Another New Hijackthis Log File

[RobK]

Sorry, here we go.

Logfile of HijackThis v1.98.0
Scan saved at 14:30:45, on 02/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Home\My Documents\HJT\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm?id=9
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://super-spider.com/sp.htm?id=9
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://super-spider.com/sp.htm?id=9
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://super-spider.com/hp.htm?id=9
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\ng8h2y74tra5.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.greg-search.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247
O17 - HKLM\System\CS1\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247
O20 - AppInit_DLLs: 6058d12nd3.tlb

[brad]

Please download and open:

Run the "!LOG!.bat" file, wait for the final output (log.txt)
and post the results.

brad

[RobK]

Ok Brad, thanks. There's quite a lot of it. Hope you can make sense of it.

Scanning for file(s)...
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» .........
»»Locked or 'Suspect' file(s) found...


»»»»» (*2*) »»»»»........

»»»»» (*3*) »»»»»........

C:\WINDOWS\SYSTEM32\
bridge.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
d2kpax.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
jac.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
msxslab.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
system32.dll Wed 4 Aug 2004 0:07:26 ..SHR 0 0.00 K

5 items found: 5 files (5 H/S), 0 directories.
Total of file sizes: 0 bytes 0.00 K

unknown/hidden files...

C:\WINDOWS\SYSTEM32\
bridge.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
d2kpax.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
jac.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
msxslab.dll Wed 4 Aug 2004 0:07:24 ..SHR 0 0.00 K
system32.dll Wed 4 Aug 2004 0:07:26 ..SHR 0 0.00 K

5 items found: 5 files, 0 directories.
Total of file sizes: 0 bytes 0.00 K

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\BRIDGE.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\D2KPAX.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\JAC.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\MSXSLAB.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\SYSTEM32.DLL
SNiF 1.34 statistics

Matching files : 5 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»»»(*5*)»»»»»

»»»»»(*6*)»»»»»

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...


No matches found.

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»


BHO search...


Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL


»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 478

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ 6058d12nd3.tlb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = 6058d12nd3.tlb
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710

»»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM


»»Member of...: (Admin logon required!)
User is a member of group YOUR-R50EDLRTE1\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.


»»»»»»Backups created...»»»»»»
0:19am up 0 days, 0:15
Wed 04 Aug 04 00:19:22

A C:\FINDnFIX\keyback.hiv
--a-- - - - - - 8,192 08-04-2004 keyback.hiv
A C:\FINDnFIX\keys1\winkey.reg
--a-- - - - - - 301 08-04-2004 winkey.reg
*Temp backups...
.
..
keyback2.hi_
winkey2.re_


C:\FINDNFIX\
JUNKXXX Wed 4 Aug 2004 0:16:04 .D... <Dir>

1 item found: 0 files, 1 directory.

»»Performing string scan....
00001150: vk f AppInit_DLLs G
00001190: 6 0 5 8 d 1 2 n d 3 . t l b meout h vk
000011D0: UDeviceNotSelectedTimeout 1 5 P 9 0
00001210: vk ' zGDIProcessHandleQuota" vk `
00001250: Spooler2 y e s _ h @ vk
00001290: 5swapdisk vk . TransmissionRetr
000012D0:yTimeout h @ vk ' r
00001310:USERProcessHandleQuotaw
00001350:
00001390: q` iD6B e>S H q
000013D0:
00001410:
00001450: X T
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:

---------- WIN.TXT
fùAppInit_DLLsÖ￾æGØÿÿÿ6
--------------
--------------
$01180: AppInit_DLLs
$011D7: UDeviceNotSelectedTimeout
$01227: zGDIProcessHandleQuota
$012C0: TransmissionRetryTimeout
$01310: USERProcessHandleQuotaw
--------------
--------------
6058d12nd3.tlb
--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="6058d12nd3.tlb"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 30 bytes, including the 2 for string termination.

[AppInitDLLs]
Ansi string : "6058d12nd3.tlb"
0000 36 00 30 00 35 00 38 00 64 00 31 00 32 00 6e 00 | 6.0.5.8.d.1.2.n.
0010 64 00 33 00 2e 00 74 00 6c 00 62 00 00 00 | d.3...t.l.b...

-----END------
Wed 04 Aug 04 00:19:24

[brad]

Open the C:\FINDnFIX\Keys1\ Subfolder
DoubleClick on the "FIX.bat" file
You will be prompted by popup Alert to restart in 15 seconds.
Allow it to restart the computer!

On restart, navigate to System32 folder:
Locate and select these files, one at a time:
bridge.dll
d2kpax.dll
jac.dll
msxslab.dll
system32.dll
And use the folder's top Menu / Edit
"Move to folder"...
Select the C:\junkxxx as destination and move bridge.dll
d2kpax.dll
jac.dll
msxslab.dll
system32.dll
to the C:\junkxxx folder

Go back to C:\FINDnFIX\ main folder and
Run the "RESTORE.bat", file , wait for
and post the 'log1.txt' file!

Open the FINDnFIX\Files2< Subfolder:
Run the "ZIPZAP.bat" file.
It will quickly clean the rest and
will make a copy of the bad file(s) in the same
folder (junkxxx.zip) and open your email client with instructions:

When done, restart your computer and
Delete and entire 'FINDnFIX' file+folder(s)
From C:\, and be sure the C:\junkxxx folder
was deleted (as part of the cleanup process)

brad

[RobK]

I don't know what I'm doing but I've done it anyway. Thanks again. Here's the log1.txt file you asked for.

C:\FINDNFIX\JUNKXXX\
bridge.dll Wed 4 Aug 2004 18:01:44 A.SHR 0 0.00 K
d2kpax.dll Wed 4 Aug 2004 18:01:46 A.SHR 0 0.00 K
jac.dll Wed 4 Aug 2004 18:01:44 A.SHR 0 0.00 K
msxslab.dll Wed 4 Aug 2004 18:01:44 A.SHR 0 0.00 K
system32.dll Wed 4 Aug 2004 18:01:46 A.SHR 0 0.00 K

5 items found: 5 files (5 H/S), 0 directories.
Total of file sizes: 0 bytes 0.00 K

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\FINDNFIX\JUNKXXX\BRIDGE.DLL
Sniffed -> C:\FINDNFIX\JUNKXXX\D2KPAX.DLL
Sniffed -> C:\FINDNFIX\JUNKXXX\JAC.DLL
Sniffed -> C:\FINDNFIX\JUNKXXX\MSXSLAB.DLL
Sniffed -> C:\FINDNFIX\JUNKXXX\SYSTEM32.DLL
SNiF 1.34 statistics

Matching files : 5 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.*

fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.*

A--SHR BRIDGE .DLL 00000000 18:01.44 04/08/2004
A--SHR D2KPAX .DLL 00000000 18:01.46 04/08/2004
A--SHR JAC .DLL 00000000 18:01.44 04/08/2004
A--SHR MSXSLAB .DLL 00000000 18:01.44 04/08/2004
A--SHR SYSTEM32.DLL 00000000 18:01.46 04/08/2004

c:\findnfix\junkxxx\bridge.dll
-rahs - - - - - 0 08-04-2004 bridge.dll
c:\findnfix\junkxxx\d2kpax.dll
-rahs - - - - - 0 08-04-2004 d2kpax.dll
c:\findnfix\junkxxx\jac.dll
-rahs - - - - - 0 08-04-2004 jac.dll
c:\findnfix\junkxxx\msxslab.dll
-rahs - - - - - 0 08-04-2004 msxslab.dll
c:\findnfix\junkxxx\system32.dll
-rahs - - - - - 0 08-04-2004 system32.dll
A SHR C:\FINDnFIX\junkxxx\bridge.dll
A SHR C:\FINDnFIX\junkxxx\d2kpax.dll
A SHR C:\FINDnFIX\junkxxx\jac.dll
A SHR C:\FINDnFIX\junkxxx\msxslab.dll
A SHR C:\FINDnFIX\junkxxx\system32.dll

CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock.
MD5 Message Digest Algorithm by RSA Data Security, Inc.

File name Size Date Time MD5 Hash
________________________________________________________________________

CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk

C:\FINDNFIX\JUNKXXX
BRIDGE.DLL : crc16=0005 crc32=FFFFFFFA
D2KPAX.DLL : crc16=0005 crc32=FFFFFFFA
JAC.DLL : crc16=0005 crc32=FFFFFFFA
MSXSLAB.DLL : crc16=0005 crc32=FFFFFFFA
SYSTEM32.DLL: crc16=0005 crc32=FFFFFFFA


File: <C:\FINDnFIX\junkxxx\bridge.dll>

CRC-32 : 00000000

MD5 : D41D8CD9 8F00B204 E9800998 ECF8427E



File: <C:\FINDnFIX\junkxxx\d2kpax.dll>

CRC-32 : 00000000

MD5 : D41D8CD9 8F00B204 E9800998 ECF8427E



File: <C:\FINDnFIX\junkxxx\jac.dll>

CRC-32 : 00000000

MD5 : D41D8CD9 8F00B204 E9800998 ECF8427E



File: <C:\FINDnFIX\junkxxx\msxslab.dll>

CRC-32 : 00000000

MD5 : D41D8CD9 8F00B204 E9800998 ECF8427E



File: <C:\FINDnFIX\junkxxx\system32.dll>

CRC-32 : 00000000

MD5 : D41D8CD9 8F00B204 E9800998 ECF8427E




#######################################################
*Known files are...
--------------------
File: ((56k; (57,344 bytes)
(CRC16 : 3138)
CRC-32 : D5C9FB2E
MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249
--------------------
File: ((35k; (35,840 bytes)
(CRC16 : EEB1)
CRC-32 : 33081C8B
MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE
--------------------
File: ((21k; (21,504 bytes)
(CRC16 : 90A5)
CRC-32 : 2258F59E
MD5 : EFEE2CB3 B342A351 51802356 9637F8E6
#######################################################
»»Permissions:
C:\FINDnFIX\junkxxx\bridge.dll Everyone:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
YOUR-R50EDLRTE1\Home:F
BUILTIN\Users:R

C:\FINDnFIX\junkxxx\d2kpax.dll Everyone:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
YOUR-R50EDLRTE1\Home:F
BUILTIN\Users:R

C:\FINDnFIX\junkxxx\jac.dll Everyone:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
YOUR-R50EDLRTE1\Home:F
BUILTIN\Users:R

C:\FINDnFIX\junkxxx\msxslab.dll Everyone:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
YOUR-R50EDLRTE1\Home:F
BUILTIN\Users:R

C:\FINDnFIX\junkxxx\system32.dll Everyone:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
YOUR-R50EDLRTE1\Home:F
BUILTIN\Users:R

Directory "C:\FINDnFIX\junkxxx\."
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000002 tc-- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000009 --o- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000002 tc-- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000009 --o- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000013 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000013 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 0000001B -co- 10000000 ---A ---- ---- \CREATOR OWNER
Allow 00000013 tco- 001200A9 ---- -S-- r--x BUILTIN\Users
Allow 00000012 tc-- 00000004 ---- ---- --+- BUILTIN\Users
Allow 00000012 tc-- 00000002 ---- ---- -w-- BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

Directory "C:\FINDnFIX\junkxxx\.."
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000000 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 0000000B -co- 10000000 ---A ---- ---- \CREATOR OWNER
Allow 00000003 tco- 001200A9 ---- -S-- r--x BUILTIN\Users
Allow 00000002 tc-- 00000004 ---- ---- --+- BUILTIN\Users
Allow 00000002 tc-- 00000002 ---- ---- -w-- BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

File "C:\FINDnFIX\junkxxx\bridge.dll"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000000 t--- 001F01FF ---- DSPO rw+x \Everyone
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

File "C:\FINDnFIX\junkxxx\d2kpax.dll"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000000 t--- 001F01FF ---- DSPO rw+x \Everyone
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

File "C:\FINDnFIX\junkxxx\jac.dll"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000000 t--- 001F01FF ---- DSPO rw+x \Everyone
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

File "C:\FINDnFIX\junkxxx\msxslab.dll"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000000 t--- 001F01FF ---- DSPO rw+x \Everyone
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

File "C:\FINDnFIX\junkxxx\system32.dll"
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000000 t--- 001F01FF ---- DSPO rw+x \Everyone
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000000 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x YOUR-R50EDLRTE1\Home
Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users

Owner: YOUR-R50EDLRTE1\Home

Primary Group: YOUR-R50EDLRTE1\None

C:\FINDnFIX\junkxxx\bridge.dll;Everyone:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\bridge.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\bridge.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\bridge.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\bridge.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\bridge.dll;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\bridge.dll;YOUR-R50EDLRTE1\Home:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\bridge.dll;BUILTIN\Users:RrRaRepX[I]
C:\FINDnFIX\junkxxx\d2kpax.dll;Everyone:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\d2kpax.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\d2kpax.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\d2kpax.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\d2kpax.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\d2kpax.dll;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\d2kpax.dll;YOUR-R50EDLRTE1\Home:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\d2kpax.dll;BUILTIN\Users:RrRaRepX[I]
C:\FINDnFIX\junkxxx\jac.dll;Everyone:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\jac.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\jac.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\jac.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\jac.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\jac.dll;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\jac.dll;YOUR-R50EDLRTE1\Home:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\jac.dll;BUILTIN\Users:RrRaRepX[I]
C:\FINDnFIX\junkxxx\msxslab.dll;Everyone:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\msxslab.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\msxslab.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\msxslab.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\msxslab.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\msxslab.dll;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\msxslab.dll;YOUR-R50EDLRTE1\Home:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\msxslab.dll;BUILTIN\Users:RrRaRepX[I]
C:\FINDnFIX\junkxxx\system32.dll;Everyone:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\system32.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\system32.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\system32.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO
C:\FINDnFIX\junkxxx\system32.dll;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\system32.dll;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\system32.dll;YOUR-R50EDLRTE1\Home:RrRaRepWwAWaWePXDDcO[I]
C:\FINDnFIX\junkxxx\system32.dll;BUILTIN\Users:RrRaRepX[I]



»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450

»»Dumping Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs =

»»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM



00001150: vk UDeviceNotSelecte
00001190:dTimeout 1 5 P h vk ' zGDIProce
000011D0:ssHandleQuota" 9 0 vk Spooler2
00001210: y e s _ vk 5swapdisk h
00001250: X vk . TransmissionRetryTimeout vk
00001290: ' r USERProcessHandleQuotaw h X
000012D0: vk AppInit_DLLs A
00001310: w
00001350:h/ `? w 4/ w w
00001390: 4 6 < w w TI w & ( !o(o w
000013D0: ? w !o " C : \ F I N D n
00001410:F I X \
00001450:
00001490:
000014D0:
00001510:
00001550:

---------- NEWWIN.TXT
AppInit_DLLsÈA§
--------------
--------------
$0117F: UDeviceNotSelectedTimeout
$011C7: zGDIProcessHandleQuota
$01270: TransmissionRetryTimeout
$012A0: USERProcessHandleQuotaw
$012F0: AppInit_DLLs
--------------
--------------
C:\FINDnFIX\
ShimCacheMutex
ShimSharedMemory
C:\WINDOWS\System32;C:\WINDOWS\system;C:\WINDOWS;

d.... 0 Aug 4 0:16 .
d.... 0 Aug 4 0:16 ..
.shra 0 Aug 4 18:01 bridge.dll
.shra 0 Aug 4 18:01 d2kpax.dll
.shra 0 Aug 4 18:01 jac.dll
.shra 0 Aug 4 18:01 msxslab.dll
.shra 0 Aug 4 18:01 system32.dll

7 files found occupying -3584 bytes


===============================================================================
0 bytes 0 cps
Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01

VDIR v1.00
Path: C:\FINDNFIX\JUNKXXX\*.*
---------------------------------------+---------------------------------------
. <dir> 08-04-:4 00:16|JAC DLL 0 AHSR 08-04-:4 18:01
.. <dir> 08-04-:4 00:16|MSXSLAB DLL 0 AHSR 08-04-:4 18:01
BRIDGE DLL 0 AHSR 08-04-:4 18:01|SYSTEM32 DLL 0 AHSR 08-04-:4 18:01
D2KPAX DLL 0 AHSR 08-04-:4 18:01|
---------------------------------------+---------------------------------------
7 files totaling 0 bytes consuming 0 bytes of disk space.
17299968 bytes available on Drive C: No volume label

...File dump...

junkxxx\*.*
The system cannot find the file specified.
0 file(s) copied.

Detecting...

C:\FINDnFIX\junkxxx
bridge.dll ACL has 8 ACE(s)
SID = /Everyone S-1-1-0
ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
ACE 3 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 4 is an ACCESS_ALLOWED_ACE_TYPE
ACE 4 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = NT AUTHORITY/SYSTEM S-1-5-18
ACE 5 is an ACCESS_ALLOWED_ACE_TYPE
ACE 5 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = YOUR-R50EDLRTE1/Home S-1-5-21--2080537990--786673420--1793012761-1005
ACE 6 is an ACCESS_ALLOWED_ACE_TYPE
ACE 6 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Users S-1-5-32-545
ACE 7 is an ACCESS_ALLOWED_ACE_TYPE
ACE 7 mask = 0x001200a9 -R -X
ACL done...


d2kpax.dll ACL has 8 ACE(s)
SID = /Everyone S-1-1-0
ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
ACE 3 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 4 is an ACCESS_ALLOWED_ACE_TYPE
ACE 4 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = NT AUTHORITY/SYSTEM S-1-5-18
ACE 5 is an ACCESS_ALLOWED_ACE_TYPE
ACE 5 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = YOUR-R50EDLRTE1/Home S-1-5-21--2080537990--786673420--1793012761-1005
ACE 6 is an ACCESS_ALLOWED_ACE_TYPE
ACE 6 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Users S-1-5-32-545
ACE 7 is an ACCESS_ALLOWED_ACE_TYPE
ACE 7 mask = 0x001200a9 -R -X
ACL done...


jac.dll ACL has 8 ACE(s)
SID = /Everyone S-1-1-0
ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
ACE 3 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 4 is an ACCESS_ALLOWED_ACE_TYPE
ACE 4 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = NT AUTHORITY/SYSTEM S-1-5-18
ACE 5 is an ACCESS_ALLOWED_ACE_TYPE
ACE 5 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = YOUR-R50EDLRTE1/Home S-1-5-21--2080537990--786673420--1793012761-1005
ACE 6 is an ACCESS_ALLOWED_ACE_TYPE
ACE 6 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Users S-1-5-32-545
ACE 7 is an ACCESS_ALLOWED_ACE_TYPE
ACE 7 mask = 0x001200a9 -R -X
ACL done...


msxslab.dll ACL has 8 ACE(s)
SID = /Everyone S-1-1-0
ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
ACE 3 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 4 is an ACCESS_ALLOWED_ACE_TYPE
ACE 4 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = NT AUTHORITY/SYSTEM S-1-5-18
ACE 5 is an ACCESS_ALLOWED_ACE_TYPE
ACE 5 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = YOUR-R50EDLRTE1/Home S-1-5-21--2080537990--786673420--1793012761-1005
ACE 6 is an ACCESS_ALLOWED_ACE_TYPE
ACE 6 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Users S-1-5-32-545
ACE 7 is an ACCESS_ALLOWED_ACE_TYPE
ACE 7 mask = 0x001200a9 -R -X
ACL done...


system32.dll ACL has 8 ACE(s)
SID = /Everyone S-1-1-0
ACE 0 is an ACCESS_ALLOWED_ACE_TYPE
ACE 0 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 1 is an ACCESS_ALLOWED_ACE_TYPE
ACE 1 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 2 is an ACCESS_ALLOWED_ACE_TYPE
ACE 2 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 3 is an ACCESS_ALLOWED_ACE_TYPE
ACE 3 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Administrators S-1-5-32-544
ACE 4 is an ACCESS_ALLOWED_ACE_TYPE
ACE 4 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = NT AUTHORITY/SYSTEM S-1-5-18
ACE 5 is an ACCESS_ALLOWED_ACE_TYPE
ACE 5 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = YOUR-R50EDLRTE1/Home S-1-5-21--2080537990--786673420--1793012761-1005
ACE 6 is an ACCESS_ALLOWED_ACE_TYPE
ACE 6 mask = 0x001f01ff -R -W -X -D -DEL_CHILD -CHANGE_PERMS -TAKE_OWN
SID = BUILTIN/Users S-1-5-32-545
ACE 7 is an ACCESS_ALLOWED_ACE_TYPE
ACE 7 mask = 0x001200a9 -R -X
ACL done...


Finished Detecting... Wed 04 Aug 04 18:41:08
-----END-----


[brad]

Great!
Now did you:
Delete and entire 'FINDnFIX' file+folder(s)
From C:\, and be sure the C:\junkxxx folder
was deleted (as part of the cleanup process)?

Please post a fresh HJT Log File.

brad

[RobK]

Yep, FINDnFIX is completely deleted and C:\junkxxx went with the cleanup. Here is the new HJT log file. Just to note, the problem is still persisting but the address to which I am being directed has changed.
Thanks for the continuing assistance

Logfile of HijackThis v1.98.0
Scan saved at 19:45:34, on 04/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Home\My Documents\HJT\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm?id=9
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowws.cc/hp.htm?id=9
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\ng8h2y74tra5.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.greg-search.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247
O17 - HKLM\System\CS1\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247

[brad]

Are you following all the instructions to the letter?

Boot into "Safe Mode" and run HJT again. Follow the following instructions:

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

matrixhere.exe
winlogin.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/sp.htm?id=9
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowws.cc/hp.htm?id=9
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\ng8h2y74tra5.dll
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll ]
O4 - Global Startup: winlogin.exe
O15 - Trusted Zone: *.greg-search.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247
O17 - HKLM\System\CS1\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" and rename them, in order to delete some Files/Folders)

C:\WINDOWS\System32\matrixhere.exe
C:\WINDOWS\System32\ng8h2y74tra5.dll
C:\Documents and Settings\Username\Start Menu\Programs\Startup\winlogin.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad

[RobK]

Yep, following all the instructions. Had some trouble with the last few though. Firstly, you asked to to ctrl/alt/del and end process on winlogin.exe. It is not there, however, winlogon.exe is present. Should I delete this?
Secondly, HJT could not fix O4 - Global Startup: winlogin.exe, stating that it was in operation. Also, the following two files/folders were not present.

C:\WINDOWS\System32\ng8h2y74tra5.dll
C:\Documents and Settings\Username\Start Menu\Programs\Startup\winlogin.exe

Here is the most recent HJT Log file

Logfile of HijackThis v1.98.0
Scan saved at 23:04:36, on 04/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\Home\My Documents\HJT\hijackthis.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: winlogin.exe
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247
O17 - HKLM\System\CS1\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247

[RobK]

Thought that I should also mention that the following two processes were not present, and therefore could not be fixed, when HJT was run in safe mode.

O17 - HKLM\System\CCS\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247
O17 - HKLM\System\CS1\Services\Tcpip\..\{3125BE77-660E-4527-8887-22ECFBA5DC9F}: NameServer = 207.44.140.102 64.191.22.247

Thanks

[brad]

Did you try to Delete Winlogin?
brad

[RobK]

Winlogin was not there. Only Winlogon. I don't know if they are the same thing or are different.
Anyway, the problem seems to have been solved. Can't find any trace of it. Thanks very much to everyone for their help.