LOCALS~1\Temp\27.exe\27.exe "
O4 - HKLM\..\Run: [ntechin] C:\WINNT\SYSTEM32\n20050308.exe
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe "
O4 - HKLM\..\Run: [p4mW37O] gluhlpr.exe
O4 - HKCU\..\Run: [Y356RXi7e] gcdr815s.exe
O4 - Startup: DLHelperEXE.exe
O16 - DPF: {BAB3E70B-A847-4A88-ACFC-778FCCC00287} (CActSetupObj Object) - =http://www.odysseusmarketing.com/actsetup.cab
========================

Hit fix checked and close Hijackthis.

Restart your PC
Set windows to show hidden extensions file's and folder's.
>click here for instructions<.
find and delete (ONLY THESE EXACT) files and folder's (If present)
C:\Program Files\SED
C:\WINNT\SYSTEM32\n20050308.exe
C:\winnt\system32\kalvtcr32.exe
C:\Program Files\AutoUpdate
C:\WINNT\system32\gluhlpr.exe
C:\WINNT\system32\gcdr815s.exe
Important
Delete the contents of all your temp folders, as in. Open C:\ then >
C:\documents and settings\(all your pc users)\local settings\temp
Note: Some systems have temporary internet files, Application Data and History in that temp, if so leave them and delete all other folders and files inside that temp..
Delete the contents of the C:\windows\temp folder

Clear Internet Explorers's cache
1. In Control Panel, open Internet Options.
2. Click the General tab, and then under Temporary Internet files, click Delete Files.
3. In the Delete Files dialog box, click to select the Delete all offline content check box.
4. wait for the hourglass to disapear
5. Click OK.
Make and post the results of this batch file
=============
Launch Notepad, and copy/paste the bolded below into a new text file. Save it as Findkalv.bat and save it on your Desktop.

dir C:\winnt\system32\kalv?????.exe /a h > files.txt
notepad files.txt

Locate Findkalv.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text here.
=================
Next:
Download Find-qoologic.zip from here
http://forums.skads.org/index.php?showtopic=89

Unzip the the files open the qoologic folder, Then run qoologic.bat from there wait for it to finish.
it will take awhile wait untill the dos box disapears and disk activity stops at text will open, post that back here please along with a new hijackthis log.

omytoo · 2005/01/18

OK.

text from findkalv.bat:

Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F

Directory of C:\winnt\system32

Directory of C:\Documents and Settings\adudley\Desktop
----------------------------------------------------------
text from goologic:

C:\Documents and Settings\adudley\My Documents\qoologic

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINNT\SYSTEM32\eieeis.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\hlhhlx.exe: updates.qoologic.com
C:\WINNT\SYSTEM32\clccli.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\pwppwg.dat: .aspack
C:\WINNT\SYSTEM32\wvwwvq.exe: .aspack

Files Found in all users startup Folder............
------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe: .aspack
Files Found in all users windows Folder............
------------------------
Finished
----------------------------------------------------------
new hjt log:

Logfile of HijackThis v1.99.0
Scan saved at 2:24:00 PM, on 1/18/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wvwwvq.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\system32\SxgTkBar.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\SYSTEM32\rundll32.exe
C:\Documents and Settings\adudley\My Documents\highjack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [sethook] cmd /c start /min cmd /c c:\dell\src_path.cmd
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: printkey.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: Win6l5oahder - Intel - (no file)

Lonny Jones · 2005/01/18

Hello

Please copy this to a text for referance
Is this something you know of ?
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
If not add it to the list below

[1] Download Pocket Killbox.version 2.0.0.76
If you already have Killbox ensure its this version
[2] Unzip the contents of KillBox.zip to a convenient location.
[3] Close all Browsers and programs that show in the windows taskbar
[4] Double-click on KillBox.exe.
[5] Click "Delete on Reboot "
[6] Copy/Paste this file into the top "Full Path of File to Delete" box.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe

[7] Click the "Delete File" button which looks like a stop sign.
[8] Click "Yes" at the Replace on Reboot prompt.
[9] Click "No" at the Pending Operations prompt.
[10] Repeat steps 5-9 above for these files.

C:\WINNT\SYSTEM32\eieeis.dll
C:\WINNT\SYSTEM32\hlhhlx.exe
C:\WINNT\SYSTEM32\clccli.dll
C:\WINNT\SYSTEM32\pwppwg.dat
C:\WINNT\SYSTEM32\wvwwvq.exe
C:\winnt\system32\kalvtcr32.exe
C:\WINNT\EliteToolBar\EliteToolBar.dll
[11] Use the browse Button (folder icon) to look in all users startup>
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Id you see a similur file to those we have just marked for deletion add it to.
[12] Exit Killbox, restart your PC

Download and Unzip the LSP tool
http://downloads.net-integration.net/lspfix.zip
alternate download areas >
http://castlecops.com/downloads-file-334.html
http://www.cexx.org/LSPFix.exe
close the internet connection and any programs that show in the taskbar,, start the tool, check the box that says you know what you are doing, fix all instances (and only those) of "calsp.dll" (ie, move it/them to the remove window, click finish)

Now restart your computer, and delete that c:\winnt\system32\calsp.dll
file

Try this batch for findkalv.bat

dir C:\winnt\system32\kalv*.exe /a h > files.txt
notepad files.txt

Post that and a new hiajckthis log,

then in another post becouse it will be quite large the L2mfix report.
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
Once posted do not restart your pc untill suggested
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

omytoo · 2005/01/18

Here we go...

NEW findkalv.bat text:

Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F

Directory of C:\winnt\system32

Directory of C:\Documents and Settings\adudley\Desktop
----------------------------------------------------------------
new hjt log:

Logfile of HijackThis v1.99.0
Scan saved at 3:19:41 PM, on 1/18/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\system32\SxgTkBar.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Documents and Settings\adudley\My Documents\highjack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [sethook] cmd /c start /min cmd /c c:\dell\src_path.cmd
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wvwwvq.exe
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: printkey.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: Win6l5oahder - Intel - (no file)

-------------------------------------------------------------------
L2mfix report in next post

omytoo · 2005/01/18

L2mfix report:

These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AdminDebug]
"Asynchronous "=dword:00000000
"DllName "= "C:\\WINNT\\system32\\m0lsla371d.dll "
"Impersonate "=dword:00000000
"Logon "= "WinLogon "
"Logoff "= "WinLogoff "
"Shutdown "= "WinShutdown "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff "= "ChainWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff "= "CryptnetWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName "= "cscdll.dll "
"Logon "= "WinlogonLogonEvent "
"Logoff "= "WinlogonLogoffEvent "
"ScreenSaver "= "WinlogonScreenSaverEvent "
"Startup "= "WinlogonStartupEvent "
"Shutdown "= "WinlogonShutdownEvent "
"StartShell "= "WinlogonStartShellEvent "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName "= "C:\\WINNT\\System32\\NavLogon.dll "
"Logoff "= "NavLogoffEvent "
"StartShell "= "NavStartShellEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff "= "WLEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001
"DllName "=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName "= "WlNotify.dll "
"Lock "= "SensLockEvent "
"Logon "= "SensLogonEvent "
"Logoff "= "SensLogoffEvent "
"Safe "=dword:00000001
"MaxWait "=dword:00000258
"StartScreenSaver "= "SensStartScreenSaverEvent "
"StopScreenSaver "= "SensStopScreenSaverEvent "
"Startup "= "SensStartupEvent "
"Shutdown "= "SensShutdownEvent "
"StartShell "= "SensStartShellEvent "
"Unlock "= "SensUnlockEvent "
"Impersonate "=dword:00000001
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName "= "wzcdlg.dll "
"Logon "= "WZCEventLogon "
"Logoff "= "WZCEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000000

**********************************************************************************
useragent:
**********************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{0376E960-9B6E-4872-BB1F-E7DE94FD573E} "=" "

Files Found are not all bad files:

C:\WINNT\SYSTEM32\
dqraw.dll Tue Jan 18 2005 3:04:48p ..S.R 226,191 220.89 K
nhlanui.dll Tue Jan 18 2005 1:27:52p ..S.R 226,191 220.89 K
sclwoa.dll Tue Jan 18 2005 3:08:00p ..S.R 222,550 217.33 K
ir02l5~1.dll Mon Jan 10 2005 10:11:48a ..S.R 224,947 219.67 K
gpp8l3~1.dll Tue Jan 11 2005 10:02:30a ..S.R 223,144 217.91 K
mvrsl9~1.dll Thu Jan 13 2005 3:49:32p ..S.R 224,102 218.85 K
i0lola~1.dll Thu Jan 13 2005 1:38:30p ..S.R 225,432 220.15 K
m0lsla~1.dll Tue Jan 18 2005 3:03:10p ..S.R 222,550 217.33 K
i0nmla~1.dll Mon Jan 10 2005 10:28:54a ..S.R 225,857 220.56 K
enrul1~1.dll Tue Jan 18 2005 3:06:48p ..S.R 226,191 220.89 K

10 items found: 10 files, 0 directories.
Total of file sizes: 2,247,155 bytes 2.14 M

No matches found.

Lonny Jones · 2005/01/18

Ok. do this, Note to others do not use the L2mfix tool without assistance please, they will all be slightly differant

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread,
in the l2mfix folder rightclick on the Cleanup.reg file choose open with, choose notepad and copy that here to.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!

omytoo · 2005/01/18

here's the log:

Setting Directory
H:\
H:\
System Rebooted!

Running From:
H:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.PeacockATbeyondlogic.org
Killing PID 1276 'explorer.exe'
Killing PID 1276 'explorer.exe'
Error 0x5 : Access is denied.

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.PeacockATbeyondlogic.org
Killing PID 1280 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINNT\system32\NHLANUI.DLL
1 file(s) copied.
Backing Up: C:\WINNT\system32\ir02l5do1.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\gpp8l37u1.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\mvrsl9971.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\i0lola331d.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\i0nmla511d.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\enrul1991.dll
1 file(s) copied.
deleting: C:\WINNT\system32\NHLANUI.DLL
Successfully Deleted: C:\WINNT\system32\NHLANUI.DLL
deleting: C:\WINNT\system32\ir02l5do1.dll
Successfully Deleted: C:\WINNT\system32\ir02l5do1.dll
deleting: C:\WINNT\system32\gpp8l37u1.dll
Successfully Deleted: C:\WINNT\system32\gpp8l37u1.dll
deleting: C:\WINNT\system32\mvrsl9971.dll
Successfully Deleted: C:\WINNT\system32\mvrsl9971.dll
deleting: C:\WINNT\system32\i0lola331d.dll
Successfully Deleted: C:\WINNT\system32\i0lola331d.dll
deleting: C:\WINNT\system32\i0nmla511d.dll
Successfully Deleted: C:\WINNT\system32\i0nmla511d.dll
deleting: C:\WINNT\system32\enrul1991.dll
Successfully Deleted: C:\WINNT\system32\enrul1991.dll

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: enrul1991.dll (200 bytes security) (deflated 5%)
adding: gpp8l37u1.dll (200 bytes security) (deflated 3%)
adding: i0lola331d.dll (200 bytes security) (deflated 4%)
adding: i0nmla511d.dll (200 bytes security) (deflated 5%)
adding: ir02l5do1.dll (200 bytes security) (deflated 4%)
adding: mvrsl9971.dll (200 bytes security) (deflated 4%)
adding: NHLANUI.DLL (200 bytes security) (deflated 5%)
adding: desktop.ini (200 bytes security) (deflated 13%)
adding: lo2.txt (200 bytes security) (deflated 75%)
adding: test.txt (200 bytes security) (deflated 64%)
adding: xfind.txt (200 bytes security) (deflated 57%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for really "Everyone "

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: NHLANUI.DLL
deleting local copy: ir02l5do1.dll
deleting local copy: gpp8l37u1.dll
deleting local copy: mvrsl9971.dll
deleting local copy: i0lola331d.dll
deleting local copy: i0nmla511d.dll
deleting local copy: enrul1991.dll

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff "= "ChainWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff "= "CryptnetWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName "= "cscdll.dll "
"Logon "= "WinlogonLogonEvent "
"Logoff "= "WinlogonLogoffEvent "
"ScreenSaver "= "WinlogonScreenSaverEvent "
"Startup "= "WinlogonStartupEvent "
"Shutdown "= "WinlogonShutdownEvent "
"StartShell "= "WinlogonStartShellEvent "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName "= "C:\\WINNT\\System32\\NavLogon.dll "
"Logoff "= "NavLogoffEvent "
"StartShell "= "NavStartShellEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff "= "WLEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001
"DllName "=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName "= "WlNotify.dll "
"Lock "= "SensLockEvent "
"Logon "= "SensLogonEvent "
"Logoff "= "SensLogoffEvent "
"Safe "=dword:00000001
"MaxWait "=dword:00000258
"StartScreenSaver "= "SensStartScreenSaverEvent "
"StopScreenSaver "= "SensStopScreenSaverEvent "
"Startup "= "SensStartupEvent "
"Shutdown "= "SensShutdownEvent "
"StartShell "= "SensStartShellEvent "
"Unlock "= "SensUnlockEvent "
"Impersonate "=dword:00000001
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName "= "wzcdlg.dll "
"Logon "= "WZCEventLogon "
"Logoff "= "WZCEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000000

The following are the files found:
****************************************************************************
C:\WINNT\system32\NHLANUI.DLL
C:\WINNT\system32\ir02l5do1.dll
C:\WINNT\system32\gpp8l37u1.dll
C:\WINNT\system32\mvrsl9971.dll
C:\WINNT\system32\i0lola331d.dll
C:\WINNT\system32\i0nmla511d.dll
C:\WINNT\system32\enrul1991.dll

Registry Entries to be Deleted:
Please verify that the listing looks ok. It shouldn't be longer than 13 lines
If approved by helper double click the cleanup.reg in the l2mfix folder.
****************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{A591C55F-C50C-4D3A-B52F-9EE834F91A68} "=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{A591C55F-C50C-4D3A-B52F-9EE834F91A68}</IDone>
<IDtwo>AD</IDtwo>
<VERSION>200</VERSION>
****************************************************************************
Classid's found from regsearch:
****************************************************************************

The problem: there is NO cleanup.reg file in the folder!!! how can that be?

omytoo · 2005/01/18

also, I got an error message when running the fix (#2) it said:

"Cannot import cecho.reg: error opening the file. There may be a disk or file system error "

Lonny Jones · 2005/01/19

Hello

Not to worry, download to your desktop this attachment "omytooFixMereg.txt "
Rightclick and choose rename, rename to omytooFixMereg.REG save and exit
run the reg file by double clicking it answer yes to the prompt, you should recieve a suceed message did you ?

Open the system32 folder
C:\winnt\system32\ sort by date Look for kalvtcr32.exe
and tell us what other files are there beside it? they will be of a sililur name
like kal****32.exe where * is any character
?

Post a New hijackthis log and mention it if there are any problems.

Lonny Jones · 2005/01/19

Hi do this for the kalvsys related files.

Reboot into Safe Mode.

Delete C:\WINNT\system32\kalv???32.exe <these file's
(where ??? indicates random characters).
Delete C:\WINNT\EliteToolBar
Delete the entire contents of all Temp folders.

Delete the error32.dat file in System32.

Run HijackThis and fix all related items (still in Safe Mode).
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar.dll
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe

Restart back to normal
Download Unzip and run the following Registry file:
http://aumha.org/downloads/elitebar.zip

Once back make and post a hijackthis log

omytoo · 2005/01/19

Ok, ran the omytoofixmereg.reg...did all the rest...kept looking for a kalv(anything).exe file in winnt/system32...and it simply isn't there...nothing even remotely like it...and yet, as you'll see, it shows up in my hjt log over and over again...

Logfile of HijackThis v1.99.0
Scan saved at 9:47:11 AM, on 1/19/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\rundll32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\system32\SxgTkBar.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\wsxsvc\wsxsvc.exe
C:\WINNT\system32\vmss\vmss.exe
C:\WINNT\system32\wvwwvq.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Documents and Settings\adudley\My Documents\highjack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [sethook] cmd /c start /min cmd /c c:\dell\src_path.cmd
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Dvx] C:\WINNT\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINNT\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: printkey.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: Win6l5oahder - Intel - (no file)

I keep getting a winlogon.exe error that shuts me down now, too!!

Lonny Jones · 2005/01/19

Hi

You looked for C:\WINNT\system32\kalv???32.exe <these file's
While in safe mode correct ?

Since you mention a winlogon error, delete your L2mfix redownload, they have changed it slightly. same instructions basicly.
I think its gone but just want to be sure.
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
Once posted do not restart your pc untill suggested
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

Note to others, do not use this tool without assistance, the infection is always slightly differant.
==================

Run run qoologic.bat again and post it log

omytoo · 2005/01/19

L2mfix:

L2MFIX find log 1.01
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous "=dword:00000000
"DllName "=" "
"Impersonate "=dword:00000000
"Logon "= "WinLogon "
"Logoff "= "WinLogoff "
"Shutdown "= "WinShutdown "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx]
"Asynchronous "=dword:00000000
"DllName "= "C:\\WINNT\\system32\\ogbc32gt.dll "
"Impersonate "=dword:00000000
"Logon "= "WinLogon "
"Logoff "= "WinLogoff "
"Shutdown "= "WinShutdown "

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{8E58AA6A-E4E3-4A36-B1B6-7EC6F3522918} "=" "

**********************************************************************************
Files Found are not all bad files:

C:\WINNT\SYSTEM32\
shdocvw.dll Thu Nov 11 2004 11:20:56p A.... 1,332,224 1.27 M
ogbc32gt.dll Wed Jan 19 2005 9:17:56a ..S.R 222,578 217.36 K
dusrslvr.dll Tue Jan 18 2005 4:19:02p A.... 222,550 217.33 K
mwrtedit.dll Tue Jan 18 2005 4:16:56p A.... 222,550 217.33 K
dcmrtp.dll Tue Jan 18 2005 4:37:58p A.... 222,550 217.33 K
urlmon.dll Mon Oct 25 2004 10:39:52a A.... 450,048 439.50 K
mshtml.dll Mon Oct 25 2004 10:39:16a A.... 2,693,120 2.57 M
sysfile.dll Wed Dec 29 2004 10:35:14a A.... 378 0.37 K
booknew.dll Tue Dec 28 2004 1:52:22p A.... 327,680 320.00 K
pop5.dll Tue Dec 28 2004 1:52:22p A.... 53,760 52.50 K
wxhtcpip.dll Tue Jan 18 2005 4:35:04p A.... 222,550 217.33 K
eieeis.dll Tue Jan 18 2005 5:56:06p A.... 24,576 24.00 K
clccli.dll Tue Jan 18 2005 5:56:08p A.... 5,632 5.50 K
iwrop.dll Wed Jan 19 2005 9:28:46a A.... 222,578 217.36 K
exact.dll Wed Dec 22 2004 3:45:02p A.... 380,928 372.00 K
akcore.dll Tue Jan 4 2005 8:57:36a A.... 188,416 184.00 K
akupd.dll Tue Jan 4 2005 8:57:34a A.... 155,648 152.00 K
akrules.dll Tue Jan 4 2005 8:57:38a A.... 110,592 108.00 K
aklsp.dll Tue Jan 4 2005 8:57:38a A.... 196,608 192.00 K
tv2.dll Wed Dec 29 2004 10:35:18a A.... 393,216 384.00 K
casync.dll Mon Jan 10 2005 12:47:50p A.... 114,688 112.00 K
sporder.dll Tue Jan 4 2005 8:57:38a A.... 8,464 8.27 K
cacore.dll Tue Jan 18 2005 9:43:00a A.... 151,552 148.00 K
carules.dll Tue Jan 4 2005 9:57:34a A.... 45,056 44.00 K
h44m0e~1.dll Wed Jan 19 2005 8:49:52a ..S.R 222,694 217.47 K
hypertrm.dll Tue Nov 16 2004 5:47:02a A.... 576,784 563.27 K
ciodm.dll Thu Nov 4 2004 11:41:52p A.... 68,880 67.27 K
user32.dll Wed Dec 29 2004 4:14:10a A.... 380,688 371.77 K
sp3res.dll Thu Dec 2 2004 9:27:18a A.... 6,272,512 5.98 M
fp6003~1.dll Wed Jan 19 2005 9:17:56a ..S.R 222,641 217.42 K
l06ola~1.dll Tue Jan 18 2005 3:42:14p ..S.R 223,910 218.66 K

31 items found: 31 files (4 H/S), 0 directories.
Total of file sizes: 15,936,051 bytes 15.20 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F

Directory of C:\WINNT\System32

01/19/2005 09:17a 222,641 fp6003jme.dll
01/19/2005 09:17a 222,578 ogbc32gt.dll
01/19/2005 08:49a 222,694 h44m0eh1eh4.dll
01/18/2005 03:42p 223,910 l06olaj31do.dll
08/16/2001 12:04a <DIR> dllcache
4 File(s) 891,823 bytes
1 Dir(s) 33,534,803,968 bytes free

------------------------------------------------------------------------
qoologic:

C:\Documents and Settings\adudley\My Documents\qoologic

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINNT\SYSTEM32\eieeis.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\hlhhlx.exe: updates.qoologic.com
C:\WINNT\SYSTEM32\clccli.dll: updates.qoologic.com
C:\WINNT\SYSTEM32\pwppwg.dat: .aspack
C:\WINNT\SYSTEM32\wvwwvq.exe: .aspack

Files Found in all users startup Folder............
------------------------
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe: .aspack
Files Found in all users windows Folder............
------------------------
Finished

Lonny Jones · 2005/01/19

Hello

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. close it for now.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
=====================
Now restart into safe mode

find and delete (ONLY THESE EXACT) files and folder's
C:\WINNT\SYSTEM32\eieeis.dll
C:\WINNT\SYSTEM32\hlhhlx.exe
C:\WINNT\SYSTEM32\clccli.dll
C:\WINNT\SYSTEM32\pwppwg.dat
C:\WINNT\SYSTEM32\wvwwvq.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe
C:\WINNT\system32\wsxsvc
C:\WINNT\system32\vmss
C:\Program Files\se
C:\winnt\system32\kalvtcr32.exe
Delete C:\winnt\system32\kalv???32.exe <these file's
(where ??? indicates random characters).
Delete C:\winnt\EliteToolBar
C:\winnt\bundles is there delete it.
C:\winnt\SYSTEM32\DRIVERS\etc\hosts < its the file with no extension
Delete the entire contents of all Temp folders.

Restart the PC back to a normal windows session post a new hijackthis log and the log.txt thats in the l2mfix folder

omytoo · 2005/01/19

ok...i deleted everything in safe mode EXCEPT, the system wouldn't let me delete wvwwvq.exe...it said it was in use. i don't know how to get around that.

hjt log:

Logfile of HijackThis v1.99.0
Scan saved at 11:49:34 AM, on 1/19/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\system32\SxgTkBar.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\wvwwvq.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\WINNT\System32\svchost.exe
C:\Documents and Settings\adudley\My Documents\highjack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.search-exe.com/nph-search.cgi?tcode=exebar1&look=sbar1_srchbtn
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.search-exe.com/nph-search.cgi?tcode=exebar1&look=sbar1_srchbtn
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R3 - URLSearchHook: WebSearch Class - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program Files\se\v11\se.DLL (file missing)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINNT\EliteSideBar\EliteSideBar 08.dll (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [sethook] cmd /c start /min cmd /c c:\dell\src_path.cmd
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Dvx] C:\WINNT\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINNT\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvtcr32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: printkey.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: Win6l5oahder - Intel - (no file)

--------------------------------------------------------------
L2mfix log.txt:

L2Mfix 1.01

Running From:
C:\DOCUME~1\adudley\Desktop\l2mfix\l2mfix

Vbruntimes Found!

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C access for really "Everyone "
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting up for Reboot

Starting Reboot!

C:\Documents and Settings\adudley\Desktop\l2mfix\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\adudley\Desktop\l2mfix\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.PeacockATbeyondlogic.org
Killing PID 1272 'explorer.exe'
Killing PID 1272 'explorer.exe'
Error 0x5 : Access is denied.

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.PeacockATbeyondlogic.org
Killing PID 1312 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Desktop.ini sucessfully removed

Zipping up files for submission:
adding: cecho.reg (deflated 2%)
adding: echo.reg (deflated 12%)
adding: desktop.ini (deflated 13%)
adding: readme.txt (deflated 48%)
adding: direct.txt (deflated 7%)
adding: report.txt (deflated 67%)
adding: lo2.txt (deflated 71%)
adding: test.txt (stored 0%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for really "Everyone "

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous "=dword:00000000
"DllName "=" "
"Impersonate "=dword:00000000
"Logon "= "WinLogon "
"Logoff "= "WinLogoff "
"Shutdown "= "WinShutdown "

The following are the files found:
****************************************************************************

Registry Entries to be Deleted:
Please verify that the listing looks ok. It shouldn't be longer than 13 lines
If approved by helper double click the cleanup.reg in the l2mfix folder.
****************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{8E58AA6A-E4E3-4A36-B1B6-7EC6F3522918} "=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{8E58AA6A-E4E3-4A36-B1B6-7EC6F3522918}</IDone>
<IDtwo>AD</IDtwo>
<VERSION>200</VERSION>
****************************************************************************
Classid's found from regsearch:
****************************************************************************

I don't want to jinx myself...but as of this note, I've been connected to the internet for a good five minutes and haven't had ONE pop-up! (normally would have had countless by now...it was nearly non-stop)

Edited to replace @ with AT in email address

Lonny Jones · 2005/01/19

Hello

I recommend you copy the list to notepad, use cut to take it out of the notepad document and then paste it into killbox, that way you won't miss any. You must get them all or the infection will reinstate itself.

Close all Browsers and programs that show in the windows taskbar
Double-click on KillBox.exe.
Click "Delete on Reboot "
Copy/Paste this file into the top "Full Path of File to Delete" box.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hkhhkf.exe

Click the "Delete File" button which looks like a stop sign.
Click "Yes" at the Replace on Reboot prompt.
Click "No" at the Pending Operations prompt.
Repeat steps 5-9 above for each of these files.
C:\WINNT\SYSTEM32\eieeis.dll
C:\WINNT\SYSTEM32\hlhhlx.exe
C:\WINNT\SYSTEM32\clccli.dll
C:\WINNT\SYSTEM32\pwppwg.dat
C:\WINNT\SYSTEM32\wvwwvq.exe

Use standard file kill option for these others
C:\WINNT\SYSTEM32\carules.dll
C:\WINNT\SYSTEM32\akcore.dll
C:\WINNT\SYSTEM32\akupd.dll
C:\WINNT\SYSTEM32\akrules.dll
C:\WINNT\SYSTEM32\akrules.dll
C:\WINNT\SYSTEM32\iwrop.dll
C:\WINNT\SYSTEM32\wxhtcpip.dll
C:\WINNT\SYSTEM32\clccli.dll
C:\WINNT\SYSTEM32\ogbc32gt.dll
C:\WINNT\SYSTEM32\dusrslvr.dll
C:\WINNT\SYSTEM32\mwrtedit.dll
C:\WINNT\SYSTEM32\dcmrtp.dll
If you recieve a file not deleted message use delete on reboot.
=======
Exit Killbox

We need to rebuild the keys under notify
Download/save the attached file to the desktop change the name to fixmereg.reg run it and answer yes to the prompt to merge.
Start Hijackthis and place a check next to these items,
Close all browser windows and shut down all other programs that show in the taskbar. (even Folders)

All the unwanted R1's and R0's and any with aboutblank

R3 - URLSearchHook: WebSearch Class - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program Files\se\v11\se.DLL (file missing)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINNT\EliteSideBar\EliteSideBar 08.dll (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar.dll (file missing)
======================
Hit fix checked and close Hijackthis.

Restart your PC

Replace your Hosts file with this one
Blocking Unwanted Parasites with a Hosts File: http://www.mvps.org/winhelp2002/hosts.htm
How did that go ?

make and post a new hiajckthis log. run l2mfix.bat and choose option 1
post that log please

omytoo · 2005/01/19

Whew! Ok...

Everything seemed to go smoothly.

hjt log:

Logfile of HijackThis v1.99.0
Scan saved at 3:12:31 PM, on 1/19/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\system32\SxgTkBar.exe
C:\Program Files\NavNT\vptray.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\printkey.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Documents and Settings\adudley\My Documents\highjack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [sethook] cmd /c start /min cmd /c c:\dell\src_path.cmd
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: printkey.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: Win6l5oahder - Intel - (no file)

---------------------------------------------------------------------

L2mfix log:

L2MFIX find log 1.01
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff "= "ChainWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff "= "CryptnetWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName "= "cscdll.dll "
"Logon "= "WinlogonLogonEvent "
"Logoff "= "WinlogonLogoffEvent "
"ScreenSaver "= "WinlogonScreenSaverEvent "
"Startup "= "WinlogonStartupEvent "
"Shutdown "= "WinlogonShutdownEvent "
"StartShell "= "WinlogonStartShellEvent "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName "= "C:\\WINNT\\System32\\NavLogon.dll "
"Logoff "= "NavLogoffEvent "
"StartShell "= "NavStartShellEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
"Asynchronous "=dword:00000000
"DllName "= "C:\\WINNT\\system32\\guard.tmp "
"Impersonate "=dword:00000000
"Logon "= "WinLogon "
"Logoff "= "WinLogoff "
"Shutdown "= "WinShutdown "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff "= "WLEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001
"DllName "=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName "= "WlNotify.dll "
"Lock "= "SensLockEvent "
"Logon "= "SensLogonEvent "
"Logoff "= "SensLogoffEvent "
"Safe "=dword:00000001
"MaxWait "=dword:00000258
"StartScreenSaver "= "SensStartScreenSaverEvent "
"StopScreenSaver "= "SensStopScreenSaverEvent "
"Startup "= "SensStartupEvent "
"Shutdown "= "SensShutdownEvent "
"StartShell "= "SensStartShellEvent "
"Unlock "= "SensUnlockEvent "
"Impersonate "=dword:00000001
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName "= "wzcdlg.dll "
"Logon "= "WZCEventLogon "
"Logoff "= "WZCEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000000

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{D0B67800-F8DA-487A-A164-73015B9F0528} "=" "

**********************************************************************************
Files Found are not all bad files:

C:\WINNT\SYSTEM32\
shdocvw.dll Thu Nov 11 2004 11:20:56p A.... 1,332,224 1.27 M
nrtapi32.dll Wed Jan 19 2005 10:35:28a A.... 222,578 217.36 K
urlmon.dll Mon Oct 25 2004 10:39:52a A.... 450,048 439.50 K
mshtml.dll Mon Oct 25 2004 10:39:16a A.... 2,693,120 2.57 M
sysfile.dll Wed Dec 29 2004 10:35:14a A.... 378 0.37 K
booknew.dll Tue Dec 28 2004 1:52:22p A.... 327,680 320.00 K
pop5.dll Tue Dec 28 2004 1:52:22p A.... 53,760 52.50 K
exact.dll Wed Dec 22 2004 3:45:02p A.... 380,928 372.00 K
aklsp.dll Tue Jan 4 2005 8:57:38a A.... 196,608 192.00 K
tv2.dll Wed Dec 29 2004 10:35:18a A.... 393,216 384.00 K
casync.dll Mon Jan 10 2005 12:47:50p A.... 114,688 112.00 K
sporder.dll Tue Jan 4 2005 8:57:38a A.... 8,464 8.27 K
cacore.dll Tue Jan 18 2005 9:43:00a A.... 151,552 148.00 K
h44m0e~1.dll Wed Jan 19 2005 8:49:52a ..S.R 222,694 217.47 K
hypertrm.dll Tue Nov 16 2004 5:47:02a A.... 576,784 563.27 K
ciodm.dll Thu Nov 4 2004 11:41:52p A.... 68,880 67.27 K
user32.dll Wed Dec 29 2004 4:14:10a A.... 380,688 371.77 K
sp3res.dll Thu Dec 2 2004 9:27:18a A.... 6,272,512 5.98 M
fp6003~1.dll Wed Jan 19 2005 9:17:56a ..S.R 222,641 217.42 K
j60slg~1.dll Wed Jan 19 2005 10:28:14a ..S.R 222,578 217.36 K
lv8009~1.dll Wed Jan 19 2005 10:27:14a ..S.R 222,667 217.45 K
ij1xdnt5.dll Wed Jan 19 2005 10:51:42a A.... 222,578 217.36 K
l06ola~1.dll Tue Jan 18 2005 3:42:14p ..S.R 223,910 218.66 K

23 items found: 23 files (5 H/S), 0 directories.
Total of file sizes: 14,961,176 bytes 14.27 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F

Directory of C:\WINNT\System32

01/19/2005 10:28a 222,578 j60slgd7160.dll
01/19/2005 10:27a 222,667 lv8009lme.dll
01/19/2005 09:17a 222,641 fp6003jme.dll
01/19/2005 08:49a 222,694 h44m0eh1eh4.dll
01/18/2005 03:42p 223,910 l06olaj31do.dll
08/16/2001 12:04a <DIR> dllcache
5 File(s) 1,114,490 bytes
1 Dir(s) 33,516,978,176 bytes free

Lonny Jones · 2005/01/20

Hello

Looks better but its still there.

Since there is a delay in our postingings, I need you to run l2mfix.bat and choose option 1 again please. try to stick around the forums as much as possible and take action once i post back.

Also: Download Silent runners.Vbs post the log it creates please
http://www.silentrunners.org/
Your antivirus script protection might interfear, please allow it to run after a bit box will say done.
Wait untill there is a finished message !!, Then open and post the log next to it.

omytoo · 2005/01/20

Silent runner log:

"Silent Runners.vbs ", revision 29, launched at: 10:07
Output limited to non-default values, except where indicated by "{++} "
Operating System: Windows 2000

Startup items buried in registry:
---------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Synchronization Manager" = "mobsync.exe /logon" [MS]
"sethook" = "cmd /c start /min cmd /c c:\dell\src_path.cmd" [MS]
"POINTER" = "point32.exe" [MS]
"TCASUTIEXE" = "TCAUDIAG -off" [empty string]
"MULTIMEDIA KEYBOARD" = "C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe" [ "Netropa Corp."]
"SxgTkBar" = "SxgTkBar.exe" [ "YAMAHA COROPRATION"]
"vptray" = "C:\Program Files\NavNT\vptray.exe" [ "Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension "
-> CLSID InProcServer32 resolves to: "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext "
-> CLSID InProcServer32 resolves to: "C:\WINNT\System32\hticons.dll" [ "Hilgraeve, Inc."]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions "
-> CLSID InProcServer32 resolves to: "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" [ "Symantec Corporation"]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind "
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\MICROS~3\Office\1033\UNBIND.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler "
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL" [MS]
"{3a726f80-eed4-11d0-aca7-0060972d0294}" = "Ceridian Shell Extensions "
-> CLSID InProcServer32 resolves to: "flxshx32.dll" [ "FLX Corporation"]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip "
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip "
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip "
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" [ "WinZip Computing, Inc."]
"{eb9ebda0-b3e7-11cf-81c9-0000c0aa665f}" = "FTP Explorer Shell Extension "
-> CLSID InProcServer32 resolves to: "ftpxext.dll" [ "FTPx Corp."]
"{57FEA343-6CC9-455E-BE39-725A6A4EB3D4}" = (no title provided)
-> CLSID InProcServer32 resolves to: "C:\WINNT\system32\NWMSMGR.DLL" [file not found]
"{BA4FFB78-A05B-4F4A-BCA9-58B743096BFF}" = (no title provided)
-> CLSID InProcServer32 resolves to: "C:\WINNT\system32\guard.tmp" [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! "NavLogon\DLLName" = "C:\WINNT\System32\NavLogon.dll" [null data]
INFECTION WARNING! "policies\DLLName" = "C:\WINNT\system32\guard.tmp" [file not found]

Startup items in "adudley" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]
"printkey.exe" [file not found]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

3Com DMI Agent, 3ComDMIService, "C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE" [ "3Com Corporation"]
ActionAgent, ActionAgent, "C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe" [ "Dell Computer Corporation"]
DameWare Mini Remote Control, DWMRCS, "C:\WINNT\SYSTEM32\DWRCS.EXE -service" [ "DameWare Development"]
DefWatch, DefWatch, "C:\Program Files\NavNT\defwatch.exe" [ "Symantec Corporation"]
DellDmi, DellDmi, "C:\DMI\WIN32\bin\DellDmi.exe" [ "Dell Computer Corporation"]
DEventAgent, DEventAgent, "C:\Program Files\Dell\OpenManage\Client\EventAgt.exe" [ "Dell Computer Corporation"]
DLT, DLT, "C:\Program Files\Dell\OpenManage\Client\DLT.exe" [ "Dell Computer Corporation"]
Iap, Iap, "C:\Program Files\Dell\OpenManage\Client\Iap.exe" [ "Dell Computer Corporation"]
Netropa NHK Server, nhksrv, "C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe" [null data]
Norton AntiVirus Client, Norton AntiVirus Server, "C:\Program Files\NavNT\rtvscan.exe" [ "Symantec Corporation"]
Win32Sl, Win32Sl, "C:\dmi\win32\bin\Win32sl.exe" [ "Intel"]

----------
This report excludes default entries except where indicated.
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
----------
----------------------------------------------------------------------
L2mfix log:

L2MFIX find log 1.01
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff "= "ChainWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous "=dword:00000000
"Impersonate "=dword:00000000
"DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff "= "CryptnetWlxLogoffEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName "= "cscdll.dll "
"Logon "= "WinlogonLogonEvent "
"Logoff "= "WinlogonLogoffEvent "
"ScreenSaver "= "WinlogonScreenSaverEvent "
"Startup "= "WinlogonStartupEvent "
"Shutdown "= "WinlogonShutdownEvent "
"StartShell "= "WinlogonStartShellEvent "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName "= "C:\\WINNT\\System32\\NavLogon.dll "
"Logoff "= "NavLogoffEvent "
"StartShell "= "NavStartShellEvent "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
"Asynchronous "=dword:00000000
"DllName "= "C:\\WINNT\\system32\\guard.tmp "
"Impersonate "=dword:00000000
"Logon "= "WinLogon "
"Logoff "= "WinLogoff "
"Shutdown "= "WinShutdown "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff "= "WLEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000001
"DllName "=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName "= "WlNotify.dll "
"Lock "= "SensLockEvent "
"Logon "= "SensLogonEvent "
"Logoff "= "SensLogoffEvent "
"Safe "=dword:00000001
"MaxWait "=dword:00000258
"StartScreenSaver "= "SensStartScreenSaverEvent "
"StopScreenSaver "= "SensStopScreenSaverEvent "
"Startup "= "SensStartupEvent "
"Shutdown "= "SensShutdownEvent "
"StartShell "= "SensStartShellEvent "
"Unlock "= "SensUnlockEvent "
"Impersonate "=dword:00000001
"Asynchronous "=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName "= "wzcdlg.dll "
"Logon "= "WZCEventLogon "
"Logoff "= "WZCEventLogoff "
"Impersonate "=dword:00000000
"Asynchronous "=dword:00000000

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{D0B67800-F8DA-487A-A164-73015B9F0528} "=" "

**********************************************************************************
Files Found are not all bad files:

C:\WINNT\SYSTEM32\
shdocvw.dll Thu Nov 11 2004 11:20:56p A.... 1,332,224 1.27 M
nrtapi32.dll Wed Jan 19 2005 10:35:28a A.... 222,578 217.36 K
urlmon.dll Mon Oct 25 2004 10:39:52a A.... 450,048 439.50 K
mshtml.dll Mon Oct 25 2004 10:39:16a A.... 2,693,120 2.57 M
sysfile.dll Wed Dec 29 2004 10:35:14a A.... 378 0.37 K
booknew.dll Tue Dec 28 2004 1:52:22p A.... 327,680 320.00 K
pop5.dll Tue Dec 28 2004 1:52:22p A.... 53,760 52.50 K
exact.dll Wed Dec 22 2004 3:45:02p A.... 380,928 372.00 K
aklsp.dll Tue Jan 4 2005 8:57:38a A.... 196,608 192.00 K
tv2.dll Wed Dec 29 2004 10:35:18a A.... 393,216 384.00 K
casync.dll Mon Jan 10 2005 12:47:50p A.... 114,688 112.00 K
sporder.dll Tue Jan 4 2005 8:57:38a A.... 8,464 8.27 K
cacore.dll Tue Jan 18 2005 9:43:00a A.... 151,552 148.00 K
h44m0e~1.dll Wed Jan 19 2005 8:49:52a ..S.R 222,694 217.47 K
hypertrm.dll Tue Nov 16 2004 5:47:02a A.... 576,784 563.27 K
ciodm.dll Thu Nov 4 2004 11:41:52p A.... 68,880 67.27 K
user32.dll Wed Dec 29 2004 4:14:10a A.... 380,688 371.77 K
sp3res.dll Thu Dec 2 2004 9:27:18a A.... 6,272,512 5.98 M
fp6003~1.dll Wed Jan 19 2005 9:17:56a ..S.R 222,641 217.42 K
j60slg~1.dll Wed Jan 19 2005 10:28:14a ..S.R 222,578 217.36 K
lv8009~1.dll Wed Jan 19 2005 10:27:14a ..S.R 222,667 217.45 K
ij1xdnt5.dll Wed Jan 19 2005 10:51:42a A.... 222,578 217.36 K
l06ola~1.dll Tue Jan 18 2005 3:42:14p ..S.R 223,910 218.66 K

23 items found: 23 files (5 H/S), 0 directories.
Total of file sizes: 14,961,176 bytes 14.27 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C is WINDOWS 2K
Volume Serial Number is 07D1-080F

Directory of C:\WINNT\System32

01/19/2005 10:28a 222,578 j60slgd7160.dll
01/19/2005 10:27a 222,667 lv8009lme.dll
01/19/2005 09:17a 222,641 fp6003jme.dll
01/19/2005 08:49a 222,694 h44m0eh1eh4.dll
01/18/2005 03:42p 223,910 l06olaj31do.dll
08/16/2001 12:04a <DIR> dllcache
5 File(s) 1,114,490 bytes
1 Dir(s) 33,471,397,888 bytes free
--------------------------------------------------------------------
Just so you know, I haven't had ONE pop-up since yesterday afternoon. I'm SO happy!!! Definitely willing to do the rest of the work, though...I'll check in VERY often.

Log in or Sign up

DMVlite...geez...HJT log included

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Share This Page

Log in or Sign up

DMVlite...geez...HJT log included

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Lonny Jones Inactive Alumni

omytoo Inactive Thread Starter

Share This Page

Useful Searches