Hijacked ?

OK, I don't know what happened out of the blue, but I keep reprogramming my MSIE home site as www.msn.com, and even just a minute later, after I close and reopen MSIE, my assigned home page goes back to http://uni--search.com/.

Who are these jerks and how do I destroy the "connection" that keeps hijacking my assigned home site ?

I have scrubbed everything with SpyBot S&D but that didn't change a thing .... I also have ZoneAlarm and AVG antivirus running.


Royally ticked off in VA,
- Dave

Hi, please download and update Adaware then run a scan.


Download Hijackthis from <<HERE>> download the self-extracting version.

Run a scan then copy and paste your log in this thread.

Thank you, P3-450 .... Hijack This found and fixed 3 items containing the name of the offending site. I had Hijack This "fix" them, and now MSIE keeps the home site I assign. Great little prog there ....

- Dave in VA

Great

If you want you can paste your Hijackthis log here and I could take a look at if for you, just incase there is anything else there that needs removing.

Uh-oh ..... I spoke too soon. The offending site I mentioned IS appearing again when I fire up MSIE. Going to try Hijack This again, and also Ad Aware .... sigh

P.S. As an afterthought, I reassigned my usual home site to MSIE and then *rebooted*, but that didn't help either ... it's still going back to that &%@$#%$@ site

- Dave:mad:

Please post your Hijackthis log.

UPDATE:

Installed and ran AdAware, didn't see offending site listed on Critical List, but still deleted many .... STILL no change, STILL getting that stupid &@^#%$^@ site ...

- Dave

Hi all,

Sorry ... in my extreme frustration, I forgot to post the AdAware log file ..... here it is, attached ....

By the way, I have instructed both Spybot S&D *and* AdAware to delete the items containing the name of the offending site, and somehow they manage to reappear again !! GRRRRRRRRR ....

- Dave

Logfile of HijackThis v1.99.0
Scan saved at 5:45:38 PM, on 1/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\Explorer.EXE
C:\WINDOWS2\Logi_MwX.Exe
C:\WINDOWS2\System32\WService.EXE
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\WINDOWS2\System32\devldr32.exe
C:\WINDOWS2\System32\ctfmon.exe
D:\Program Files\Logitech\iTouch\kbdtray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS2\system32\ZoneLabs\vsmon.exe
C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://uni--search.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS2\System32\IETie.dll
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS2\System32\msdxm.ocx
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WService] WService.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
O4 - HKLM\..\Run: [EM_EXEC] D:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll
O9 - Extra button: (no name) - {578FC4E3-151E-456c-AF8E-B63061EFE228}} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/mini...ansporter.cab?
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k00719/sb02a.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104543957578
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.47/ttinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C83C5C97-CD0D-4C5D-B1F8-EBB7E44F6FD4}: NameServer = 192.168.2.1,38.9.212.2
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS2\system32\ZoneLabs\vsmon.exe
O23 - Service: WinTab Service - Tablet Driver - C:\WINDOWS2\System32\DRIVERS\WtSrv.exe

stargazer777. We ask that hijackthis logs not be attached to posts :). http://discussions.virtualdr.com/sho...hreadid=179233
I have taken the liberty of posting it correctly for you :).

OK, I screwed up .... when I edited the last message, I didn't realize I would "lose" the attachment. Here is an "instant replay", with attachment included ....
------------------------------------------------------
Hi all,

Sorry ... in my extreme frustration, I forgot to post the AdAware log file ..... here it is, attached ....

By the way, I have instructed both Spybot S&D *and* AdAware to delete the items containing the name of the offending site, and somehow they manage to reappear again !! GRRRRRRRRR ....

- Dave

Sorry, Crunchie ..... two screwups in 5 minutes, must be a record ... :( Anyway, my heart was in the right place, just not my brain .... sigh

Well, it IS 3:20 AM .... heh .....

- Dave

Cool :). It's 4.20 PM here. BTW. I deleted the original attachment after I pasted your log in :D.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://uni--search.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/min...ransporter.cab?

Reboot and post another log. If you are still awake :D.

Crunchie (and all) -

I followed your instructions in your previous post. Then I did another virus scan, and came up with the items in the screen shot (attached to this post). Right clicking and asking for details brought up info which indicated that this item (the first of the three) DOES INDEED change the MSIE home page.

HOWEVER, I cannot figure out how to get rid of this garbage. AVG AntiVirus does not seem to offer a "fix" option, and does NOT seem to indicate that it fixed or quarantined anything. Any ideas ?


- Dave

Try this.

Clear out your Temporary internet files and other temp files.
Go to Start > Settings > Control Panel >Internet Options.
Under the General tab click the Delete temporary internet files,
delete all Offline content as well. Clear out Cookies.

Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

C:\Documents and Settings\username\Local Settings\Temp\

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Empty the Recycle Bin.

Please go here & install ALL critical updates required for your system.

Well, thank you for the comments and ideas. I followed what you said, including the .TMP files. I also followed the idea of another site that recommended searching for .HTA files and moving them to a different folder.

I have repeatedly cleaned out temp files, cookies, etc. and also questionable History items. I have run half a dozen spyware/adware/trojan/hijacker finder/eradicator programs and STILL this stupid homepage keeps putting itself back.

I wouldn't care so much if it were easy to remove, but whoever programmed this little demon has a truly demented mind.

I am about to give up, wipe my C: partition and reinstall WinXP

Well, thank you for the comments and ideas. I followed what you said, including the .TMP files. I also followed the idea of another site that recommended searching for .HTA files and moving them to a different folder.

I have repeatedly cleaned out temp files, cookies, etc. and also questionable History items. I have run half a dozen spyware/adware/trojan/hijacker finder/eradicator programs and STILL this stupid homepage keeps putting itself back.

I wouldn't care so much if it were easy to remove, but whoever programmed this little demon has a truly demented mind.

I am about to give up, wipe my C: partition and reinstall WinXP :mad:


- Dave

Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

And another hijackthis log please.

Quote:

---

Originally posted by crunchie
Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

And another hijackthis log please.

---

----------------------------------------------------------------

Crunchie,

Thanks for your reply -- I followed your instructions, using both basic and "RED" versions of SilentRunners (the latter recommended for WinXP).

Attached are the files you requested. I combined the following onto one text file, separated by "double-double" lines:

SilentRunners log
SilentRunners (RED) log
new HijackThis log


Cheers,
Dave

I think we have it :).

Download the Pocket KillBox
Unzip the file to your desktop.
Run Pocket Killbox and paste the full file path of the following in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter it.

C:\WINDOWS2\System32\delaybuf.dll

Reboot afterwards if the file is successfully deleted.

If it is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uni--search.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://uni--search.com

Hope that get's it for you.

hello, i ran into this thread while searching for info on "uni--search.com". tried all the things you mentioned, adware programs etc., norton, microsoft. none worked. couldn't locate the .dll you mentioned. any further news on what is causing this or how to solve it?

thanks.

tom

I have PM'd the OP on two occasions regarding this matter, but so far have not received a reply :(.
Hopefully it was not a wasted effort on my part.
If you are having problems, you are welcome to post a log in the hijackthis forum, along with a silent runners log. The text file it creates will be in the same folder you run it from.
Please run Adaware and Spybot S&D first if you decide to post :).

stargazer777. If you read this, can you also do a search for C:\windows\Hires.dat and delete that also if found.

okay- problem solved- i downloaded the silent runner program and found a startup program called "resetuponreboot.exe" or something (i wish i saved the name) that was located in the windows/temp directory. after erasing the temp directories and eliminating that item from the registry and rebooting the computer- it seems to have gone away. funny that norton or any other spyware/adware programs could not catch this, and i tried them all. btw- i updated all the most recent winxp updates available- don't know if that helped any- but it seemed many of them were security and adware related.

Quote:

---

Originally posted by crunchie
stargazer777. If you read this, can you also do a search for C:\windows\Hires.dat and delete that also if found.

---

Nope, did a full search in that directory path and .... nothing.



- Dave

All,

I did another scan with Silent Runner, and I have attached the resulting file.

- Dave

You still have C:\WINDOWS2\System32\delaybuf.dll on board. That is why you are still being hijackrd :).
Please post another hijackthis log and we can go from there.

Well, I deleted everything I previously was told to. I can only surmise it is somehow being reinstalled.

I tried to delete it, and a message window informed me that I could not delete the file, that "access is denied". How do I get around this so I can ditch it ?

- Dave

That's why I wanted a hijackthis log. Then the complete process can be undertaken. Do you still have the killbox? It will be required again, unless you can delete the delaybuf file in safe mode.

crunchie,


Here is a new HijackThis log as requested.

I'm late to work but will check for replies from there.

I'll be coming home early and should have plenty of time this afternoon to work on killing this thing. Hopefully it won't be a too-involved process.

Thanks again for comments and info.


- Dave

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

O2 - BHO: BHO Class - {575A5AE9-B68E-4BEB-BACB-FE430448C654} - C:\WINDOWS2\System32\WinSuck.dll
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS2\System32\IETie.dll
O2 - BHO: BHO Class - {F6053709-5723-454E-AB9D-7FC7E681AFA5} - C:\WINDOWS2\System32\WinTitle.dll

O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll
O9 - Extra button: (no name) - {578FC4E3-151E-456c-AF8E-B63061EFE228}} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)


Run Pocket Killbox again and paste the full file path of the file in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter the file.

C:\WINDOWS2\System32\delaybuf.dll

Reboot afterwards if the file is successfully deleted.

If the file is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.

After the reboot please post another hijackthis log and a silent runners log.

Success, crunchie !! :D

Yessssss !! I followed your directions on your previous post, and it looks like I have control over my home page on IE once again !! I have closed and reopened MSIE several times, and I keep getting my desired home page -- finally !!

Many thanks to you and others who helped, and to the producers of HijackThis and Pocket KillBox.

If I am indeed hijack-free, I'm going to barbecue a huge steak ! If I could email you some of it, I would .... hehe.


Many thanks again,
- Dave
in Virginia

Crunchie (and all):

Well .... ratzafratz !! I came home from my evening job and fired up MSIE again, and blast it!!.... the home page came up as one of those hijack sites again.

The interesting thing is, in MSIE, I opened Tools>Internet Options and my usual home page site was listed as such. Before, when I was hijacked, the demon site became the home page in MSIE's Tools>Internet Options. How can I get hijacked (again) and still have the correct site showing as the home page ?

Anyway ..... do I use the previous process again, or what would you like me to try ?

- Dave :(

Post both those logs again (new ones :D). It's possible that there are entries in your favourites or your hosts file that are doing something too.

Here you go, crunchie ... two new files as you requested.

Got to run out for the afternoon but will check back later.

Interestingly, I seem to have a trojan(?) script or something that is killing MSIE, even as I was writing this reply the first time. I restarted MSIE, and it shut down again even before I could get to the VDr site.

Instead, on my desktop, I got a small window with adult material being advertised (which I do not visit anywhere).

I don't know what the connection might be, but that's what happened.

thanks again,
- Dave

Apparently only one file can be attached to each reply. Here is the one for the Silent Runner results.

- Dave

Picked up some other nasties from somewhere.

Please go here and have this file scanned.

C:\WINDOWS2\System32\soft.exe

If bad, delete it manually then add it to the hijackthis fix list. (F3 - REG:win.ini: run=C:\WINDOWS2\System32\soft.exe)

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

O2 - BHO: BHO Class - {575A5AE9-B68E-4BEB-BACB-FE430448C654} - C:\WINDOWS2\System32\WinSuck.dll
O2 - BHO: BHO Class - {F6053709-5723-454E-AB9D-7FC7E681AFA5} - C:\WINDOWS2\System32\WinTitle.dll

O4 - HKLM\..\Run: [Web Service] C:\WINDOWS2\System32\msxmidi.exe
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS2\System32\msxmidi.exe

O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k00719/sb02a.cab

O21 - SSODL: eplrr - {20C2E11E-486A-44BF-B125-BC33B8189CCB} - C:\WINDOWS2\System32\eplrr3.dll

Reboot into safe mode following the instructions here and navigate to and delete the following if found:

C:\WINDOWS2\System32\msxmidi.exe<----file
C:\WINDOWS2\System32\eplrr3.dll<----file

Reboot normally.

Download CWShredder 2 from here. Run it and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.

Reboot again then post those two logs again please.

Well, crunchie and all ....

Things are falling apart faster and faster.

1.) I followed all of the steps in your previous post; files got zapped but later appear to be magically re-installed.

2.) Following your directions, one file I destroyed with Pocket Killbox .... soft.exe ... is referred to by new messages appearing on my desktop when I boot up.

3.) I am now the proud owner of no less than eight (8) virus files. I have no idea how I got them, since I have avoided using my MSIE browser to surf while I've been dealing with this hijacker garbage (10 to 12 days). ....

* * * Please see my post in the virus section at http://discussions.virtualdr.com/sho...hreadid=181563

4.) I am slowly going mad, following directions and deleting files with downloaded spyware and malware killers, only to have files reappear and remain hijacked as ever. I am about ready to back things up, format my hard drive and start over :P

Nonetheless, I am once again doing scans with Silent Runner and HijackThis, and attaching log files.

regards,
- "Prozac Dave"

Once again, I apparently cannot attach more than one file per post .... here is the other log file.

- Dave

Not a great deal has changed there :(. Let's try killbox on them all :D.

Run Pocket Killbox again and paste the full file path of each of the below files in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter each file (see the files below).

C:\WINDOWS2\msxmidi.exe
C:\WINDOWS2\System32\soft.exe
C:\WINDOWS2\System32\WinSuck.dll
C:\WINDOWS2\System32\WinTitle.dll
C:\WINDOWS2\System32\msxmidi.exe

Reboot afterwards if the files are successfully deleted.

If all files are not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.

Once up and running, Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

F3 - REG:win.ini: run=C:\WINDOWS2\System32\soft.exe

O2 - BHO: BHO Class - {575A5AE9-B68E-4BEB-BACB-FE430448C654} - C:\WINDOWS2\System32\WinSuck.dll
O2 - BHO: BHO Class - {F6053709-5723-454E-AB9D-7FC7E681AFA5} - C:\WINDOWS2\System32\WinTitle.dll

O4 - HKLM\..\Run: [Web Service] C:\WINDOWS2\System32\msxmidi.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS2\System32\msxmidi.exe

Another reboot and another couple of logs :D.

Just for interests sake, can you also go here and download FindIt.zip to your Desktop, unzip it and open the FindIt folder and doubleclick on find.bat. Let it run (please be patient, it will take a few minutes) and when it has finished gathering info, it will generate a file called Output.txt. Please copy it and paste it back in this thread.

Hi, all ....


Crunchie, I followed your most recent instructions to the letter. Here are the log files you requested.

This post will have the HJT log attached .... the Silent Runner log will be attached to the following post.

***** I will attach the FindIt log as soon as I can find where it was stashed :D

Can't someone *PLEASE* set up VDr. to allow multiple file attachments to single posts ?!??



Thanks again ....
- Dave