Show Posts

Tech Clinic / HJT Log for about:blank related problem

« on: May 16, 2005, 09:24:51 AM »

Guestolo, you are a lifesaver. So far, it seems to be running just fine. Homepage has defaulted back to Dell's, and no pop-ups so far!

Here are the logs you requested:

Logfile of HijackThis v1.99.1
Scan saved at 10:22:18 AM, on 5/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office2\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Log from SpSeHjfix112.exe:

(5/16/05 10:14:35 AM) SPSeHjFix started v1.1.2
(5/16/05 10:14:35 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/16/05 10:14:35 AM) Language: english
(5/16/05 10:14:35 AM) Win-Path: C:\WINDOWS
(5/16/05 10:14:35 AM) System-Path: C:\WINDOWS\System32
(5/16/05 10:14:35 AM) Temp-Path: C:\DOCUME~1\TOMHAM~1\LOCALS~1\Temp\
(5/16/05 10:14:41 AM) Disinfection started
(5/16/05 10:14:41 AM) Bad-Dll(IEP): (not found)
(5/16/05 10:14:41 AM) Bad-Dll(IEP) in BHO: (not found)
(5/16/05 10:14:41 AM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\hndd.dll
(5/16/05 10:14:41 AM) Searchassistant Uninstaller - Keys Deleted
(5/16/05 10:14:41 AM) UBF: 8 - UBB: 0 - UBR: 12
(5/16/05 10:14:41 AM) FilterKey: HKCR\text/html (deleted)
(5/16/05 10:14:41 AM) FilterKey: HKCR\CLSID\{12418D99-2CE7-49EB-81A3-966B4C038973} (deleted)
(5/16/05 10:14:41 AM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(5/16/05 10:14:41 AM) UBF: 7 - UBB: 0 - UBR: 12
(5/16/05 10:14:41 AM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
(5/16/05 10:14:41 AM) Stealth-String not found
(5/16/05 10:14:41 AM) File added to delete: c:\windows\system32\hndd.dll
(5/16/05 10:14:41 AM) Reboot

(5/16/05 10:15:28 AM) SPSeHjFix started v1.1.2
(5/16/05 10:15:28 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/16/05 10:15:28 AM) Language: english
(5/16/05 10:15:28 AM) Win-Path: C:\WINDOWS
(5/16/05 10:15:28 AM) System-Path: C:\WINDOWS\System32
(5/16/05 10:15:28 AM) Temp-Path: C:\DOCUME~1\TOMHAM~1\LOCALS~1\Temp\

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:         10:05:40 AM, 5/16/2005
+ Report-Checksum:      64837F0A

+ Date of database:      5/16/2005
+ Version of scan engine:   v3.0

+ Duration:            24 min
+ Scanned Files:         47997
+ Speed:            32.53 Files/Second
+ Infected files:         3
+ Removed files:         3
+ Files put in quarantine:      3
+ Files that could not be opened:   0
+ Files that could not be cleaned:   0

+ Binder:      Yes
+ Crypter:      Yes
+ Archives:      Yes

+ Scanned items:
   C:\

+ Scan result:
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP361\A0014227.exe -> Trojan.Agent.ct -> Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP365\A0014588.dll -> TrojanDownloader.Agent.le -> Cleaned with backup
   C:\WINDOWS\SYSTEM32\hndd.dll -> Spyware.Hijacker.Generic -> Cleaned with backup

::Report End

Please let me know if there's anything else I need to do to be completely rid of this nastiness. Thanks again for all your help!

TheTechGuide Forum

News:

Messages - Hammond

Tech Clinic / HJT Log for about:blank related problem

Tech Clinic / HJT Log for about:blank related problem