In trouble again...
I open internet explorer - and the default page it keeps opening on is::
http://win-eto.com/hp.htm?
I have tried all the usual spyware - and remove some bugs but none fix this. - I have pasted in the hijackthis log below
It does report the following in the hijack log
R0 - HKCU\Software\Microsoft\In
But I cannot find this in the registry and when I use hijack to fix, it never seems to do it...
Logfile of HijackThis v1.98.2
Scan saved at 11:01:25, on 09/12/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon
C:\WINNT\system32\services
C:\WINNT\system32\lsass.ex
C:\WINNT\system32\svchost.
C:\WINNT\System32\svchost.
C:\WINNT\system32\spoolsv.
d:\Program Files\Nokia\Nokia D211\D211CTL.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\system32\Hummbird
C:\WINNT\system32\inetsrv\
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\nvsvc32.
c:\oracle\bin\agntsrvc.exe
C:\WINNT\system32\cmd.exe
C:\Program Files\Novadigm\radexecd.ex
c:\oracle\bin\dbsnmp.exe
C:\Program Files\Novadigm\radsched.ex
C:\Program Files\Novadigm\Radstgms.ex
C:\TNGRCO\RCManClient.exe
C:\WINNT\system32\rcmdsvc.
C:\TNGRCO\RCOService.exe
C:\WINNT\system32\regsvc.e
C:\WINNT\system32\MSTask.e
C:\TNGRCO\rp32u.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\SUSS.EXE
c:\oracle\Apache\jdk\bin\j
C:\Program Files\Common Files\PFShared\UmxCfg.exe
C:\WINNT\System32\WBEM\Win
C:\WINNT\System32\wltrysvc
C:\WINNT\system32\svchost.
C:\Program Files\Common Files\PFShared\UmxPol.exe
C:\WINNT\System32\bcmwltry
C:\Program Files\Tiny Personal Firewall\UmxAgent.exe
C:\Program Files\Tiny Personal Firewall\UmxTray.exe
C:\Program Files\Tiny Personal Firewall\DseCC.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\NWTRAY.E
C:\Program Files\QuickTime\qttask.exe
D:\Program Files\Nokia\Nokia D211\D211STRT.EXE
C:\Program Files\Java\j2re1.4.2_06\bi
C:\WINNT\system32\dk0puxk8
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\SPYWAR~1\PRJSP
c:\program files\reflection\r2win.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
c:\program files\reflection\r2win.exe
c:\program files\reflection\r2win.exe
C:\Lotus\Notes\NLNOTES.EXE
C:\Lotus\Notes\nhldaemn.EX
C:\WINNT\regedit.exe
C:\Documents and Settings\mf_locadm\Desktop
C:\Program Files\JavaSoft\JRE\1.3.1_1
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dl
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroChec
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [D211STRT.EXE] "d:\Program Files\Nokia\Nokia D211\D211STRT.EXE"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bi
O4 - HKLM\..\Run: [Control handler] C:\WINNT\system32\dk0puxk8
O4 - HKCU\..\Run: [Spyware Vanisher] c:\spywarevanisher-free\Fr
O4 - Global Startup: Anti-Virus&Spyware.lnk = C:\Program Files\Anti-Virus&Spyware\A
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RealDownload.lnk.disabled
O4 - Global Startup: winlogin.exe
O4 - Global Startup: WinZip Quick Pick.lnk.disabled
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CS2\Services\T
O17 - HKLM\System\CS2\Services\T
O17 - HKLM\System\CCS\Services\T
O18 - Protocol: AxrObjrefStream - {78E7CF7E-D9E0-4122-86E9-E
O20 - AppInit_DLLs: x6cyyzvifbzsi7dll.dll.dll.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
goto Start>Run>regedit
and navigate to the following key
HKEY_LOCAL_MACHINE\Softwar
in the right pane u will find a AppInit_DLLs entry, and when u right click it and choose Modify, under the Value data, u will see the above file !!!!
and what u need is just to remove it from there to get rid of this message !!!!
for this restart ur system in SAFEMODE, login as Administrator, and follow these instructions carefully !!!!!
==========================
The key to removing this problem is the registry key called
HKEY_LOCAL_MACHINE\Softwar
You have to remove this key. The value of this key may look blank for you, but it is not. They hide the value so you can't see it. This registry key tells Windows to load the trojan DLL every time ANY application is run giving it complete control to do whatever it wants. So you need to remove it so that the trojan DLL cannot load and keep re-infecting your pc.
The way to remove the registry key is not obvious. If you just delete it from regedit, since the trojan DLL is loaded, it will re-add it right back. (Try it. Delete the AppInit_DLLs registry key and hit F5. Notice that it's added right back by the trojan). So what you have to do is the following which worked for me.
1. Rename the HLM\Software\Microsoft\Win
2. Now delete the AppInit_DLLs key under the Windows2 folder.
3. Hit F5 and notice that AppInit_DLLs doesn't come back.
4. Rename the Windows2 folder back to Windows.
Now that AppInit_DLLs is gone, run the latest Adaware 6 *(and the other tools also)* to remove the trojan for good. Reboot your machine. Check the registry and make sure AppInit_DLLs is still gone. Your computer should be free of this for good now.
==========================
ref >> http://www.lavasoftsupport
The latest version of CoolWebShredder takes care of some versions of the hidden DLL hijacker.
Maybe it's worth a try:
http://majorgeeks.com/down
Download, install and run (clicking FIX).
Zee
Better try the CWShredder version 2.11, just out:
http://cwshredder.net/bin/
Zee
frust... you need to fix these entries with hijackthis,
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2
O4 - HKLM\..\Run: [Control handler] C:\WINNT\system32\dk0puxk8
O4 - Global Startup: winlogin.exe
O20 - AppInit_DLLs: x6cyyzvifbzsi7dll.dll.dll.
and then boot the system in safemode to delete this two files,
C:\WINNT\system32\dk0puxk8
and read here about that O4 - Global Startup: winlogin.exe entry,
http://www.liutilities.com
So here are the Removal Instructions >> http://securityresponse.sy
Removes the Registry entries for Winlogin.exe (virus file)
http://www.dougknox.com/xp
Business Accounts
Answer for Membership
by: SheharyaarSaahilPosted on 2004-12-09 at 06:04:02ID: 12783211
Post that log at this site >> http://www.hijackthis.de
and it will automatically analyse it for u,,, Fix the entries which it labels as Nasty :)
To Fix, check the lines in Hijackthis scan and click on Fix Checked !!
HJT Log Tutoriol >> http://aumha.org/a/hjttuto
CAUTION: Before fixing the entries in hijackthis, make sure that they are really Nasty and can be deleted, better u first research for it on Google and then when u will confirm that they shud be deleted, Fix them. And whenever u run Hijackthis, run it from a New folder on ur desktop, so that in case of any problem, u can take advantages of its created backups of fixed items. And in case if u still face problems in dealing with it, just analyse ur log at the above site, and then scroll down where u will see a Save Analyse button, hit it and it will save ur Log Analysation, then copy the link of that page and paste it here, and we will check it for u :)