dab2403's HJT logfile sent via E-Mail

[Cactus]

Logfile of HijackThis v1.98.2
Scan saved at 9:07:36 PM, on 9/15/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\explorer.exe
C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\David\LOCALS~1\Temp\svchost124.exe
C:\Program Files\WebSiteViewer\124289.dlr
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC07.EXE
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\David\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.worldnet.att.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hwzbldnmiwfpgsufwmlgrsub.net ... 4DfCI.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
O1 - Hosts: 172.30.71.2 paul
O1 - Hosts: 172.30.71.5 terminal
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll
O2 - BHO: (no name) - {8279FE96-0F30-B3B4-7886-E77A44967027} - C:\PROGRA~1\GLUENE~1\VGA LOG.exe (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {D9BA0B30-92EE-B7EC-2EBF-FC9C8043E8EB} - C:\PROGRA~1\GLUENE~1\Sign bold.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [explorer] C:\WINDOWS\System32\explorer.exe
O4 - HKLM\..\Run: [Creative 1] C:\PROGRA~1\CDROMD~1\Style Keep.exe
O4 - HKLM\..\Run: [Build sixth admin face] C:\Documents and Settings\All Users\Application Data\Wma comp build sixth\htmgrey.exe
O4 - HKLM\..\Run: [Dale File Bows Keep] C:\Documents and Settings\All Users\Application Data\byte pop dale file\Wait Drv.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe -a
O4 - HKCU\..\Run: [WTST] C:\WINDOWS\System32\wapisvtr.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Mobile User VPN.lnk = C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200 ... taller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/06f446227c535a0d7a ... RdxIE6.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} - http://www.imagestation.com/common/clas ... ,3,2,20802
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v15 ... ontrol.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://vspan.webex.com/client/latest/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C61FE30-D27B-4F04-A023-54F97E6EB784}: NameServer = 199.96.34.34,199.96.34.33
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 172.30.71.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 172.30.71.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 172.30.71.2


Posted by Cactus for dab2403


Cactus

[Cactus]

Ok let's start with this...


I noticed you Downloaded HJT to a TEMP folder,always download to a folder OTHER than Temp/Temorary Internet Folders.

EG---- Open MyDocuments----Right click an empty spot and select NEW---Folder----Name the new folder HJT ---this is where you will want to save Hijackthis too, also, backups will be stored there.
Copy and Paste hijackthis to that new folder and delete the one in the originally downloaded.

**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

Now...
Set Windows to show Hidden files and folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

wapisvtr.exe
svchost124.exe
Scheduler.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hwzbldnmiwfpgsufwmlgrsub.net ... 4DfCI.html
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll
O2 - BHO: (no name) - {8279FE96-0F30-B3B4-7886-E77A44967027} - C:\PROGRA~1\GLUENE~1\VGA LOG.exe (file missing)
O2 - BHO: (no name) - {D9BA0B30-92EE-B7EC-2EBF-FC9C8043E8EB} - C:\PROGRA~1\GLUENE~1\Sign bold.exe
O4 - HKLM\..\Run: [explorer] C:\WINDOWS\System32\explorer.exe
O4 - HKLM\..\Run: [Build sixth admin face] C:\Documents and Settings\All Users\Application Data\Wma comp build sixth\htmgrey.exe
O4 - HKLM\..\Run: [Dale File Bows Keep] C:\Documents and Settings\All Users\Application Data\byte pop dale file\Wait Drv.exe
O4 - HKCU\..\Run: [WTST] C:\WINDOWS\System32\wapisvtr.exe
O4 - Startup: PowerReg Scheduler.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/06f446227c535a0d7a ... RdxIE6.cab
O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} - http://www.imagestation.com/common/clas ... ,3,2,20802

The next are optional, but recommended for removal,Resource hogs and not needed on startup, but does not disable the program:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

WebSite Viewer
WTST
PowerReg

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\DOCUME~1\David\LOCALS~1\Temp\svchost124.exe
C:\Program Files\WebSiteViewer\124289.dlr
C:\WINDOWS\questmod.dll
C:\Documents and Settings\All Users\Application Data\Wma comp build sixth\htmgrey.exe
C:\Documents and Settings\All Users\Application Data\byte pop dale file\Wait Drv.exe
C:\WINDOWS\System32\wapisvtr.exe


Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and Reboot.

Turn on System restore,before opening your browser goto TOOLS>INTERNET OPTIONS and make sure your Homepage is correct,if not ,type the URL you would like in the HomePage box.

Now re-run HJT and post a new logfile back here.

Cactus

[Cactus]

dab2403 is unable to connect to the Forum..this is being done through Email at my request.
dabs latest logfile:

Cactus,

Here is the 2nd log file from HJT after completing most of what you spelled out.

Here are some issues I encountered.

Could not find some of the Folders/Files you wanted me to delete. I couldn’t find svchost124.exe, questmod.dll, wapisvtr.exe.
I found but was not able to delete Websiteviewer/124289.dlr (This sucker is the culprit)
I found but was not able to delete Wait Drv.exe
I don’t know how to boot to safe mode. Can you explain how?

I was able to “Fix” all the files thru HJT except the first one on the list which I couldn’t find.

When you talked about the temp files, did you mean that I should empty all four temp files, I am really only certain of how to empty the temp internet file folder which I did. Can you tell about the others I should empty.

I’ll see you back in the forum tomorrow

Thanks again.

THE LOG:

Logfile of HijackThis v1.98.2
Scan saved at 11:38:01 PM, on 9/15/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\devldr32.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\David\My Documents\Dab Documents\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.worldnet.att.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.aptnupwamasredrdpwlo.info/MS ... 04DfCI.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
O1 - Hosts: 172.30.71.2 paul
O1 - Hosts: 172.30.71.5 terminal
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Creative 1] C:\PROGRA~1\CDROMD~1\Style Keep.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe -a
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Mobile User VPN.lnk = C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200 ... taller.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v15 ... ontrol.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://vspan.webex.com/client/latest/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C61FE30-D27B-4F04-A023-54F97E6EB784}: NameServer = 199.96.34.34,199.96.34.33
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 172.30.71.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 172.30.71.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 172.30.71.2

------------------------------------------------------------------------------------

How to Boot to SAFE MODE ( Quoted from Geekgirl in )

Windows XP includes the System Configuration Utility. If you can start the computer normally and get into Windows, this is the easiest--and the recommended way--to restart the computer in Safe mode.

To use the System Configuration Utility method
Close all open programs.
Click Start, and then click Run. The Run dialog box appears.
Type msconfig and then click OK.
The System Configuration Utility appears.
Check the "/SAFEBOOT" option, and then click OK.

You then see the prompt to restart the computer. Click Restart

The computer restarts in Safe mode. (This can take several minutes.)
Perform the troubleshooting steps for which you are using Safe Mode.
When you are finished with troubleshooting in Safe mode repeat steps 1-5, but in step 4, uncheck "/SAFEBOOT"
Close all programs and restart the computer as you normally would.

To use the F8 method
Use this method only if Windows XP is the only operating system installed on your computer.
Start Windows, or if it is running, shut Windows down, and then turn off the computer.
Restart the computer. The computer begins processing a set of instructions known as the Basic Input/Output System (BIOS). What is displayed depends on the BIOS manufacturer. Some computers display a progress bar that refers to the word BIOS, while others may not display any indication that this process is happening.
As soon as the BIOS has finished loading, begin tapping the F8 key on your keyboard. Continue to do so until the Windows Advanced Options menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Using the arrow keys on the keyboard, scroll to and select the Safe mode menu item, and then press Enter.

Make sure that Windows is set to show HIDDEN Files and Folders,here's how again...

Set Windows to show Hidden files and folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.


**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

wscntfy.exe


Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:



R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.aptnupwamasredrdpwlo.info/MS ... 04DfCI.htm

O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe -a
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200 ... taller.exe
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v15 ... ontrol.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://vspan.webex.com/client/latest/webex/ieatgpc.cab


Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

wscntfy

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\system32\wscntfy.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and Reboot.

Turn on System restore,before opening your browser goto TOOLS>INTERNET OPTIONS and make sure your Homepage is correct,if not ,type the URL you would like in the HomePage box.

Now re-run HJT and post a new logfile back here.



OK...where are the temp folders? ( Quoted from Geekgirl in this


In Xp, here are some locations of Temp files (thx brad)

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Username\Local Settings\Temporary Internet Files
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files

To locate the current \Temp folder and display its contents

Exit all programs,
Double-click the My Computer icon on the Windows desktop.
Click anywhere in the Address bar to select it.
Type the following and then press Enter:

%temp%

The \Temp folder for the currently logged-on user is displayed.
Note the location of the \TEMP folder

Take note of the contents of the \TEMP folder. Do one of the following:

Delete any files and subfolders within this folder. In most cases, this is the recommended action. Files and folders that were placed there by Windows or Windows-based programs were not meant to be permanent and can be safely deleted.
You can also move the files to a different location if you are not sure that the files or folders were placed there by Windows or Windows-based programs.


You can also
Select Start > Run.
Launch the MS-DOS prompt:
If your using Windows NT 4.0, Windows 2000 or Windows XP, type cmd.
If your using Windows 95, 98 or ME, type command.com.
Click OK.
In the Command Prompt window, type set.
Press Enter.
Write down the location for TEMP.
Go to the location and delete the files inside the folder.


You can also launch IE, click Tools>Internet Options, from there you can delete your On and Offline Temp files, Cookies and History.

Often you will be instructed to "Set Windows to show Hidden files and folders"

Hope this gets you on-line...

Cactus

[dab2403]

Thank you again to Cactus and Geekgirl for your help on this.

I want to clarify what the various problems are that I have been having to make sure that our current course will correct them.

1. Problem 1. Get rid of the WebsiteViewer\124289.dlr infection. Every time I delete these files, shortcuts, etc. they come back eventually after re-starting the computer. This acitvates shortcuts that pop up on my screen.. I noticed this was running in the Processes last night when I was following your instructions on which processes to End Process. I did not End Process as you gave no instructions to do so - but should I?

2. Problem 2 is inability to log in the forum.

3. Problem 3. Get rid of whatever is infecting IE with additional shortcuts that pop up on the screen, puts toolbars in the IE browser, and resets the homepage.

I trust that the path we are following will eradicate all of these, but I just wanted to make clear what problems we are attempting to correct in case my earlier posts were confusing.

I will follow your instructions on the safeboot and other instructions later this evening. Do you want me to send another HJT scan after completeing these instructions?

Thanks again

[Cactus]

Yes please.....


Cactus

[Cactus]

[brad]

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fnnigehijbnyvwuzzc.com/MSGhv ... 04DfCI.htm
O1 - Hosts: 172.30.71.2 paul
O1 - Hosts: 172.30.71.5 terminal
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 172.30.71.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 172.30.71.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 172.30.71.2

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

Now post a fresh HJT Log File before you do anything else.

brad

[dab2403]

I've done as you have instructed in your last post and posted the latest HJT scan below.
At this point, all the prior remedies seem to have corrected the major complaints with respect to the .dlr file issue. As it relates to login on this site, I was able to fix that by resetting the privacy settings in IE. They were set very high after I downloaded SP 2.
This was also affecting my ability to login to a number of sites, all of which were corrected by resetting the privacy settings.

I will watch for any further suggestions you may have on my HJT log, but otherwise I'm satisfied that the problems have been corrected. Thanks again to all of you who have helped with suggestions. I will be a fan of this site forever!!



Logfile of HijackThis v1.98.2
Scan saved at 8:42:31 PM, on 9/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe
c:\progra~1\intern~1\iexplore.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\AIM95\aim.exe
C:\Documents and Settings\David\My Documents\Dab Documents\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.worldnet.att.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.tdhqluzzsuxpaq.uk/MSGhvmyJPN ... 4DfCI.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
O1 - Hosts: 172.30.71.2 paul
O1 - Hosts: 172.30.71.5 terminal
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Creative 1] C:\PROGRA~1\CDROMD~1\Style Keep.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\2.0.3.16\InstallStub.exe -a
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Mobile User VPN.lnk = C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C61FE30-D27B-4F04-A023-54F97E6EB784}: NameServer = 199.96.34.34,199.96.34.33