Author Topic: Unable to upload/attach files (Read 12675 times)

ADAJehuty · « **on:** January 21, 2008, 06:10:41 AM »

I'm having a problem with my internet connection. I'm using the latest versions of both IE and Firefox, and everything works fine, except for the fact that I cannot upload files to hosting sites, or attach files to e-mails. It has only been a few days (two at max) since this started, but it is imperative that I correct this problem ASAP, as all my courses this semester require the work to be turned in digitally by e-mailing it to the course instructor!

Any help would be greatly appreciated. Thanks!

Deerpark · « **Reply #1 on:** January 21, 2008, 06:19:14 AM »

More info please.
Version of windows.
What happens when you try to upload files? Any error messages?
Have you recently changed anything on your computer? Added or removed software for example?
What protection software do you have installed? (Antivirus, Firewalls, Anti-spyware, etc).

ADAJehuty · « **Reply #2 on:** January 21, 2008, 06:28:25 AM »

Quote from: Deerpark on January 21, 2008, 06:19:14 AM

More info please.
Version of windows.
What happens when you try to upload files? Any error messages?
Have you recently changed anything on your computer? Added or removed software for example?
What protection software do you have installed? (Antivirus, Firewalls, Anti-spyware, etc).

Current version of Windows is XP Media Center Edition Version 2002, Service Pack 2.

In Firefox (My browser of choice), I'm defaulted to the "Problem loading page" page when I try and upload, saying "the connection to the server was reset while the page was loading".

There haven't been any drastic changes to my computer recently, no installs/unistalls or things of that nature between now and the time when I could upload.

Currently my only running anti-virus program is Webroot Spy Sweeper.

Deerpark · « **Reply #3 on:** January 21, 2008, 06:35:13 AM »

Webroot spysweeper is an anti-spyware software not anti-virus. So I would say you're dangerously under protected.
I suggest you go through the steps here to make sure your computer is clean before trying anything else.

Broni · « **Reply #4 on:** January 21, 2008, 11:46:31 AM »

Quote

I suggest you go through the steps here to make sure your computer is clean before trying anything else.

...especially System Restore.

ADAJehuty · « **Reply #5 on:** January 21, 2008, 05:04:41 PM »

Thanks a lot for the warning. I had reason to suspect I might have a virus, but I had no idea it'd gotten this bad... hopefully it's still repairable without a reformat.

Here are the logs:
(Since I can't attach files currently, I'll unfortunately have to post them directly in the thread)

SUPERanti-spyware log:

Code: [Select]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/21/2008 at 11:33 AM

Application Version : 3.9.1008

Core Rules Database Version : 3384
Trace Rules Database Version: 1378

Scan type       : Custom Scan
Total Scan Time : 02:00:11

Memory items scanned      : 416
Memory threats detected   : 2
Registry items scanned    : 5752
Registry threats detected : 20
File items scanned        : 121220
File threats detected     : 79

Trojan.Mezzia/Resident
 C:\WINDOWS\SYSTEM32\WINEIL32.DLL
 C:\WINDOWS\SYSTEM32\WINEIL32.DLL

Trojan.WinFixer
 C:\WINDOWS\SYSTEM32\SSQRO.DLL
 C:\WINDOWS\SYSTEM32\SSQRO.DLL
 HKLM\Software\Classes\CLSID\{784C4FED-DA52-40D6-8252-D0822F80B9F0}
 HKCR\CLSID\{784C4FED-DA52-40D6-8252-D0822F80B9F0}
 HKCR\CLSID\{784C4FED-DA52-40D6-8252-D0822F80B9F0}\InprocServer32
 HKCR\CLSID\{784C4FED-DA52-40D6-8252-D0822F80B9F0}\InprocServer32#ThreadingModel
 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{784C4FED-DA52-40D6-8252-D0822F80B9F0}

Adware.Vundo Variant
 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{C91D0A87-3744-445B-8A0E-29942831DC9C}
 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{60E2746A-9C2E-45A2-85CE-7E1A8A890961}
 C:\WINDOWS\SYSTEM32\XXYWXYW.DLL.VIR

Unclassified.Unknown Origin
 HKLM\Software\Microsoft\Internet Explorer\Toolbar#{11A69AE4-FBED-4832-A2BF-45AF82825583}
 HKU\S-1-5-21-1790651529-2737603661-118392741-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{11A69AE4-FBED-4832-A2BF-45AF82825583}

Trojan.Downloader-Win/GHY
 Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\wineil32

Trojan.Unknown Origin
 HKLM\SOFTWARE\Microsoft\MSSMGR
 HKLM\SOFTWARE\Microsoft\MSSMGR#Brnd
 HKLM\SOFTWARE\Microsoft\MSSMGR#PSTV
 HKLM\SOFTWARE\Microsoft\MSSMGR#SSTV
 HKLM\SOFTWARE\Microsoft\MSSMGR#SCLIST
 HKLM\SOFTWARE\Microsoft\MSSMGR#SSLIST
 HKLM\SOFTWARE\Microsoft\MSSMGR#Data
 HKLM\SOFTWARE\Microsoft\MSSMGR#LSTV
 HKLM\SOFTWARE\Microsoft\MSSMGR#BSTV
 HKLM\SOFTWARE\Microsoft\MSSMGR#MSLIST
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO1.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO10.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO11.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO12.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO13.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO14.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO15.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO16.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO17.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO18.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO19.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO2.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO3.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO4.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO5.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO6.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO7.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO8.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICO9.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICOA.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICOB.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICOC.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICOD.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICOE.TMP
 C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ICOF.TMP

Adware.ClickSpring/Yazzle
 C:\PROGRAM FILES\COMMON FILES\YAZZLE1552OINUNINSTALLER.EXE

Trojan.Downloader-Gen/BigTkt
 C:\VUNDOFIX BACKUPS\DRVJODR.DLL.BAD
 C:\WINDOWS\SYSTEM32\DRVNOPR.DLL

Trojan.Downloader-Gen/DDC
 C:\WINDOWS\SYSTEM32\BTXKGKCL.EXE
 C:\WINDOWS\SYSTEM32\BXYGJRMV.EXE
 C:\WINDOWS\SYSTEM32\CPMMIKNW.EXE
 C:\WINDOWS\SYSTEM32\CTWPYPPO.EXE
 C:\WINDOWS\SYSTEM32\DAOIRCOO.EXE
 C:\WINDOWS\SYSTEM32\DJVYYLIS.EXE
 C:\WINDOWS\SYSTEM32\EFBGGCMS.EXE
 C:\WINDOWS\SYSTEM32\EQFDVTLR.EXE
 C:\WINDOWS\SYSTEM32\ETHBGFUF.EXE
 C:\WINDOWS\SYSTEM32\EWSJMJQF.EXE
 C:\WINDOWS\SYSTEM32\FGAMYYXQ.EXE
 C:\WINDOWS\SYSTEM32\FROEOLUB.EXE
 C:\WINDOWS\SYSTEM32\GGEYAOBQ.EXE
 C:\WINDOWS\SYSTEM32\GHCPBRFL.EXE
 C:\WINDOWS\SYSTEM32\GQKRUNCM.EXE
 C:\WINDOWS\SYSTEM32\GWKPDAUJ.EXE
 C:\WINDOWS\SYSTEM32\HEDDGAQU.EXE
 C:\WINDOWS\SYSTEM32\HINDWUQJ.EXE
 C:\WINDOWS\SYSTEM32\HXEQBMGW.EXE
 C:\WINDOWS\SYSTEM32\HXKIHNRS.EXE
 C:\WINDOWS\SYSTEM32\INARJEPG.EXE
 C:\WINDOWS\SYSTEM32\IOMAVDRN.EXE
 C:\WINDOWS\SYSTEM32\KEGYWKPF.EXE
 C:\WINDOWS\SYSTEM32\LMTDDSXX.EXE
 C:\WINDOWS\SYSTEM32\NDUIBDPS.EXE
 C:\WINDOWS\SYSTEM32\NLWBBBEJ.EXE
 C:\WINDOWS\SYSTEM32\QGTCBYFT.EXE
 C:\WINDOWS\SYSTEM32\QLNJMWTA.EXE
 C:\WINDOWS\SYSTEM32\QRLVNXJS.EXE
 C:\WINDOWS\SYSTEM32\QSFXNQIK.EXE
 C:\WINDOWS\SYSTEM32\QUELXQKO.EXE
 C:\WINDOWS\SYSTEM32\QYUSVHBE.EXE
 C:\WINDOWS\SYSTEM32\RENWNHQH.EXE
 C:\WINDOWS\SYSTEM32\RNMXUPRP.EXE
 C:\WINDOWS\SYSTEM32\SQPFONMP.EXE
 C:\WINDOWS\SYSTEM32\TLUTYSAX.EXE
 C:\WINDOWS\SYSTEM32\TNKADKER.EXE
 C:\WINDOWS\SYSTEM32\TUHOMQVE.EXE
 C:\WINDOWS\SYSTEM32\TWMWBERD.EXE
 C:\WINDOWS\SYSTEM32\TYSOFXWF.EXE
 C:\WINDOWS\SYSTEM32\UQCCVHLC.EXE
 C:\WINDOWS\SYSTEM32\VLPYNKII.EXE
 C:\WINDOWS\SYSTEM32\VXUFUUON.EXE
 C:\WINDOWS\SYSTEM32\WBPOJJVQ.EXE
 C:\WINDOWS\SYSTEM32\WJRLRCHA.EXE
 C:\WINDOWS\SYSTEM32\XQSPTWYF.EXE

Adware.Vundo Variant/Rel
 C:\WINDOWS\SYSTEM32\MCRH.TMP
 C:\WINDOWS\SYSTEM32\ORQSS.INI2

Dr. Web CureIt Log:
(I couldn't run a full scan because the GUI for this program was messed up and I couldn't click the full scan button, but I can try and fix that if need be. This is the log for the quick scan)

Code: [Select]

npopkrct.exe;C:\WINDOWS\system32;Trojan.EzulaAd;Deleted.;

ADAJehuty · « **Reply #6 on:** January 21, 2008, 05:05:24 PM »

ESET Online Scan log:

Code: [Select]

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2811 (20080121)
# vers_arch_module=1.063 (20080117)
# vers_adv_heur_module=1.060 (20070601)
# EOSSerial=c83380ea936d5d44bdc115be9537f183
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2008-01-21 11:41:30
# local_time=2008-01-21 06:41:30 (-0500, Eastern Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=297135
# found=8
# scan_time=4082
C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\t3h uz0rz\Desktop\Live Safety Center.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\t3h uz0rz\Desktop\Online Security Guide.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000
C:\Documents and Settings\t3h uz0rz\Favorites\Online Security Guide.lnk Win32/Adware.SecToolbar application (unable to clean - deleted) 00000000000000000000000000000000

ADAJehuty · « **Reply #7 on:** January 21, 2008, 05:07:09 PM »

HijackThis log:

Code: [Select]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:53:02 PM, on 1/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\MA311 PCI Adapter Configuration Utility\wlanutil.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gaim\gaim.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: {27a4e006-0e6d-8ec8-e854-09ff95efd0b0} - {0b0dfe59-ff90-458e-8ce8-d6e0600e4a72} - (no file)
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {99344B55-1E31-4F6E-8294-4D2579A164AA} - (no file)
O2 - BHO: (no name) - {9D12F5A7-8624-4809-A832-318BA4777A19} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CAMTRAY.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [1c4e3ba7] "rundll32.exe" "C:\WINDOWS\system32\iluuoppd.dll",b
O4 - HKLM\..\Run: [BM1f7d083b] Rundll32.exe "C:\WINDOWS\system32\ppnrmqpw.dll",s
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - Global Startup: Configuration Utility.lnk = C:\Program Files\MA311 PCI Adapter Configuration Utility\wlanutil.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v46/wof/wof.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5140/mcfscan.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccbywx - fccbywx.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\xhegkahv.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54GSCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe

--
End of file - 8572 bytes

I hope these are helpful in understanding the cause of my problem, and I appreciate the time and effort put into helping me. Thanks again! (And sorry for the triple post, but it exceeded the maximum character limit)

Broni · « **Reply #8 on:** January 21, 2008, 05:09:17 PM »

Let me see...

Broni · « **Reply #9 on:** January 21, 2008, 05:19:14 PM »

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries:

- O2 - BHO: {27a4e006-0e6d-8ec8-e854-09ff95efd0b0} - {0b0dfe59-ff90-458e-8ce8-d6e0600e4a72} - (no file)

- O2 - BHO: (no name) - {99344B55-1E31-4F6E-8294-4D2579A164AA} - (no file)

- O2 - BHO: (no name) - {9D12F5A7-8624-4809-A832-318BA4777A19} - (no file)

- O4 - HKLM\..\Run: [1c4e3ba7] "rundll32.exe" "C:\WINDOWS\system32\iluuoppd.dll",b

- O4 - HKLM\..\Run: [BM1f7d083b] Rundll32.exe "C:\WINDOWS\system32\ppnrmqpw.dll",s

- O20 - Winlogon Notify: fccbywx - fccbywx.dll (file missing)

- O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\xhegkahv.exe (file missing)

4. Click on "Fix checked" button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders".

7. Delete following files/folders (if present):

- iluuoppd.dll, ppnrmqpw.dll, xhegkahv.exe files from C:\WINDOWS\system32

8. Turn off System Restore:

- Windows XP:
   1. Click Start.
   2. Right-click the My Computer icon, and then click Properties.
   3. Click the System Restore tab.
   4. Check "Turn off System Restore".
   5. Click Apply.
   6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
   7. Click OK.
- Windows Vista:
   1. Click Start.
   2. Right-click the Computer icon, and then click Properties.
   3. Click on System Protection under the Tasks column on the left side
   4. Click on Continue on the "User Account Control" window that pops up
   5. Under the System Protection tab, find Available Disks
   6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
   7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
   8. Click OK

9. Restart in Normal Mode.

10. Turn System Restore on.

11. Post new HijackThis log.

ADAJehuty · « **Reply #10 on:** January 21, 2008, 05:41:23 PM »

Sorry that took so long, my manual printer (see: handwriting) is slow.

Here's the new log file:

Code: [Select]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:39:27 PM, on 1/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\MA311 PCI Adapter Configuration Utility\wlanutil.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CAMTRAY.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [BM1f7d083b] Rundll32.exe "C:\WINDOWS\system32\ppnrmqpw.dll",s
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - Global Startup: Configuration Utility.lnk = C:\Program Files\MA311 PCI Adapter Configuration Utility\wlanutil.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v46/wof/wof.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5140/mcfscan.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WUSB54GSCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe

--
End of file - 7974 bytes

Broni · « **Reply #11 on:** January 21, 2008, 06:20:44 PM »

We're almost there.
Somehow, this:
- O4 - HKLM\..\Run: [BM1f7d083b] Rundll32.exe "C:\WINDOWS\system32\ppnrmqpw.dll",s
didn't want to go.
I need to know, if you can see ppnrmqpw.dll file in C:\WINDOWS\system32, and if so, what happens, when you try to delete it (in Safe Mode, if in Normal Mode it won't go).

ADAJehuty · « **Reply #12 on:** January 21, 2008, 06:40:09 PM »

Yeah, I noticed that one was the only one that returned as well.

However, upon checking the system32 folder, the actual file isn't there... (I checked twice, both in normal and safe mode, with hidden files visible.)

And now, after the restarts, running HijackThis no longer shows the " - O4 - HKLM\..\Run: [BM1f7d083b] Rundll32.exe "C:\WINDOWS\system32\ppnrmqpw.dll",s " entry.

Testing this post to see if I can attach the log this time instead of posting it...

EDIT: Seems like it attached fine. Kinda weird if you ask me..

[file cleanup - saving space - attachment deleted by admin]

Broni · « **Reply #13 on:** January 21, 2008, 06:44:25 PM »

Everything looks clean. Good job.

1. Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
2. Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner

When you're done, report how your computer is doing.

ADAJehuty · « **Reply #14 on:** January 21, 2008, 06:56:50 PM »

Yeah, everything appears to be in working order. And I have CCleaner now, I used it earlier before running all the virus scanners.

Thanks a lot for all your help, I really appreciate it! Now if only you'll do my Visual Basic homework for me...

Broni · « **Reply #15 on:** January 21, 2008, 07:05:24 PM »

Quote

Now if only you'll do my Visual Basic homework for me...

Are you a female?......
......Just kidding...LOL

Deerpark · « **Reply #16 on:** January 22, 2008, 03:48:18 AM »

So is everything in order now? Can you upload again?
If you haven't already done so, you should download a copy of AVG free for virus protection.

ADAJehuty · « **Reply #17 on:** January 22, 2008, 08:45:05 AM »

Yeah, everything is A-OK now, and my homework is in one time!

I'll download the AVG, too. Thanks again for all the help!

Broni · « **Reply #18 on:** January 22, 2008, 07:30:46 PM »

Wait a second. Aren't you using McAfee Security Center, which includes antivirus?

ADAJehuty · « **Reply #19 on:** January 23, 2008, 11:06:44 AM »

It was one of those free 1-year installations that came with the computer, but I didn't pay to renew it.

Broni · « **Reply #20 on:** January 23, 2008, 06:12:48 PM »

Then, you need to uninstall it. Ues removal tool: http://service.mcafee.com/FAQDocument.aspx?id=107083&lc=4105 rather, then Add\Remove.
After that...
1. Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
2. Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner
Finally, post new HijackThis log for us to see what leftovers you have.

Computer Hope Forum

News:

Author Topic: Unable to upload/attach files (Read 12675 times)

ADAJehuty

Deerpark

ADAJehuty

Deerpark

Broni

ADAJehuty

ADAJehuty

ADAJehuty

Broni

Broni

ADAJehuty

Broni

ADAJehuty

Broni

ADAJehuty

Broni

Deerpark

ADAJehuty

Broni

ADAJehuty

Broni