Let's go thru the steps
Some may not be necessary, but let's do it anyways
Ensure you have Hoster still in a convenient spot
Also ensure you still have
fix.reg placed on your desktop for easy access
If not you can save it too notepad again>>>on page 2 of our replies
Related too the ZoneMap\Domains registry fix
Print this out so you can use it as a checklist
Also
Please save this too a Notepad file on your desktop >>>
Disconnect from the Internet>>>Disable System Restore, if you can and you haven't done so already
Close down All unnecessary programs running in the background
Keep all other users of the computer logged off
Do another scan with Hijackthis and put a check next to these entries:
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/landingpages/cd....ystempopup=true (obfuscated)
O2 - BHO: (no name) - {4C6760DC-238D-9383-FB09-D1F471E71804} - (no file)
O2 - BHO: (no name) - {502B8893-05D5-1E4B-D4E1-6F514A11CDB7} - (no file)
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
O2 - BHO: (no name) - {79EF8DE9-C305-C8CC-6B87-1ED452FEAE42} - (no file)
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
ALL the 015 entries
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)After you have ticked the above entries, close
All other open windows, including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis
With only your Notepad file open
Open Killbox.exe
Then bring up Taskmanager
Now you have this Notepad file that you saved>>>Killbox>>taskmanager open
End process on
explorer.exe as you did before
May not be necessary at this point but let's not take a chance
Icons and Taskbar disappear
In Task Manager go to FILE>>>NEW TASK (RUN)
Type in
cmd.exe Hit OK
At the command prompt
type this again, remember there are no = signs, see Note below
cd\WINDOWS\Downloaded Program Files (hit Enter)
del=YSBactivex.dll (hit Enter)
del=ysbactivex.inf (hit Enter)
del=loader2.ocx (hit Enter)
del=OSDEB.OSD (hit Enter)
del=v3.dll (hit Enter)
Rmdir=/s=CONFLICT.1 (hit Enter)
Rmdir=/s=CONFLICT.2 (hit Enter)
Rmdir=/s=CONFLICT.3 (hit Enter)
Rmdir=/s=CONFLICT.4 (hit Enter)
Rmdir=/s=CONFLICT.5 (hit Enter)
Rmdir=/s=CONFLICT.6 (hit Enter)
Rmdir=/s=CONFLICT.7 (hit Enter)
Rmdir=/s=CONFLICT.8 (hit Enter)
Rmdir=/s=CONFLICT.9 (hit Enter)
Rmdir=/s=CONFLICT.10 (hit Enter)
Rmdir=/s=CONFLICT.11 (hit Enter)
Rmdir=/s=CONFLICT.12 (hit Enter)
Rmdir=/s=CONFLICT.13 (hit Enter)
Rmdir=/s=CONFLICT.14 (hit Enter)
Rmdir=/s=CONFLICT.15 (hit Enter)
Rmdir=/s=CONFLICT.16 (hit Enter)
Rmdir=/s=CONFLICT.17 (hit Enter)
NOTE* = signs should be replaced by a space
After you have entered all those close the command promp
Now you have just the Notepad file open and Killbox
In Killbox
Copy and paste each of the following lines into the
"Full Path of File to Delete" Click the RED X button that looks like the Stop sign
Keep track of any files that won't delete
You'll need those later
C:\WINDOWS\NDNuninstall6_22.exe
C:\WINDOWS\SSK_B5.EXE
C:\WINDOWS\woinstall.exe
C:\WINDOWS\System32\304390.exe
C:\WINDOWS\System32\311375.exe
C:\WINDOWS\System32\cp.exe
C:\WINDOWS\System32\dfe.exe
C:\WINDOWS\System32\eree.exe
C:\WINDOWS\System32\fgrr.exe
C:\WINDOWS\System32\htt.exe
C:\WINDOWS\System32\iwdwin.dll
C:\WINDOWS\System32\KVIF_7.dll
C:\WINDOWS\System32\mac80ex.idf
C:\WINDOWS\System32\mqexdlm.srg
C:\WINDOWS\System32\netut80ex.vxd
C:\WINDOWS\System32\SHAgentNew.dll
C:\WINDOWS\System32\WinSuck.dll
C:\WINDOWS\System32\Xcite2.exe
C:\DOCUME~1\jordan\LOCALS~1\TEMPOR~1\Content.IE5\014D63SJ\ysb_prompt[1].php
C:\DOCUME~1\jordan\LOCALS~1\TEMPOR~1\Content.IE5\89SF0L8N\js[1].htm
C:\DOCUME~1\jordan\LOCALS~1\TEMPOR~1\Content.IE5\89SF0L8N\js[2].htm
C:\DOCUME~1\jordan\LOCALS~1\TEMPOR~1\Content.IE5\89SF0L8N\ysb_prompt[1].php
C:\Documents and Settings\jordan\eree.exe
C:\Documents and Settings\jordan\ewhtt.exe
C:\Program Files\AIM\aim95.exe
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
C:\Program Files\MyWay\myBar\1.bin\MY2NS.EXE
C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
C:\Program Files\TopConverting\arkanoid\arkanoid.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.10\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.8\v3.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.9\v3.dll
C:\WINDOWS\Downloaded Program Files\v3.dll
C:\WINDOWS\System32\ntqm.exe
C:\WINDOWS\System32\d3wq.exe
C:\WINDOWS\System32\msjy32.exe
C:\WINDOWS\System32\netxh32.exe
C:\WINDOWS\System32\ipxm32.exe
C:\WINDOWS\System32\kwxle.txt
C:\WINDOWS\System32\sdklk.exe
C:\WINDOWS\System32\d3wq.exe
C:\WINDOWS\System32\d3ea.exe
C:\WINDOWS\isrvs\ffisearch.exeCopy and paste each of the following lines into the
"Full Path of File to Delete" box in Killbox.
Put a mark next to
Replace on RebootAlso mark
Use DummyClick the red button with the X after each. It will ask you if you want to reboot each time you click it, answer
"No"C:\WINDOWS\System32\brew.dll
C:\WINDOWS\BTGrab.dll
C:\WINDOWS\System32\dOnim.dll
C:\WINDOWS\System32\l06olaj31do.dll
C:\WINDOWS\System32\LMWND13n.DLL
C:\WINDOWS\System32\o884lilq18qe.dll
C:\WINDOWS\System32\s8pu0i79e8.dll
C:\WINDOWS\System32\tarmmgr.dll
C:\WINDOWS\System32\Xcite.dll
C:\WINDOWS\Downloaded Program Files\YSBactivex.dll
C:\WINDOWS\inst\3p1.exeAt this point copy and paste any file that wouldn't delete earlier with just the
Delete file button and use the
"Replace on Reboot"
"Use Dummy"
options
On the last path to file to delete is entered
Answer
YESAnd allow the system to Reboot
or use the option in the Taskmanager under Shutdown>>Restart
Please reboot into safe mode at this time
Look for these 2 files in the C:\Windows\System32 folder
02/01/2005 09:45 AM 413,696
r?gsvr32.exe <--this file
02/01/2005 09:42 AM 413,696
m?iexec.exe <--this file
They may contain the ? mark in them, if you see them delete them
Careful as they like too disguise as legitimate file
You can see if you right click on them and left click properties
There file size is about 413 kb and created on the date above
Find and delete these folders if they exist
C:\WINDOWS\
isrvs <--this folder
C:\Program Files\
AWS <--folder
C:\Program Files\
MyWay <--folder
C:\Program Files\
TopConverting <--folder
Take a look for any of those files killed with killbox manually and ensure they don't exist
Some of the files should of been removed by RubberDucky's About:Buster
If you still have it
Can you please run About:Buster again in safe mode
Let it scan twice>>Save the log afterwards
Open HOSTER and RESTORE ORIGNAL HOSTS
Double click on
fix.reg and allow it to merge to the registry
Well your in safe mode can you open your Registry editor
just be careful and do just what I ask
Go to START>>RUN>>Type in
regeditHit OK
Navigate to this entry
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
ModuleUsage]
Left click to Highlight ModuleUsage
Right click on it and Choose EXPORT
Name it and save it to MyDocuments folder
Exit the Registry
Temp files should of been deleted, but because you have Windows CleanUp! can you run it also in safe mode just to be safe
Restart back to Normal mode
Enable System Restore
At this time let's try another scan with the newer L2mfix>>>Can you redownload it please, don't use your old copy>>Here's the instructions again
Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
[color=\"red\"]IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so![/color]
Hopefully one last time
Can you run another scan with Mwav scan from eSecan
and post another log
Also post back another Hijackthis log
Also include the About:Buster logs if you have them
Could you also go to the MyDocuments folder, find that entry you exported from the Registry
RIGHT CLICK on it and select EDIT
Copy and paste back here the contents, thanks
