PCTech Forums

Posted: **Tue Jul 27, 2004 8:00 am**

This one was... just about clean.. until spyware blaster pointed out to me.. that active x controls were all set to enable..

got it all cleaned up .. again.. i think i got all of the files related to atdtf.exe out..

here is the HJT log

Logfile of HijackThis v1.98.0
Scan saved at 2:48:51 AM, on 7/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\TEKS2G~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Teks2Go Utilities\ZoneAlarm\zonealarm.exe
C:\TEKS2G~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Teks2Go Utilities\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: lies knob - {0515072D-9C1A-7B83-BDE8-3DAB4D1951C1} - C:\PROGRA~1\CDROMS~1\vc coal.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {18FA7C4E-46CC-468B-96B4-0B1CE8A28F2F} - C:\WINDOWS\System32\gamp.dll
O2 - BHO: (no name) - {4FFE655A-9535-6FC6-8724-64550CD0263B} - C:\WINDOWS\System32\zqpfwyf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\TEKS2G~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 4 Link Bolt - {9AE45157-EE58-266C-8B0E-1F110052AAA2} - C:\PROGRA~1\CDROMS~1\vc coal.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone system] C:\WINDOWS\szchost.exe
O4 - HKLM\..\Run: [AVG_CC] C:\TEKS2G~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Teks2Go Utilities\ZoneAlarm\zonealarm.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\nosuch.mht!http://2awm.com/pop/chm1/westxx.chm::/on-line.exe
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3A5ABA8-F87F-48B5-BBD3-72351949C828}: NameServer = 192.168.2.2
O18 - Filter: text/html - {17B0383D-DAC2-474A-99AC-BD22E9DF75AF} - C:\WINDOWS\System32\gamp.dll
O18 - Filter: text/plain - {17B0383D-DAC2-474A-99AC-BD22E9DF75AF} - C:\WINDOWS\System32\gamp.dll

thx..

Posted: **Tue Jul 27, 2004 8:31 am**

Hi CanadianTek,try this out

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

on-line.exe
szchost.exe
Q330995.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: lies knob - {0515072D-9C1A-7B83-BDE8-3DAB4D1951C1} - C:\PROGRA~1\CDROMS~1\vc coal.dll
O2 - BHO: (no name) - {18FA7C4E-46CC-468B-96B4-0B1CE8A28F2F} - C:\WINDOWS\System32\gamp.dll
O2 - BHO: (no name) - {4FFE655A-9535-6FC6-8724-64550CD0263B} - C:\WINDOWS\System32\zqpfwyf.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O3 - Toolbar: 4 Link Bolt - {9AE45157-EE58-266C-8B0E-1F110052AAA2} - C:\PROGRA~1\CDROMS~1\vc coal.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Zone system] C:\WINDOWS\szchost.exe
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\nosuch.mht!http://2awm.com/pop/chm1/westxx.chm::/on-line.exe
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O18 - Filter: text/html - {17B0383D-DAC2-474A-99AC-BD22E9DF75AF} - C:\WINDOWS\System32\gamp.dll
O18 - Filter: text/plain - {17B0383D-DAC2-474A-99AC-BD22E9DF75AF} - C:\WINDOWS\System32\gamp.dll

Go to Control Panel / Add/Remove Programs and remove the following if they are there:

Blazefind

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\systb.dll
C:\PROGRA~1\CDROMS~1\vc coal.dll
C:\WINDOWS\System32\gamp.dll
C:\WINDOWS\System32\zqpfwyf.dll
C:\WINDOWS\2_0_1browserhelper2.dll

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

Posted: **Wed Jul 28, 2004 12:59 pm**

Thanx Lil Jim..

Here is what happened... followed your instructions to a "T"

re-ran SPYBOT s+d 1.3

says all was clear..

rebooted.. ran Kephyr's Bazooka.. says all was clear

Hooked back up to the internet... browsed a half dozen sites, (CLEAN ones like google, cnn, microsoft)

re- ran Spybot.. BOOM 105 new spies..

varied from vx2, to cwsearch, dyfica.... etc..

cleaned them all out.. cleared all the temp and temporary internet files (all 4 as they had admin/chris/default/all users/owner accounts)

emptied the recycling bin

then i thought i would be smart

ran HJT...

Found a couple entries.. that I KNOW I DELETED THE FIRST TIME

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

...had come back.. yet.. fle sp.html DID NOT EXIST ANYWHERE ON THE HD DRIVE... not hidden not in recycle.. nowhere..

so i thought i would just delete them the second time.. without BOTHERING YOU..

burp

on reboot.. default web page came back as http:///

when i changed it to www.google.ca apply.. home..

PAGE COULD NOT BE DISPLAYED...

sooooooooooo

i ran spybot.. just the standard 5 dso exploits

ran bazooka.. says it was clean.. but still no net..

(however.. the router.. was acting flakey... (gnet ip0006 model :O )

wasnt gonna take to many more chances..

backstepped to previous spybot restore point

after reboot..

ran spybot.. only 48 hits.. all cleaned... rebooted flakey router...

GOT OUT TO GOOOGLE as home page.. no problem..

and this is the HJT report

Logfile of HijackThis v1.98.0
Scan saved at 11:35:30 PM, on 7/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\TEKS2G~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Teks2Go Utilities\ZoneAlarm\zonealarm.exe
C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
C:\TEKS2G~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Teks2Go Utilities\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Teks2Go Utilities\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Teks2Go Utilities\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\TEKS2G~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\TEKS2G~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Teks2Go Utilities\ZoneAlarm\zonealarm.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab

so yes.. i see the same 2 (possibly 3? ) offending lines near the top.. but didnt want to chance getting locked out of the net..

...not sure if the http:/// was for me only removing the 2 lines as indicated above and i should have taken out the 3.. or.. if it was the flakey router..

AS WE SPEAK the file sp.html DOES NOT EXIST on the system

any suggestions.. ?

thx

Posted: **Wed Jul 28, 2004 3:22 pm**

Hey CanadianTek...

Set Windows to show hidden files and folders

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

RESTART your Computer in SAFE MODE

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

qttask.exe

While still in safe mode
Do another Scan with Hijackthis and put a check next to these entries and then FIX CHECKED when ALL other windows are closed

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\chris\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime ---Not needed at boot-up

Goto START>SETTINGS>CONTROL PANEL
Reset your homepage.

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

Post a fresh HJT logfile.

Cactus

Posted: **Wed Jul 28, 2004 6:38 pm**

When your done with that...here's something else you should do.

Please download:
Unzip it to your desktop but don't run it yet.

Do not open internet explorer to come back here until after running the tool.

Double click Aboutbuster.exe, click OK, click Start, then click OK. This will scan your computer for the bad files and delete them.

Once the tool is done scanning, copy the log and paste it into your thread.
with a new Hijack this log.

"instructions stolen from brad"
sorry man..

Posted: **Thu Jul 29, 2004 1:00 am**

I'm pleased to see everyone learning...... Use all of my posts, at your will, when trying to help others.
Smart call...
brad

Posted: **Thu Jul 29, 2004 1:29 am**

lol...thanks brad.

Posted: **Thu Jul 29, 2004 11:25 am**

i had placed a check mark in the box to notify my email when any replies were posted - and i didnt get any notice :shock:

will look into these options here and get back to you.. thanx

PCTech Forums

HJT have about:blank and random atdtf dialer.. in xp

HJT have about:blank and random atdtf dialer.. in xp

strangely.. a burp.. one last crack at this..

sorry guyz...