please help me with Incredifind

Question

HeidiGiller 0 Junior Poster in Training

22 Years Ago

My computer just started running slow a few months ago and now the browser keeps getting hijacked. I believe it started right after my husband tried to download Napster or something similar. Here is my HijackThis! Log. Can someone please help me figure out what to delete? I know there is a lot of junk on my registry and i'd like to clear it up, and stop the pop ups! I have run AdAware and SpyBot, but they can't get rid of some things. Thanks in advance for any help!

Logfile of HijackThis v1.97.7
Scan saved at 2:51:29 PM, on 4/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\WINDOWS\slrundll.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HiJack This!\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
N2 - Netscape 6: user_pref("browser.startup.homepage", "allaboutsearching.com");\nuser_pref("browser.startup.page", 1); (C:\Documents and Settings\Heidi\Application Data\Mozilla\Profiles\default\1q0xg24x.slt\)
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Heidi\Application Data\Mozilla\Profiles\default\1q0xg24x.slt\)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Forget Me Not.lnk = ?
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF7E120A-C1B0-4BD2-8EB3-F08D0A0C196B}: NameServer =

microsoft:windows-nt-2000-xp virus-malware

3 Contributors
16 Replies
305 Views
6 Days Discussion Span
Latest Post 22 Years Ago Latest Post by crunchie

Dani AI

Generated 9 Months Ago

This thread shows a classic Look2Me / VX2 (aka “BetterInternet”) household infection: the VX2 finder output and the repeated browser‑hijack symptoms match a Look2Me family adware that drops random‑named DLLs into System32, adds a guardian/Winlogon hook and a registry “user‑agent” marker so it can persist. (bleepingcomputer.com)

A key point missed in some replies is why the machine began crashing after you used an aggressive removal tool. Look2Me variants install components that run inside privileged subsystems (Winlogon/LSA) — removing their DLLs or their registry notification packages without restoring proper ACLs or the expected registry structure can break the Local Security Authority (lsass.exe) and force system restarts. That is why edits to Winlogon/LSA entries must be done carefully or performed offline (rescue media). (vdoc.pub)

A safer recovery plan (ordered, concise): stop further online activity and unplug the PC; try booting to Last Known Good or Safe Mode to get a stable desktop; if the system will not stay stable, create and boot from rescue media (Microsoft Defender Offline or a vendor rescue ISO such as Kaspersky/Bitdefender/ESET) from a clean machine and run full offline scans to remove the active components; after malware removal run System File Checker (sfc /scannow) or an in‑place repair to restore any damaged system files; finally, with infection confirmed gone, re‑enable System Restore and create a fresh restore point. Each of those steps is documented by vendors and security responders — rescue ISOs for offline cleanups and Microsoft’s SFC/System Restore guidance are the right references. (learn.microsoft.com)

Two practical cautions: do not rerun registry/“kill” tools while the system is online and connected — that can trigger immediate re‑download or trigger crashes; and when you clean the machine, check browser start pages, search assistant entries and DNS (O17) entries and reset them only after you are offline and certain the infection is removed. If recovery proves unreliable, image (backup) user data, then plan a clean OS reinstall — that is often the fastest route to a trustworthy result. (bleepingcomputer.com)

Acknowledgements: and offered the correct detection tools and the important System Restore warning; the missing piece here is an offline, rescue‑media first approach and careful restoration of Winlogon/LSA state before reattaching to the network.

All 16 Replies

crunchie 990 Most Valuable Poster

22 Years Ago

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)

O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -

That's all.

crunchie 990 Most Valuable Poster

22 Years Ago

Can you download the following app & run it, making sure to have one internet exploder window open. Save the log & paste the results back here.

crunchie 990 Most Valuable Poster

22 Years Ago

Hmm. Please do the following:

Next, type javascript:navigator.userAgent or just copy and paste it in your IE Address bar then hit enter.

Post the complete result.

Download Killbox from
Unzip to your desktop.
Run Killbox.exe. From the menu click “Fix L2M then click “Kill VX2.BetterInternet"

Restart your system

Post the complete result again.

And post a new fresh log of HijackThis.

crunchie 990 Most Valuable Poster

22 Years Ago

Use the Killbox that you've download the other day.
Run Killbox.exe.
From the menu click “Fix L2M then click “Import L2M.reg.
Click OK when you asked to “Import Registry Script?
Then from the menu again, click “Find. Click “User Agent String.
Select the entry {25641DC8-6046-461E-993B-D7C4706A767E} then click “Action.
Click “Delete User Agent String. Close Killbox.

Please run VX2finder again after a reboot & post the log it creates.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

HeidiGiller 0 Junior Poster in Training · Answer 1 · 2004-04-30T03:10:48+00:00

Thanks for your advice, it is greatly appreciated! Got any about VX2.BetterInternet?

HeidiGiller 0 Junior Poster in Training · Answer 2 · 2004-05-01T01:03:14+00:00

Here is the log from the vx2finder. Thanks so much!Log for VX2.BetterInternet File Finder

Files Found---
C:\WINDOWS\System32\6yo4svc.cpy.dll
C:\WINDOWS\System32\6yo4svc.dll

Guardian Key---
Asynchronous 000
DllName C:\WINDOWS\system32\6yo4svc.dll
Impersonate 000
Logon WinLogon
Version 122
ID {25641DC8-6046-461E-993B-D7C4706A767E}
IDex CS2

User Agent String---
{25641DC8-6046-461E-993B-D7C4706A767E}

HeidiGiller 0 Junior Poster in Training · Answer 3 · 2004-05-02T03:02:39+00:00

Hmm. Please do the following:
Next, type javascript:navigator.userAgent or just copy and paste it in your IE Address bar then hit enter.
Post the complete result.

OK. Here is the results for that.

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {25641DC8-6046-461E-993B-D7C4706A767E}; MSN 8.0; MSN 8.5; MSNbBBYZ; MSNmen-us; MSNcIA)

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2004-05-02T10:57:39+00:00

Please ignore my last post for now & do this instead:

Download the VX2 fix
You must run it three times in a row to completely remove the files registry keys.

Once done run the VX2finder again & post the log here along with a fresh hijackthis log.

HeidiGiller 0 Junior Poster in Training · Answer 5 · 2004-05-03T02:23:42+00:00

Ok. I downloaded and ran the Killbox thing.I started to do what you'd suggested, but an error occured and now everytime any time I try go online (MSN) an error occurs and the computer restarts. When it restarts it says that there was an exception in the LSA shell something or other and when I try go online again it does the same thing. It says that Windows encountered an error with NT/Authority/something and will now restart. Something to do with lsass.exe. I cannot go online to download anything to fix this. I had to go to the public library to post this right now. And my husband is fuming becausse I "broke" the computer. Please help. Thanks for everything so far! It's appreciated.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2004-05-03T15:40:47+00:00

crunchie 990 Most Valuable Poster

22 Years Ago

Can you clarify which one you used. The Killbox or VX2 Fix?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 7 · 2004-05-03T16:46:16+00:00

Do a system restore to a time B4 you attempted the repair. Don't forget to let me know which App you used that gave the problems.

HeidiGiller 0 Junior Poster in Training · Answer 8 · 2004-05-04T00:38:09+00:00

It was Killbox. But I may have clicked on something (on Killbox) that I shouldn't have. I wasn't sure what to do with it once I ran it (Killbox) and I clicked a few things, (it may have been "delete user agent string") then I went to go back online to see what further suggestions you'd had and that's when I got the error. My husband also suggested to do a system repair from previous. I just hope we have a restore point that's before he ever even thought about Napster. Then I can just go back to normal and not be the blame for all this anymore! :o) Anyway, wish me luck! And thanks sooooooooooooooo much for all of your time and suggestions! I'll letcha know how it turns out. (As soon as I can!)

HeidiGiller 0 Junior Poster in Training · Answer 9 · 2004-05-04T07:39:42+00:00

OK. Hubby did a system restore. Internet was working (still had pop ups), So I decided to run SpyBot again and see if any spyware was still lurking. Well it found a few things. I deleted the things in red and then had the same lsass.exe problem again. So I did system restore again, and now I'm here. Can you take a look at my current HiJackThis! log and tell me what you think? Thanks again!!!!!!!!!!

Logfile of HijackThis v1.97.7
Scan saved at 6:40:26 PM, on 5/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\WINDOWS\slrundll.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\30431_up.exe
C:\WINDOWS\system32\30431_up.exe
C:\Program Files\HiJack This!\HijackThis.exe
C:\WINDOWS\system32\30431_up.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ramgo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.ramgo.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ramgo.com/search.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe
N2 - Netscape 6: user_pref("browser.startup.homepage", ""); (C:\Documents and Settings\Heidi\Application Data\Mozilla\Profiles\default\1q0xg24x.slt\)
N2 - Netscape 6: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Heidi\Application Data\Mozilla\Profiles\default\1q0xg24x.slt\)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Forget Me Not.lnk = ?
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF7E120A-C1B0-4BD2-8EB3-F08D0A0C196B}: NameServer =

caperjack 875 I hate 20 Questions Team Colleague · Answer 10 · 2004-05-04T15:58:15+00:00

so the virus came back after asystem restor then i think you will need to disable system restore to get rid of the virus,or else it will return everytime you do a restore .

To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives" as shown in this illustration:
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Proceed with what you need to do; for example, virus removal. When you have finished, restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.

caperjack 875 I hate 20 Questions Team Colleague · Answer 11 · 2004-05-04T16:01:08+00:00

Have Hijack This fix the following by placing a check in the appropriate boxes

and selecting fix checked. Make sure all browser and all Windows Explorer

windows are closed before fixing.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = .

ramgo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://

www.ramgo.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http

://www.ramgo.com/search.html

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe

O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe

Now reboot into safe mode and delete the following file.

C:\WINDOWS\avserve2.exe >>>> delete file

to delete the above files and folder you will need to do the following
go to Show hidden files

& folders

"Fix Checked"...Reboot to SAFE mode to delete files

How to start computer in safe mode

reboot computer and post a new log

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 12 · 2004-05-04T17:31:16+00:00

If you want to attempt the VX2Finder again, let me know, only you must follow the instructions exactly. (as I am sure you are now aware) You will still have look2me on your comp.

please help me with Incredifind

Dani AI

Recommended Answers Collapse Answers

All 16 Replies

Recommended Answers