Lately I'm getting the DAX Error message (including the message: "05-Mar-05 is not a valid date) everytime I open Internet Explorer and Outlook Express.
Moreover some sites cannot be blocked by spyware even after I ran Adaware and after installing AdsGone (a program to block ads).
Can you help me to fix this problem please.
I followed the guidelines and scanned my PC using the HijackThis (v1.99.1).
Thanks,
Dorin.
This is a copy of the log file:
Logfile of HijackThis v1.99.1
Scan saved at 06:43:30 PM, on 26-Mar-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\isrvs\desktop.exe
C:\WINDOWS\system32\rmpnvi.exe
C:\WINDOWS\system32\vmss\vmss.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\MediaKey\OSD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Setup Files & Folders\Hijackthis\HijackThis.exe
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [nkfwli] c:\windows\system32\nkfwli.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rmpnvi.exe
O4 - HKLM\..\Run: [vmss] C:\WINDOWS\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [nsvcin] C:\WINDOWS\system32\n20050308.exe
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\yrikwv.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: MediaKey.lnk = C:\Program Files\MediaKey\Versato.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{003FD22B-5037-48E0-8E41-87687CA94C3B}: NameServer = 194.158.37.196,194.158.37.211
O17 - HKLM\System\CS1\Services\Tcpip\..\{003FD22B-5037-48E0-8E41-87687CA94C3B}: NameServer = 194.158.37.196,194.158.37.211
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\j2n2lc5o1f.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Full Version: DAX Error
Bube.d aka Win32.Beavis is a new infection. The only program I have found so far that removes it properly is KAV Personal 5.0 (you can get a free 30 day trial, fully functional that will remove it for you). We have found a number of AVs detect and claim to cure it but instead, they quarantine and/or delete the infected explorer.exe leaving you with no desktop.
This infection can download over 100 different malwares, but some typical entries you might see in a log look like this (and after cleaning offline, they come right back as soon as you connect to the internet)
Here is the article about the malware you have
http://www.viruslist.com/en/weblog
We are finding that some users are blocked from the KAV site due to changes in the HOSTS file. If you cannot get to the download link provided or are having trouble updating KAV, please try the following:
Download the Hoster from here: http://members.aol.com/toadbee/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.
Note: if you were using a custom Hosts file you will need to replace any of those entries yourself You must get the updates before scanning Detailed instructions for updating are below.
Go here to download the free KAV Personal 5.0 Trial (good for 30 days)
http://www.kaspersky.com/index.html
OR HERE:
http://downloads1.kaspersky-labs.com/trial..._personalen.exe
http://downloads2.kaspersky-labs.com/trial..._personalen.exe
ftp://downloads1.kaspersky-labs.com/trial..._personalen.exe
ftp://downloads3.kaspersky-labs.com/trial..._personalen.exe
Click on *downloads* on the left menu
Then scroll down and click on *trial versions*
Then choose *Kaspersky Anti-Virus Personal 5.0*
You will then have a list of the trial downloads to choose from (choose a location closest to you)
Choose *save* and it should create and save to a KAV folder on your hard drive
Navigate to the KAV folder and doubleclick on kav5.0trial_personalen.exe to install it.
You will see this screen showing the default folder it will install into. Click on *next*
If KAV detects another AV running on your PC it will advise you to uninstall it.
You can do that or you can disable the existing AV program and then press *yes* to continue.
The way to disable resident protection differs for different anti-virus programs. You might try right clicking on the icon for your AV program in the Windows System tray (on the lower right hand part of the screen) and looking at the different options.
Alternatively, you may disable your AV from starting with Windows using msconfig (Start > Run and type msconfig and OK. Click on the Startup Tab, uncheck all the startups relating to your AntiVirus and reboot).
The important thing is to set your current AV *not* to scan as your files are accessed, so that KAV can do its job
In my case, I just disabled the resident protection on EZ AV and that worked just fine without uninstalling it.
Next you will see the Kaspersky Anti-Virus Personal 5.0 Setup Wizard. It will advise you to close all other applications before starting setup. Do that and then press *Next* to continue.
You will then be presented with the License Agreement. Read that and when done you can agree to continue.
Next is the Customer Information screen. Just fill that in as you prefer and click on *next* to continue
You will be presented with some important KAV notes. I copied these and saved in Wordpad to refer back to if needed.
Please remove the green checkmark the box that says *Operate according to Recommended settings* This is so we can do a custom install.
Press *next* to continue after you have read those and unchecked the box for recommended settings
On the next screen, please uncheck the box for *use real-time protection against network attacks*
This has been known to cause problems on PCs running certain firewalls, you can try enabling it later after the initial install and scan.
You may leave the *iStreams technology* box checked if you like (I did) but it is generally recommended not to checkmark that box if you are going to uninstall KAV again after the infection has been removed.
Now it will choose the Destination folder (mine was fine as pre-selected by KAV). Click *next* to continue
Now you will get the *finish* screen
KAV will now open. If you are running a firewall, allow KAV to connect to get the updates it needs. Wait while the updates are downloaded and installed
Now get the *extended database* of updates as well, to remove the AdWare that Virus.Win32.Bube. may have downloaded. Look under *Settings*, and then *Configure Updater* Choose Extended Database. Click *OK* and then Check for Updates and you will get another smaller update which will install.
Now click on *Settings* and choose *Configure On-demand scan settings* and select *Perform recommended action* and click *OK*. You might prefer to set the scan level to maximum, just to be sure that nothing is hiding in an email database.
After clearing the HOSTS file with Hoster, if you still cannot connect to the internet to get the updates on an infected PC, follow the steps below for Manual Updating If update was successful, please proceed to the Scanning Section.
SCANNING
Close KAV and any open programs you have running.
It is recommended you run the scan in SAFE MODE
* Boot into safe mode.
How to start the computer in Safe mode (here are instructions if you need them)
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam
Once you have booted into safe mode as XP can still allow an internet connection in safe mode
Physically Disconnect from the Internet
* Open KAV but do not start the scan yet
* now and this is very important :
* Press Ctrl + ALT+DEL and bring up task manager, go to processes tab and right click on explorer.exe and then select stop process
Now your desktop will go blank and you will have no taskbar or menu etc you will still have taskmanager and KAV open on desktop so do not close them
* Now Start a full system scan. Click on the protection tab and Choose *Scan My Computer
* It will take some time probably 2 or 3 hours and will delete any infected files it finds
* KAV will disinfect all files detected as Virus.Win32.Bube and many related malware it has downloaded.
* when it has finished then on the Taskmanger press file/newtask and type explorer to regain the desktop etc.
* Close KAV &Taskmanager
* Reboot back into normal mode.
Additional cleanup may be needed. Please be sure to post in the forum if you have any questions.
IMPORTANT NOTE! This virus changes security settings your trusted zone and in the Windows Security Center. Please be sure to check all of your security settings After disinfecting.
................................
If you are asked to post a KAV log from your scan. Here's how:
Click on *View Reports*
When you go to View reports, you will see a list. You rightclick on the report *Full Scan* and a menu opens: choose *export detailed report to file* which allows you to save it :-) It defaults as a .csv file, but I found I could save as .txt. Give it a name and click *save* to save the log.
Then you can attach your report to a reply for review.
.................................
If you have lost explorer.exe
If you have lost Explorer.exe from attempted cleaning with another AV or tool, Please contact Microsoft's PCSAFETY.
This is a free service and toll-free call.
1-866-PCSAFETY
or
1-866-727-2338
This phone number is for virus and other security-related support. It is available 24 hours a day for the U.S. and Canada.
For support outside the United States and Canada, please contact your Microsoft Help and Support worldwide. Go to this page and choose your region from the box in the upper right corner:
http://support.microsoft.com/?pr=SecurityHome
Edited 21 Feb 2005: Added Hosts file replacement info
Edited 25 Feb 2005: Added Microsoft hotline to contact if explorer.exe if missing
Edited 02 Mar 2005: Added Manual Updating Instructions and Alternate download links
This infection can download over 100 different malwares, but some typical entries you might see in a log look like this (and after cleaning offline, they come right back as soon as you connect to the internet)
QUOTE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = »searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = »searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = »searchmiracle.com/sp.php
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\boln.dll
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O2 - BHO: (no name) - {2B5E7117-24E7-5914-3794-A3D089E4A773} - (no file)
O2 - BHO: (no name) - {57798B92-1E52-BB11-3BF1-51F50C193253} - (no file)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [tibs5] C:\WINNT\system32\tibs5.exe
O4 - HKLM\..\Run: [12C.tmp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12C.tmp.exe 0 10001
O4 - HKLM\..\Run: [Web Service] C:\WINNT\system32\sm.exe
O4 - HKLM\..\Run: [12C.tmp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12C.tmp.exe 0 10001
O4 - HKLM\..\Run: [version] C:\WINNT\system32\Mthnzl.exe
O4 - HKLM\..\Run: [secure] C:\WINNT\system32\Yfkadl.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [15E.tmp] C:\WINNT\TEMP\15E.tmp.exe 3 10001
O4 - HKLM\..\Run: [15E.tmp.exe] C:\WINNT\TEMP\15E.tmp.exe 3 10001
O4 - HKLM\..\Run: [4.tmp] C:\WINNT\TEMP\4.tmp.exe 0 10001
O4 - HKLM\..\Run: [4.tmp.exe] C:\WINNT\TEMP\4.tmp.exe 0 10001
O4 - HKLM\..\Run: [rE4W37i] jdbtil.exe
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvayb32.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINDOWS\System32\wnim.dll
O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINDOWS\System32\wnim.dll
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = »searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = »searchmiracle.com/sp.php
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\boln.dll
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O2 - BHO: (no name) - {2B5E7117-24E7-5914-3794-A3D089E4A773} - (no file)
O2 - BHO: (no name) - {57798B92-1E52-BB11-3BF1-51F50C193253} - (no file)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [tibs5] C:\WINNT\system32\tibs5.exe
O4 - HKLM\..\Run: [12C.tmp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12C.tmp.exe 0 10001
O4 - HKLM\..\Run: [Web Service] C:\WINNT\system32\sm.exe
O4 - HKLM\..\Run: [12C.tmp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12C.tmp.exe 0 10001
O4 - HKLM\..\Run: [version] C:\WINNT\system32\Mthnzl.exe
O4 - HKLM\..\Run: [secure] C:\WINNT\system32\Yfkadl.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [15E.tmp] C:\WINNT\TEMP\15E.tmp.exe 3 10001
O4 - HKLM\..\Run: [15E.tmp.exe] C:\WINNT\TEMP\15E.tmp.exe 3 10001
O4 - HKLM\..\Run: [4.tmp] C:\WINNT\TEMP\4.tmp.exe 0 10001
O4 - HKLM\..\Run: [4.tmp.exe] C:\WINNT\TEMP\4.tmp.exe 0 10001
O4 - HKLM\..\Run: [rE4W37i] jdbtil.exe
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvayb32.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINDOWS\System32\wnim.dll
O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINDOWS\System32\wnim.dll
Here is the article about the malware you have
http://www.viruslist.com/en/weblog
QUOTE
The file infecting AdWare saga continues
Roel February 10, 2005 | 15:28 MSK
comment
We are currently seeing an increase in cases which involve file infecting AdWare.
These new viruses are more sophisticated than the one we previously reported and append malicious code to Windows' explorer.exe. The viruses belong to the Virus.Win32.Bube family.
For example, Virus.Win32.Bube.d downloads AdWare and Trojans, including: AdWare.ISearch.d, Trojan-Clicker.Win32.Agent.bn, Trojan.Win32.LowZones.ai and PornWare.Dialer.Salc.
Disinfection in this case is tricky, as explorer.exe is an important Windows process. Additionally, the malware tries to prevent removal by disabling system restore, infecting the explorer.exe residing in %sysdir%\dllcache and lowering overall system security.
Things can get extra complicated as an AV can block access to the infected explorer.exe.
Roel February 10, 2005 | 15:28 MSK
comment
We are currently seeing an increase in cases which involve file infecting AdWare.
These new viruses are more sophisticated than the one we previously reported and append malicious code to Windows' explorer.exe. The viruses belong to the Virus.Win32.Bube family.
For example, Virus.Win32.Bube.d downloads AdWare and Trojans, including: AdWare.ISearch.d, Trojan-Clicker.Win32.Agent.bn, Trojan.Win32.LowZones.ai and PornWare.Dialer.Salc.
Disinfection in this case is tricky, as explorer.exe is an important Windows process. Additionally, the malware tries to prevent removal by disabling system restore, infecting the explorer.exe residing in %sysdir%\dllcache and lowering overall system security.
Things can get extra complicated as an AV can block access to the infected explorer.exe.
We are finding that some users are blocked from the KAV site due to changes in the HOSTS file. If you cannot get to the download link provided or are having trouble updating KAV, please try the following:
Download the Hoster from here: http://members.aol.com/toadbee/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.
Note: if you were using a custom Hosts file you will need to replace any of those entries yourself You must get the updates before scanning Detailed instructions for updating are below.
Go here to download the free KAV Personal 5.0 Trial (good for 30 days)
http://www.kaspersky.com/index.html
OR HERE:
http://downloads1.kaspersky-labs.com/trial..._personalen.exe
http://downloads2.kaspersky-labs.com/trial..._personalen.exe
ftp://downloads1.kaspersky-labs.com/trial..._personalen.exe
ftp://downloads3.kaspersky-labs.com/trial..._personalen.exe
Click on *downloads* on the left menu
Then scroll down and click on *trial versions*
Then choose *Kaspersky Anti-Virus Personal 5.0*
You will then have a list of the trial downloads to choose from (choose a location closest to you)
Choose *save* and it should create and save to a KAV folder on your hard drive
Navigate to the KAV folder and doubleclick on kav5.0trial_personalen.exe to install it.
You will see this screen showing the default folder it will install into. Click on *next*
If KAV detects another AV running on your PC it will advise you to uninstall it.
You can do that or you can disable the existing AV program and then press *yes* to continue.
The way to disable resident protection differs for different anti-virus programs. You might try right clicking on the icon for your AV program in the Windows System tray (on the lower right hand part of the screen) and looking at the different options.
Alternatively, you may disable your AV from starting with Windows using msconfig (Start > Run and type msconfig and OK. Click on the Startup Tab, uncheck all the startups relating to your AntiVirus and reboot).
The important thing is to set your current AV *not* to scan as your files are accessed, so that KAV can do its job
In my case, I just disabled the resident protection on EZ AV and that worked just fine without uninstalling it.
Next you will see the Kaspersky Anti-Virus Personal 5.0 Setup Wizard. It will advise you to close all other applications before starting setup. Do that and then press *Next* to continue.
You will then be presented with the License Agreement. Read that and when done you can agree to continue.
Next is the Customer Information screen. Just fill that in as you prefer and click on *next* to continue
You will be presented with some important KAV notes. I copied these and saved in Wordpad to refer back to if needed.
Please remove the green checkmark the box that says *Operate according to Recommended settings* This is so we can do a custom install.
Press *next* to continue after you have read those and unchecked the box for recommended settings
On the next screen, please uncheck the box for *use real-time protection against network attacks*
This has been known to cause problems on PCs running certain firewalls, you can try enabling it later after the initial install and scan.
You may leave the *iStreams technology* box checked if you like (I did) but it is generally recommended not to checkmark that box if you are going to uninstall KAV again after the infection has been removed.
Now it will choose the Destination folder (mine was fine as pre-selected by KAV). Click *next* to continue
Now you will get the *finish* screen
KAV will now open. If you are running a firewall, allow KAV to connect to get the updates it needs. Wait while the updates are downloaded and installed
Now get the *extended database* of updates as well, to remove the AdWare that Virus.Win32.Bube. may have downloaded. Look under *Settings*, and then *Configure Updater* Choose Extended Database. Click *OK* and then Check for Updates and you will get another smaller update which will install.
Now click on *Settings* and choose *Configure On-demand scan settings* and select *Perform recommended action* and click *OK*. You might prefer to set the scan level to maximum, just to be sure that nothing is hiding in an email database.
After clearing the HOSTS file with Hoster, if you still cannot connect to the internet to get the updates on an infected PC, follow the steps below for Manual Updating If update was successful, please proceed to the Scanning Section.
QUOTE
Manually Updating
You will need access to another computer. If you don't have one, perhaps a friend can help, ask your boss if you can use a work computer, go to a Kinkos or the public library.
Go here http://www.kaspersky.com/avupdates
Download the complete update... a 4.9MB zip. Choose *Complete update* (cumul.zip)
Go back into kaspersky and click Update Now you should see the files load in really fast and it will update.
A simpler method which worked for me...(EDIT: I did this with KAV running. It might be safer to exit KAV while manually updating with this method so none of the files are in use when you overwrite.)
save the zip to your desktop. I unzipped to the default Winzip location c\unzipped. Navigate to that folder and open the file. Click edit/select all. On the left hand side click Copy or move selected items. Copy or move the items here: C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases and copy or move the new database. You will get a window that says a file already exists. Do you wish to overwrite? Click yes to all and you have the latest definitions.:)
On reboot you may or may not get an error message saying your database is corrupt and to reinstall the program. Ignore it. You are good and when you are able to auto-update, it will correct itself.
You will need access to another computer. If you don't have one, perhaps a friend can help, ask your boss if you can use a work computer, go to a Kinkos or the public library.
Go here http://www.kaspersky.com/avupdates
Download the complete update... a 4.9MB zip. Choose *Complete update* (cumul.zip)
Go back into kaspersky and click Update Now you should see the files load in really fast and it will update.
A simpler method which worked for me...(EDIT: I did this with KAV running. It might be safer to exit KAV while manually updating with this method so none of the files are in use when you overwrite.)
save the zip to your desktop. I unzipped to the default Winzip location c\unzipped. Navigate to that folder and open the file. Click edit/select all. On the left hand side click Copy or move selected items. Copy or move the items here: C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases and copy or move the new database. You will get a window that says a file already exists. Do you wish to overwrite? Click yes to all and you have the latest definitions.:)
On reboot you may or may not get an error message saying your database is corrupt and to reinstall the program. Ignore it. You are good and when you are able to auto-update, it will correct itself.
SCANNING
Close KAV and any open programs you have running.
It is recommended you run the scan in SAFE MODE
* Boot into safe mode.
How to start the computer in Safe mode (here are instructions if you need them)
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam
Once you have booted into safe mode as XP can still allow an internet connection in safe mode
Physically Disconnect from the Internet
* Open KAV but do not start the scan yet
* now and this is very important :
* Press Ctrl + ALT+DEL and bring up task manager, go to processes tab and right click on explorer.exe and then select stop process
Now your desktop will go blank and you will have no taskbar or menu etc you will still have taskmanager and KAV open on desktop so do not close them
* Now Start a full system scan. Click on the protection tab and Choose *Scan My Computer
* It will take some time probably 2 or 3 hours and will delete any infected files it finds
* KAV will disinfect all files detected as Virus.Win32.Bube and many related malware it has downloaded.
* when it has finished then on the Taskmanger press file/newtask and type explorer to regain the desktop etc.
* Close KAV &Taskmanager
* Reboot back into normal mode.
Additional cleanup may be needed. Please be sure to post in the forum if you have any questions.
IMPORTANT NOTE! This virus changes security settings your trusted zone and in the Windows Security Center. Please be sure to check all of your security settings After disinfecting.
................................
If you are asked to post a KAV log from your scan. Here's how:
Click on *View Reports*
When you go to View reports, you will see a list. You rightclick on the report *Full Scan* and a menu opens: choose *export detailed report to file* which allows you to save it :-) It defaults as a .csv file, but I found I could save as .txt. Give it a name and click *save* to save the log.
Then you can attach your report to a reply for review.
.................................
If you have lost explorer.exe
If you have lost Explorer.exe from attempted cleaning with another AV or tool, Please contact Microsoft's PCSAFETY.
This is a free service and toll-free call.
1-866-PCSAFETY
or
1-866-727-2338
This phone number is for virus and other security-related support. It is available 24 hours a day for the U.S. and Canada.
For support outside the United States and Canada, please contact your Microsoft Help and Support worldwide. Go to this page and choose your region from the box in the upper right corner:
http://support.microsoft.com/?pr=SecurityHome
Edited 21 Feb 2005: Added Hosts file replacement info
Edited 25 Feb 2005: Added Microsoft hotline to contact if explorer.exe if missing
Edited 02 Mar 2005: Added Manual Updating Instructions and Alternate download links
Hello again,
I did everything you sai but I had problems with the Internet connection. Everything associated with modem, was functioning well but neither email, nor browser nor msn could log on internet cause it said that there is no internet connection. On startup I had this new error:
"Error loading E6F1873B.dll
The specified module could not be found"
Probably this important file was deleted during scanning.
Then I restored the system file but obviously I have that DAX error again.
:-(
I did everything you sai but I had problems with the Internet connection. Everything associated with modem, was functioning well but neither email, nor browser nor msn could log on internet cause it said that there is no internet connection. On startup I had this new error:
"Error loading E6F1873B.dll
The specified module could not be found"
Probably this important file was deleted during scanning.
Then I restored the system file but obviously I have that DAX error again.
:-(
Since this exploit is extremely invasive and can leave lasting effects, at this point yuo are best suited by reformatting your hard drive and re-installing WIndows and your remaining software. Be sure to back up any necessary data files.
Thanks for your time.
NOTE: This thread is now closed. Should you need it reopened, please PM an administrator or moderator.
Everyone else having a similar issue, please launch a new topic for yourselves.
Everyone else having a similar issue, please launch a new topic for yourselves.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.