Virus, or just screwed up?

[Dave_Lethal]

Try those directions to remove MIcrosoft Java and installing Java SUN. A corrupted Java could be causing explorer/outlook to crash.

[Grizzlybear]

OK. The Sun Java VM is installed.

No change.

Still get About:Blank at every startup. IE & Outlook Express still shut themselves down.

What do we try next?

[Dave_Lethal]

Hrmm, what a frustrating problem

I'm stumped.

[Gecko]

Please download
Run KillBox and paste the below into the text box:
C:\WINNT\SYSTEM32\archlib.dll
Now put a check next to 'Delete on reboot' click on the red X, click yes to delete file on reboot
Click yes to reboot now.

After the reboot download, install, update and run
Make sure it is set to do a full system scan.

[Grizzlybear]

:whine:

Well, MS AntiSpyware looked promising... It found a lot of stuff & removed (Log at end of post).

But...

While to took alittle longer this time, IE still just sat there connecting and then shut down. Same with Outlook Ex.

I set MS AntiSpy to actively monitor, and after a restart, it gave me a message about the home page changing back to About:Blank. I blocked it, but whatever is doing it is still there and still active.

A second AntiSpy scan after restart came up clean. I also ran a FULL virus scan last night. Current DAT file, highest settings, scan ALL files. It found nothing.

I'm afraid that we're running out of ideas here, and I may have to go with my 'Last Resort' option. I have 2 puters networked. Mine (the one with the prob, puter 1) is good, newer, has massive storage and is the host. The other (puter 2 Compaq Presario 5140) is old, used by my fiancee & daughter, is the client and only has 26.55GB between 2 HDs. Puter 2 has XP installed by itself on 1 HD, and all the other stuff on the other HD.

My 'Last Resort' is to move the stuff in puter 2 into puter 1, then go buy a 160GB HD (not that I really have the $ for this) and put it into puter 2. Then start transfering everything too important to take any chances with into puter 2's new big HD. Then, format C on puter 1, and do a clean re-install of XP, and then start the really fun job of putting things back and trying to get everything up and running again.

I don't know that I'd have to copy everything from puter 1 into puter 2, but it seems safer, and I do have alot of stuff that I don't to take ANY chances of loosing.

So, do we still have any more ideas, or are we down to the 'Last Resort'?

Please remember guys, even tho nothing has worked so far, I still appreciate all the efforts you guys have put into helping me with this.

Here's the AntiSpy log:

Spyware Scan Details
Start Date: 8/13/2005 9:55:55 AM
End Date: 8/13/2005 10:13:43 AM
Total Time: 17 mins 48 secs

Detected Threats

WinTools Trojan more information...
Details: WinTools’ purpose is currently unknown. WinTools installs an Internet Explorer browser helper object, a URL search hook, and downloads several files in Common files\WinTools\. WinTools runs at startup
Status: Removed
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected files detected
c:\documents and settings\grizzlybear\local settings\Temp\~232638.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~585964.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~793569.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~838755.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~844167.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~859016.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~860878.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~316552.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~342832.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~375780.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~401961.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~498363.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~502461.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~510846.tmp
c:\documents and settings\grizzlybear\local settings\Temp\~559533.tmp


Trojan:Win32/Agent.CY Trojan more information...
Status: Removed
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected files detected
c:\winnt\wmplayer.exe


CapScrn ActiveX Control Key Logger more information...
Details: The CapScrn ActiveX Control enables you to capture the desktop as a bitmap file.
Status: Removed
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected files detected
c:\winnt\system32\capscrn.ocx


Xupiter Browser Modifier more information...
Details: Xupiter consists of an Internet Explorer toolbar containing link buttons to one of Xupiters search engines, and downloads updates to the software.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\program files\sqwire\m.dat
c:\program files\sqwire\197067548\m.dat
c:\program files\sqwire\197067548\menu.xml
c:\program files\sqwire\p.dat
c:\program files\sqwire\time.txt
c:\program files\sqwire\1348759\m.dat
c:\program files\sqwire\1348759\menu.xml
c:\program files\sqwire\197009945\m.dat
c:\program files\sqwire\197009945\menu.xml
c:\program files\sqwire\197010055\m.dat
c:\program files\sqwire\197010055\menu.xml

Infected folders detected
c:\program files\sqwire
c:\program files\sqwire\1348759
c:\program files\sqwire\197009945
c:\program files\sqwire\197010055
c:\program files\sqwire\197067548


IncrediFind Adware more information...
Details: IncrediFind is an Internet Explorer browser helper object (BHO) that changes your Internet Explorer error page to its own page and displays pop-up advertising.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\winnt\system32\drivers\etc\hosts.bho
c:\program files\incredifind\bho\date.txt

Infected folders detected
c:\program files\incredifind
c:\program files\incredifind\bho


ClearSearch Browser Modifier more information...
Details: ClearSearch is an adware component that periodically contacts a specific search site for advertisement-tracking purposes.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected folders detected
c:\program files\clearsearch

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContextSidebar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContextSidebar DisplayName Context Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContextSidebar UninstallString C:\Program Files\ClearSearch\FNuninstaller.EXE -f4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RonSidebar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RonSidebar DisplayName RON Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RonSidebar UninstallString C:\Program Files\ClearSearch\FNuninstaller.EXE -f7


IBIS Toolbar Adware more information...
Details: IBIS Toolbar is an Internet Explorer search redirector.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected registry keys/values detected
HKEY_CLASSES_ROOT\clsid\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}
HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}
HKEY_CLASSES_ROOT\clsid\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}
HKEY_CLASSES_ROOT\clsid\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\clsid\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\clsid\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}\Implemented Categories
HKEY_CLASSES_ROOT\clsid\{8B0FA130-0C3D-4CB1-AEB7-2C29DA5509A3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}\Implemented Categories
HKEY_CLASSES_ROOT\clsid\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}\Implemented Categories
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}
HKEY_CLASSES_ROOT\clsid\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\clsid\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}\Implemented Categories
HKEY_CLASSES_ROOT\clsid\{6E21F428-5617-47F7-AED8-B2E1D8FBA711}
HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}
HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\CLSID\{708BE496-E202-497B-BC31-9CF47E3BF8D6}\Implemented Categories


BrowserAid Browser Plug-in more information...
Details: BrowserAid is a group of Internet Explorer toolbars that are installed without your consent.
Status: Removed
Elevated threat - Elevated-risk items have some potential for harm. Users should review such programs and remove them if unwanted.

Infected files detected
c:\winnt\mwsvm.dat


KaZaA Under Investigation more information...
Details: KaAaA is peer-to-peer file-sharing software that displays advertising and installs third-party adware on your computer.
Status: Removed
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected registry keys/values detected
HKEY_CURRENT_USER\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b0 97
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b1 99
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b0seconds 1750
HKEY_LOCAL_MACHINE\software\kazaa\CDN ExactMatches 3
HKEY_LOCAL_MACHINE\software\kazaa\CDN KeywordMatches 3
HKEY_LOCAL_MACHINE\software\kazaa\CDN NormalMatches 20
HKEY_LOCAL_MACHINE\software\kazaa\CDN LastAttempt 1036555219
HKEY_LOCAL_MACHINE\software\kazaa\CDN LastDownload 1036146452
HKEY_LOCAL_MACHINE\software\kazaa\ConnectionInfo
HKEY_LOCAL_MACHINE\software\kazaa\ConnectionInfo +
HKEY_CURRENT_USER\software\kazaa\ResultsFilter adult_filter_level 1
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent +
HKEY_LOCAL_MACHINE\software\kazaa Tmp 0
HKEY_LOCAL_MACHINE\software\kazaa my_ip_address 68.46.138.158
HKEY_LOCAL_MACHINE\software\kazaa UDP_probe_successes -1
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa UDP_receive_status 526380370
HKEY_LOCAL_MACHINE\software\kazaa FirewallStatus 1048576
HKEY_CURRENT_USER\software\kazaa\Settings Date 4-15-2003
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b0 14442
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b1 53543
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b0seconds 1362
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\LastEstimate b 74379
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\LastEstimate time 1036607822


NewDotNet Browser Plug-in more information...
Details: New.Net is an Internet Explorer plug-in that adds extra top-level domains (such as .shop or .tech) to your name resolution system.
Status: Removed
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
c:\program files\newdotnet\readme.txt

Infected folders detected
c:\program files\newdotnet


Detected Spyware Cookies
No spyware cookies were found during this scan.



Bill

[Dave_Lethal]

Did you try the Killbox program that Gecko suggested as well?

[Grizzlybear]

Yep.

[Gecko]

I have a couple of other things that you could try.
One is going through your c:\windows\system32\ directory.
View “List” and then sort by date, look for a *.dll, *.dat, *.tmp file that is dated today or yesterday.
You might have to look in the subdirectories also
It will most likely have a random name, next google the file name and check the results.
If you find it is some type of spyware or trojan then you can remove it.
If it comes up with no results then you can try and copy the file to a new directory
if it will let you and then delete the original.
You might have to use Killbox to delete on reboot to kill the file.

You could also try using Firefox so you can do an online virus scan like
It might find the little bug you have acquired.

[Grizzlybear]

:cheer:


Hi Guys,

As you can figure by all the happy little smileys, THE PUTER IS FIXED!!!!

With the MS AntiSpyware constantly blocking my homepage being changed to About:Blank, I knew it had to be a virus. Just on a hunch, I did a google search for "About:Blank virus". The first page I went to, had what I needed.



I downloaded Adware Away, and in about 10 minutes, I was back up and running.

I'll say this, that &^^$&^#$ virus is one insidious bastard! Adware Away found about 20 .dll files added to McAfee in the past few days. Near as I can tell, the damned virus blocked McAfee from detecting it!

Four straight days I've been dealing with this virus. Right about now, I'd like nothing better than to take a hammer to every joint of every finger of both hands of anyone who writes viruses. Do these ppl really get off on screwing over ppl they don't even know?

Ok, ranting over.

I want to say Thank You to both you guys for all the effort & help over the past few days. :yes: It's really been appreciated!

Take Care guys!

Bill

[Dave_Lethal]

Yes! I know just how you feel..being stuck with a crappy problem for days and days at a time, and finally finding a solution...it's better than sex.

Way to go