Expl. keeps crashing

lynchknot · Jul 7, 2004

Expl. keeps crashing - hijack this log - please read

My time is up I suppose. Symtoms: explorer crashes often, sometimes requiring a reboot. I ran AV and Adaware - found nothing - tried to run Spybot but crashed explorer. Also, Spysweeper tries to inject code into many apps DLL. Here is my HJT - Thanks for helping.

Logfile of HijackThis v1.97.7
Scan saved at 12:27:58 PM, on 7/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PowerPanel\upssrv.exe
C:\Program Files\Dudez\ProtoWall.exe
C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe
C:\PowerPanel\upsio.exe
C:\Program Files\ProcessGuard Free\dcsuserprot.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\ssm\SysSafe.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\ProcessGuard Free\procguard.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\PROGRA~1\TrayMan\ntstart.exe
C:\PROGRA~1\TrayMan\trayman.exe
C:\Program Files\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe /waitservice
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ProtoWall] C:\Program Files\Dudez\ProtoWall.exe
O4 - HKCU\..\Run: [Bandwidth Monitor Pro] "C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe" /minimized
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [SystemSafe] C:\Program Files\ssm\SysSafe.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Startup: Process Guard Free.lnk = C:\Program Files\ProcessGuard Free\procguard.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Trashcan (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan (HKCU)
O10 - Broken Internet access because of LSP provider 'imon.dll' missing
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38126.4674189815
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} -
Click to expand...

lynchknot · Jul 7, 2004

Actually, Here's an update - may be different

Logfile of HijackThis v1.97.7
Scan saved at 1:57:54 PM, on 7/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe
C:\PowerPanel\upssrv.exe
C:\Program Files\ssm\SysSafe.exe
C:\Program Files\ProcessGuard Free\dcsuserprot.exe
C:\PowerPanel\upsio.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\Program Files\ProcessGuard Free\procguard.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32kui.exe
H:\eMule\emule.exe
C:\Program Files\Eset\nod32.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\FlashGet\flashget.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\ken\Local Settings\Temp\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe /waitservice
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ProtoWall] C:\Program Files\Dudez\ProtoWall.exe
O4 - HKCU\..\Run: [Bandwidth Monitor Pro] "C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe" /minimized
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [SystemSafe] C:\Program Files\ssm\SysSafe.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Startup: Process Guard Free.lnk = C:\Program Files\ProcessGuard Free\procguard.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Trashcan (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan (HKCU)
O10 - Broken Internet access because of LSP provider 'imon.dll' missing
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38126.4674189815
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} -
Click to expand...

lynchknot · Jul 7, 2004

I can take this elsewhere if there is a problem....

mu PC is AMDXp2000 with 1gb ram. I ran adaware, spybot, TDS-3, NOD32, CWS shredder-last (fixed about:blank) Spysweeper (for some reason SS trys to inject code in DLL's) I run Sys safety mon, Process guard, teatimer,Nod32.
My syptoms are, many explorer crashes, right click explorer crashes - from quick launch, DLL injection warnings - browser start page change (about:blank) - sometimes explorer will not reboot - I have to hit reset button on PC to reboot windows.TDS-3 has found a suspicous dual extension in c:\hewlett packard\digital imaging\hpisinst\install.wse.exe

(6:20:07 PM) SpySweeper.exe was about to inject code into C:\Program Files\firefox\firefox.exe (0) but was blocked
(6:20:07 PM) SpySweeper.exe was about to inject code into H:\eMule\emule.exe (0) but was blocked
(6:20:07 PM) SpySweeper.exe was about to inject code into C:\Program Files\TrayMan\trayman.exe (0) but was blocked
(6:20:07 PM) SpySweeper.exe was about to inject code into C:\Program Files\TrayMan\NTStart.exe (0) but was blocked
(6:20:06 PM) SpySweeper.exe was about to inject code into C:\Program Files\Agnitum\Outpost Firewall\outpost.exe (0) but was blocked
(6:20:06 PM) SpySweeper.exe was about to inject code into C:\Program Files\Eset\nod32krn.exe (0) but was blocked
(6:20:06 PM) SpySweeper.exe was about to inject code into C:\PowerPanel\upsio.exe (0) but was blocked
(6:20:06 PM) SpySweeper.exe was about to inject code into C:\Program Files\ProcessGuard Free\procguard.exe (0) but was blocked
(6:20:05 PM) SpySweeper.exe was about to inject code into C:\Program Files\ePrompter\ePrompter.exe (0) but was blocked
(6:20:05 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\System32\ctfmon.exe (0) but was blocked
(6:20:05 PM) SpySweeper.exe was about to inject code into C:\Program Files\ssm\SysSafe.exe (0) but was blocked
(6:20:05 PM) SpySweeper.exe was about to inject code into C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (0) but was blocked
(6:20:04 PM) SpySweeper.exe was about to inject code into C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe (0) but was blocked
(6:20:04 PM) SpySweeper.exe was about to inject code into C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (0) but was blocked
(6:20:04 PM) SpySweeper.exe was about to inject code into C:\PowerPanel\upssrv.exe (0) but was blocked
(6:20:04 PM) SpySweeper.exe was about to inject code into C:\Program Files\Eset\nod32kui.exe (0) but was blocked
(6:20:03 PM) SpySweeper.exe was about to inject code into C:\Program Files\NetLimiter\NetLimiter.exe (0) but was blocked
(6:20:03 PM) SpySweeper.exe was about to inject code into C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (0) but was blocked
(6:20:03 PM) SpySweeper.exe was about to inject code into C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (0) but was blocked
(6:20:03 PM) SpySweeper.exe was about to inject code into C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe (0) but was blocked
(6:20:03 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\Explorer.EXE (0) but was blocked
(6:20:02 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\Ati2evxx.exe (0) but was blocked
(6:20:02 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\spoolsv.exe (0) but was blocked
(6:20:02 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\System32\svchost.exe (0) but was blocked
(6:20:02 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\System32\svchost.exe (0) but was blocked
(6:20:01 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\svchost.exe (0) but was blocked
(6:20:01 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\System32\Ati2evxx.exe (0) but was blocked
(6:20:01 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\lsass.exe (0) but was blocked
(6:20:01 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\services.exe (0) but was blocked
(6:20:01 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\winlogon.exe (0) but was blocked
(6:20:00 PM) SpySweeper.exe was about to inject code into C:\WINDOWS\system32\csrss.exe (0) but was blocked
(6:20:00 PM) SpySweeper.exe was about to inject code into \SystemRoot\System32\smss.exe (0) but was blocked
(6:20:00 PM) Internal Error while processing directive 11 : Can't get the name of target process, which is accessed by C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
(11:01:12 AM) Internal Error while processing directive 11 : Can't get the name of target process, which is accessed by C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Click to expand...

lynchknot · Jul 8, 2004

Using latest version of HJT - note last entry is different -

Logfile of HijackThis v1.98.0
Scan saved at 10:28:48 AM, on 7/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dudez\ProtoWall.exe
C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe
C:\Program Files\ssm\SysSafe.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\Program Files\ProcessGuard Free\procguard.exe
C:\PowerPanel\upssrv.exe
C:\Program Files\ProcessGuard Free\dcsuserprot.exe
C:\PowerPanel\upsio.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\PROGRA~1\TrayMan\ntstart.exe
C:\PROGRA~1\TrayMan\trayman.exe
C:\Program Files\firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\ken\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MOD] C:\Program Files\Microangelo\muamgr.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe /waitservice
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ProtoWall] C:\Program Files\Dudez\ProtoWall.exe
O4 - HKCU\..\Run: [Bandwidth Monitor Pro] "C:\Program Files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe" /minimized
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [SystemSafe] C:\Program Files\ssm\SysSafe.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Startup: Process Guard Free.lnk = C:\Program Files\ProcessGuard Free\procguard.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\Program Files\Agnitum\Outpost Firewall\TRASH.EXE (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\Program Files\Agnitum\Outpost Firewall\TRASH.EXE (HKCU)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} -
O20 - AppInit_DLLs: apihookdll.dll
Click to expand...

lynchknot · Jul 9, 2004

How about directing me to a board that isn't so busy? Every day that goes by can be causing more damage - if I truly have something wrong.

»»»»»»»»»»»»»»»»»»*** freeatlast.100free.com ***»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»*** Read this first! ***»»»»»»»»»»»»»»»»
Due to errors on various message boards I made some changes.
You must know how to ID the file based on the filters provided in
the scan, as not all the files flagged are bad.
If you make a mistake or use the wrong guidance, it is completely
your responsibility and the helper that assists you.
If you are not sure about the nature of the file or how
to proceed, I suggest you research it first before attempting
to remove any *unknown file on your own.
*For Helpers and/or users that are not familiar with any of the
items on the scan results- I recommend using an alternative, once
you know what to look for!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
--The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder
and is the destination for the file to be moved..
-*Previous directions will no longer work...
»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»

Microsoft Windows XP [Version 5.1.2600]
»»»IE build and last SP(s)
6.0.2800.1106 SP1-xxxxxxxxxx-edited
The type of the file system is NTFS.
C: is not dirty.

Fri 07/09/2004
11:22am up 0 days, 0:16

»»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/»»»»»»»»»»»»»»»»

Scanning for file(s)...
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» .........
»»Locked or 'Suspect' file(s) found...

»»»»» (*2*) »»»»»........
**File C:\FINDnFIX\LIST.TXT

»»»»» (*3*) »»»»»........

No matches found.

unknown/hidden files...

C:\WINDOWS\SYSTEM32\
nrad.dll Sat May 15 2004 8:37:30a A.S.. 139,264 136.00 K
oem.dll Thu Mar 25 2004 6:05:30p A.S.. 53,248 52.00 K
rad.dll Sat May 15 2004 9:09:16a A.S.. 335,872 328.00 K
radclkr.dll Sat May 15 2004 9:13:40a A.S.. 348,160 340.00 K
radenu.dll Sat May 15 2004 8:18:48a A.S.. 61,440 60.00 K
radesp.dll Sat May 15 2004 8:32:20a A.S.. 61,440 60.00 K
radexe.dll Sat May 15 2004 9:08:58a A.S.. 151,552 148.00 K
radfra.dll Sat May 15 2004 8:33:04a A.S.. 65,536 64.00 K
radhun.dll Sat May 15 2004 8:33:44a A.S.. 61,440 60.00 K
radita.dll Sat May 15 2004 8:34:24a A.S.. 61,440 60.00 K
radnlb.dll Sat May 15 2004 8:35:02a A.S.. 61,440 60.00 K
radplk.dll Sat May 15 2004 8:35:50a A.S.. 65,536 64.00 K
radtype.dll Sat May 1 2004 10:05:48a A.S.. 147,525 144.07 K

13 items found: 13 files, 0 directories.
Total of file sizes: 1,613,893 bytes 1.54 M

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\NRAD.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\OEM.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RAD.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADCLKR.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADENU.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADESP.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADEXE.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADFRA.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADHUN.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADITA.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADNLB.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADPLK.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\RADTYPE.DLL

»»»»»(*5*)»»»»»
**File C:\WINDOWS\SYSTEM32\DLLXXX.TXT

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...

No matches found.

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 478

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ apihookdll.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = apihookdll.dll
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710

»»Security settings for 'Windows' key:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (»www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM

»»Member of...: (Admin logon required!)
User is a member of group someone\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.

»» Service searchdifferent variant) '"Network Security Service","__NS_Service_3"...

[SC] GetServiceKeyName FAILED 1060:

The specified service does not exist as an installed service.

[SC] GetServiceDisplayName FAILED 1060:

The specified service does not exist as an installed service.

»»Notepad check....

C:\WINDOWS\
notepad.exe Thu Aug 23 2001 5:00:00a A.... 66,048 64.50 K

1 item found: 1 file, 0 directories.
Total of file sizes: 66,048 bytes 64.50 K

C:\WINDOWS\SYSTEM32\
notepad.exe Thu Aug 23 2001 2:00:00a A.... 200,192 195.50 K

1 item found: 1 file, 0 directories.
Total of file sizes: 200,192 bytes 195.50 K

No matches found.

»»»»»»Backups created...»»»»»»
11:25am up 0 days, 0:19
Fri 07/09/2004

A C:\FINDnFIX\keyback.hiv
--a-- - - - - - 8,192 07-09-2004 keyback.hiv
A C:\FINDnFIX\keys1\winkey.reg
--a-- - - - - - 301 07-09-2004 winkey.reg

C:\FINDNFIX\
JUNKXXX Fri Jul 9 2004 11:22:34a .D...

1 item found: 0 files, 1 directory.

»»Performing string scan....
00001150: ?
00001190: Q e vk f AppInit_
000011D0LLs G a p i h o o k d l l . d l l Ali vk
00001210: 8 UDeviceNotSelectedTimeout 1 5 ( W 9 0
00001250: ! vk ' zGDIProcessHandleQuota" vk
00001290: Spooler2 y e s X
000012D0: vk =pswapdisk vk H R Transmis
00001310:sionRetryTimeout X @ vk '
00001350: , USERProcessHandleQuotaSq u 3 M M H E E
00001390:hpN P U E SVW t h0 5 E t j
000013D0:M j QW s Ph u"3 M PPQW s Ph u E u { .
00001410: uO 5 e E P E j P uD zu9 u j@ E P E W
00001450 u W u W u u u j ^ u u _^[ V
00001490: T D$ @ F ^ V D$ t V G Y ^ @
000014D0: > QVW j } e w j h V P M X
00001510:_^d V D$ t V Y ^ QVW } X
00001550:e w F h P L M 0 M _^d V
00001590: D$ t V ^ ` ` QSV W u 3 9} }
000015D0:t u Y Y Fx ~x h 8 p p

---------- WIN.TXT
fùAppInit_DLLsÖ�æGØÿÿÿa
--------------
--------------
apihookdll.dll
--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="apihookdll.dll"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 30 bytes, including the 2 for string termination.

[AppInitDLLs]
Ansi string : "apihookdll.dll"
0000 61 00 70 00 69 00 68 00 6f 00 6f 00 6b 00 64 00 | a.p.i.h.o.o.k.d.
0010 6c 00 6c 00 2e 00 64 00 6c 00 6c 00 00 00 | l.l...d.l.l...
Click to expand...

lynchknot · Jul 12, 2004

Crashing fixed: https://www.wilderssecurity.com/showthread.php?p=215329&posted=1#post215329

lynchknot · Jul 12, 2004

thanks for your help.

Log in or Sign up

Expl. keeps crashing

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

Log in or Sign up

Expl. keeps crashing

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

lynchknot Registered Member

Useful Searches