O17 entry

**teacup61** · 2006-09-06, 02:33

Hello,

Yes, it's a nifty little program.

Problem is, it came up clean. Can you run eTrust again and see if encodex.exe is still there? If it is, please do the following:

1) Please download the Killbox.
Save it to the desktop and run it.

2) Select "Delete on Reboot", and then select "All files".

3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\System32\encodex.exe

4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

5) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

Please run HijackThis! and click "Scan." Place checks next to the following entries, if present:

O17 - HKLM\System\CCS\Services\Tcpip\..\{EAC62E71-ED80-48AE-B816-A0480BD2CDED}: NameServer = 85.255.114.6 85.255.112.157

Close all browsers and other windows except for HijackThis!, and click "Fix Checked".

The follow the directions again for FixWareout. Please post the report, and a new HijackThis log in your reply. Hang in there.

Thanks,
tea

**neenersnitzel** · 2006-09-06, 03:49

Tea,

I work in a casino as a surveillance officer, and one of the things that guides me is "If it dosen't look right, it's not" after I posted the last results, I found a second log on my desktop. It was a little bit different than the first one so I went ahead and ran the scan again. Here is the results:

09/05/06 20:35:13 [Info]: BlackLight Engine 1.0.46 initialized
09/05/06 20:35:13 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/05/06 20:35:13 [Note]: 7019 4
09/05/06 20:35:13 [Note]: 7005 0
09/05/06 20:35:16 [Note]: 7006 0
09/05/06 20:35:16 [Note]: 7011 848
09/05/06 20:35:16 [Note]: 7026 0
09/05/06 20:35:16 [Note]: 7026 0
09/05/06 20:35:20 [Note]: FSRAW library version 1.7.1019
09/05/06 20:37:54 [Note]: 7007 0

Since this one is different than the last one, I will refrain from doing the above until I here back from you.

Neenersnitzel

**teacup61** · 2006-09-06, 06:43

Hi neener,

It still didn't show anything. I was hoping to see a hidden file, something that might be holding that entry there, or replacing it. Go ahead with the other directions.

**neenersnitzel** · 2006-09-07, 01:36

Tea,

Ran the Killbox - didn't get a "Pending Operations prompt", Scaned with HJT and checked the O17 entry, ran a new FixWareout, and here's the reports:

Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
...

Microsoft (R) Windows Script Host Version 5.6
Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\WINDOWS\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.

Logfile of HijackThis v1.99.1
Scan saved at 18:29, on 06-09-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AnalogX\CookieWall\cookie.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Merijn\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Murphy's Matrix Surfing Rig
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CookieWall] C:\Program Files\AnalogX\CookieWall\cookie.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Merijn\HijackThis.exe /startupscan
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1134244863137
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136430743062
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/game...ploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EAC62E71-ED80-48AE-B816-A0480BD2CDED}: NameServer = 85.255.114.6 85.255.112.157
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**teacup61** · 2006-09-07, 03:18

Hello,

Can you please reset HiajckThis not to run at startup? I'm fetching some new ideas for you. I'll be back in a while with them

Thanks,
tea

**teacup61** · 2006-09-07, 16:50

Hi neener,

Thanks for your patience.

Go to Start > Control Panel, double click on Network Connections
Right click the default connection and select: Properties
(For Cable or DSL, right-click: Local Area Connection )

In the Properties box,
Under: This connection uses the following items
Double-click on the Internet Protocol (TCP/IP) item

Is the following checked:
Obtain DNS servers automatically
If it is not checked, and there are other settings, write them down in case you need to change them back to what they were.
Then, check: Obtain DNS servers automatically
Press OK twice to go out of the Properties screens

Reboot if it prompts to do so, if not, reboot manually

====
Run HijackThis, post a new log, and lets see if the 017 entry is gone.
====
Sometimes a bad DNS entry is cached...
To get rid of it, go to Start > Run, and type in: cmd
Press: Enter after the above, and after every command below:
At the prompt, type in: cd\
At C:\> type in:
ipconfig /flushdns

Click: OK

or, take a look at what is in there...

Go to Start > Run, and type in: cmd
Press: Enter after the above, and after every command below:
At the prompt, type in: cd\
At C:\> type in:
ipconfig /displaydns

Type: Exit to go out of the Command prompt

Let me know!

tea

**neenersnitzel** · 2006-09-07, 18:46

Tea,

Did as requested up to the log posting. As you can see, the O17 entry has changed the numbers. I guess a little surfing will be the true test. after I finish this post I will do the rest of what is in your last post, and we'll go from there.

TKS nennersnitzel

Logfile of HijackThis v1.99.1
Scan saved at 11:38, on 06-09-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AnalogX\CookieWall\cookie.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Merijn\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Murphy's Matrix Surfing Rig
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CookieWall] C:\Program Files\AnalogX\CookieWall\cookie.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1134244863137
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136430743062
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/game...ploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EAC62E71-ED80-48AE-B816-A0480BD2CDED}: NameServer = 70.239.240.3 70.239.240.2
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**neenersnitzel** · 2006-09-07, 19:32

tea,

After I ran /flushdns, it said it had successfully flushed.

After I ran /displaydns, it said the following:

Windows I P Configuration

1.0.0.127.in-addr.arpa
----------------------------------------------------
Record Name . . . . . : 1.0.0.127.in-addr.arpa.
Record type . . . . . : 12
Time To Live . . . . : 604692
Data Lenth . . . . . . : 4
Section . . . . . . : Answer
PTR Record . . . . . . : localhost

number-one.mshome.net
------------------------------------------------------
Record Name . . . . . : number-one.mshome.net
Record Type . . . . . : 1
Time To Live . . . . . . :604692
Data Lenth . . . . . . : 4
Section . . . . . . : Answer
A (Host) Record . . . : 192.168.0.1

1.0.168.192.in-addr.arpa
-------------------------------------------------------
Record Name . . . . . : 1.0.168.192.in-addr.arpa
Record Type . . . . . : 12
Time To Live . . . . . . : 604692
Data Lenth . . . . . . : 4
Section . . . . . . : Answer
PTR Record . . . : number-one.mshome.net

Localhost
--------------------------------------------------------
Record Name . . . . . : Localhost
Record type . . . . . : 1
Time To Live . . . . . . : 604692
Data Lenth . . . . . . : 4
Section . . . . . . : Answer
A (Host) Record . . . :127.0.0.1

C:\>

I'm hoping that this looks more normal.

Neenersnitzel

**teacup61** · 2006-09-08, 19:25

Hi neener,

How is it running now? It sure is nice to see that thing finally gone.

Let me know please!

Thanks,
tea

**neenersnitzel** · 2006-09-08, 19:40

Tea,

I went surfing last night and even went to sites that I don't normally view, and I ran into a few re-directs, but nothing on the scale that I was having. I think you have beaten this one for me. I want to thank you for your time, effort and expertise. I stand in awe!

Thank you very much.

Neenersnitzel

Thread: O17 entry

Thread Tools

Display

last scan

Killbox

Dns

DNS further

You da Man!

Posting Permissions