Member Avatar for TJ25

Hello,

I'm not really sure what I am doing, but I know I need HELP!!!! Here is my hijacker log

Logfile of HijackThis v1.97.7
Scan saved at 11:04:39 AM, on 6/18/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\IEAI.EXE
C:\WINDOWS\ATLQK.EXE
C:\WINDOWS\SYSTEM\IPLZ.EXE
C:\WINDOWS\SYSCO.EXE
C:\WINDOWS\SDKRH32.EXE
C:\WINDOWS\D3HW32.EXE
C:\WINDOWS\SYSTEM\MSZD32.EXE
C:\WINDOWS\SYSTEM\NTCY.EXE
C:\WINDOWS\WINLA.EXE
C:\WINDOWS\SYSTEM\SDKXD32.EXE
C:\WINDOWS\SYSTEM\NTTK.EXE
C:\WINDOWS\SYSTEM\SDKGH32.EXE
C:\WINDOWS\SYSTEM\WINRY32.EXE
C:\WINDOWS\SYSTEM\APPXO32.EXE
C:\WINDOWS\SYSTEM\D3BF32.EXE
C:\WINDOWS\MSYS.EXE
C:\WINDOWS\SYSTEM\SYSHN32.EXE
C:\WINDOWS\SYSTEM\IPJQ32.EXE
C:\WINDOWS\D3XU32.EXE
C:\WINDOWS\SYSTEM\CRRY.EXE
C:\WINDOWS\SYSTEM\IPNE.EXE
C:\WINDOWS\SYSTEM\JAVAPT32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\IEAT.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\NTTK.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\CRGX32.EXE
C:\PROGRAM FILES\DR_S\DR_S.EXE
C:\WINDOWS\SYSTEM\WINRY32.EXE
C:\WINDOWS\IPGO.EXE
C:\WINDOWS\IPGO.EXE
C:\WINDOWS\SYSTEM\ATLZM.EXE
C:\WINDOWS\WINLA.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\D3BF32.EXE
C:\WINDOWS\D3XU32.EXE
C:\WINDOWS\SYSTEM\D3BF32.EXE
C:\WINDOWS\WINLA.EXE
C:\WINDOWS\SYSTEM\IEAI.EXE
C:\WINDOWS\SYSTEM\IEAI.EXE
C:\WINDOWS\SYSTEM\NTTK.EXE
C:\WINDOWS\SYSTEM\CRRY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\D3BF32.EXE
C:\WINDOWS\SYSTEM\IEAI.EXE
C:\WINDOWS\SYSTEM\SDKXD32.EXE
C:\WINDOWS\SYSTEM\D3BF32.EXE
C:\WINDOWS\D3XU32.EXE
C:\WINDOWS\WINLA.EXE
C:\WINDOWS\SYSTEM\D3BF32.EXE
C:\WINDOWS\SYSTEM\NTCY.EXE
C:\WINDOWS\SYSTEM\WINRY32.EXE
C:\WINDOWS\SYSTEM\SDKXD32.EXE
C:\WINDOWS\SYSTEM\JAVAPT32.EXE
C:\WINDOWS\WINLA.EXE
C:\WINDOWS\WINLA.EXE
C:\WINDOWS\SYSTEM\IPJQ32.EXE
C:\WINDOWS\D3XU32.EXE
C:\WINDOWS\SYSTEM\NTTK.EXE
C:\WINDOWS\SYSTEM\NTTK.EXE
C:\WINDOWS\IPGO.EXE
C:\WINDOWS\SYSTEM\SDKXD32.EXE
C:\WINDOWS\SYSTEM\WINRY32.EXE
C:\WINDOWS\D3XU32.EXE
C:\WINDOWS\CRGX32.EXE
C:\WINDOWS\SDKRH32.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.yahoo.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.yahoo.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ynvdc.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://ynvdc.dll/index.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = NOT USED (OK)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://ynvdc.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ynvdc.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://ynvdc.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ynvdc.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = www.yahoo.ca
O2 - BHO: (no name) - {BD0BA5CD-7C8E-47ED-935E-1ABBAC9B29E0} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - (no file)
O2 - BHO: (no name) - {77E69D80-242D-AC8A-1B03-B1DD62569CE4} - C:\WINDOWS\SYSTEM\NTPR32.DLL
O2 - BHO: (no name) - {EFF80427-F837-4B74-8834-BAF18E0553FD} - (no file)
O2 - BHO: GuardWall - {D2F719F3-106A-402B-9996-3A5B12ACA564} - (no file)
O2 - BHO: Popup Blocker Pro - {A44B961C-8C36-470f-8555-EDA0EFC1E710} - (no file)
O2 - BHO: Core Library - {D4D505DF-D582-400c-91B6-84921012AFE3} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1629.0\EN-US\MSNTB.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IEAT.EXE] C:\WINDOWS\IEAT.EXE
O4 - HKLM\..\Run: [Popup Defence Updater] regsvr32 /s C:\WINDOWS\SYSTEM\PDFUPD.DLL
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMANTEC\LIVEUP~1\SNDMON.EXE
O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r
O4 - HKLM\..\RunServices: [12Ghosts TrayProtect] C:\PROGRAM FILES\12GHOSTS\12srvc.exe
O4 - HKLM\..\RunServices: [IPLZ.EXE] C:\WINDOWS\SYSTEM\IPLZ.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ATLQK.EXE] C:\WINDOWS\ATLQK.EXE
O4 - HKLM\..\RunServices: [SYSCO.EXE] C:\WINDOWS\SYSCO.EXE
O4 - HKLM\..\RunServices: [SDKRH32.EXE] C:\WINDOWS\SDKRH32.EXE
O4 - HKLM\..\RunServices: [IEAI.EXE] C:\WINDOWS\SYSTEM\IEAI.EXE
O4 - HKLM\..\RunServices: [D3HW32.EXE] C:\WINDOWS\D3HW32.EXE
O4 - HKLM\..\RunServices: [MSZD32.EXE] C:\WINDOWS\SYSTEM\MSZD32.EXE
O4 - HKLM\..\RunServices: [WINLA.EXE] C:\WINDOWS\WINLA.EXE
O4 - HKLM\..\RunServices: [NTCY.EXE] C:\WINDOWS\SYSTEM\NTCY.EXE
O4 - HKLM\..\RunServices: [NTTK.EXE] C:\WINDOWS\SYSTEM\NTTK.EXE
O4 - HKLM\..\RunServices: [SDKGH32.EXE] C:\WINDOWS\SYSTEM\SDKGH32.EXE
O4 - HKLM\..\RunServices: [SDKXD32.EXE] C:\WINDOWS\SYSTEM\SDKXD32.EXE
O4 - HKLM\..\RunServices: [WINRY32.EXE] C:\WINDOWS\SYSTEM\WINRY32.EXE
O4 - HKLM\..\RunServices: [MSYS.EXE] C:\WINDOWS\MSYS.EXE
O4 - HKLM\..\RunServices: [D3BF32.EXE] C:\WINDOWS\SYSTEM\D3BF32.EXE
O4 - HKLM\..\RunServices: [APPXO32.EXE] C:\WINDOWS\SYSTEM\APPXO32.EXE
O4 - HKLM\..\RunServices: [IPJQ32.EXE] C:\WINDOWS\SYSTEM\IPJQ32.EXE
O4 - HKLM\..\RunServices: [SYSHN32.EXE] C:\WINDOWS\SYSTEM\SYSHN32.EXE
O4 - HKLM\..\RunServices: [D3XU32.EXE] C:\WINDOWS\D3XU32.EXE
O4 - HKLM\..\RunServices: [CRRY.EXE] C:\WINDOWS\SYSTEM\CRRY.EXE
O4 - HKLM\..\RunServices: [IPNE.EXE] C:\WINDOWS\SYSTEM\IPNE.EXE
O4 - HKLM\..\RunServices: [JAVAPT32.EXE] C:\WINDOWS\SYSTEM\JAVAPT32.EXE
O4 - HKLM\..\RunServices: [CRGX32.EXE] C:\WINDOWS\CRGX32.EXE
O4 - HKLM\..\RunServices: [IPGO.EXE] C:\WINDOWS\IPGO.EXE
O4 - HKLM\..\RunServices: [ATLZM.EXE] C:\WINDOWS\SYSTEM\ATLZM.EXE
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers Hi-Speed Internet\RHSI SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: 12Ghosts Clip.lnk = C:\Program Files\12Ghosts\12clip.exe
O4 - Startup: 12Ghosts Startup.lnk = C:\Program Files\DR_S\DR_S.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: @C:\PROGRAM FILES\FAILSAFE\GUARDIE\PNIE.DLL,-100 (HKLM)
O9 - Extra 'Tools' menuitem: @C:\PROGRAM FILES\FAILSAFE\GUARDIE\PNIE.DLL,-100 (HKLM)
O9 - Extra button: Popup Slapdown Options (HKLM)
O9 - Extra button: Bug Swatter Options (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Yahoo! Euchre -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {94F5DCB7-816C-4B94-A2C1-856C6E323C5B} -

PLEASE HELP

  • 4 Contributors
  • 3 Replies
  • 212 Views
  • 6 Years Discussion Span
  • Latest Post Latest Post by dspnhn

Dani AI

Generated

This is a classic Internet Explorer DLL‑based homepage hijack: the browser is being pointed to an HTML resource embedded inside a malicious DLL (the “res://…dll” pattern), and the long list of oddly‑named EXEs / RunServices entries shows the infection has installed persistent autostarts. Repeated “missing module” startup popups (the winry32 complaint reported later in the thread) commonly mean the file was removed but its Run/RunServices registry entry was left behind. (kb.cert.org)

Because the machine is Windows 98 SE, many modern on‑demand cleaners won’t run; current adware tools often require Windows 7 or later. The safest modern workflow is to work from a clean system: create bootable rescue media and scan the infected disk offline, and use a startup‑inspection tool that lists BHOs and Run keys so entries can be disabled before files are deleted. Use a rescue ISO/USB to prevent the malware from blocking cleaning, and use Autoruns (Sysinternals) to identify and disable suspect autostarts; on Win9x use Scanreg to make a registry backup before editing. (help.malwarebytes.com)

A practical, low‑risk sequence that matches the thread’s evidence: (1) boot into Safe Mode/command prompt; (2) create a registry backup (Scanreg) and an image of the disk; (3) run Autoruns from removable media and uncheck or delete suspicious Run/BHO/Toolbar entries; (4) with autostarts disabled, remove the malicious DLL(s) from the Windows folder; (5) boot a rescue environment and run a full offline scan to quarantine leftover items; (6) reboot and re‑scan to confirm. If a startup error persists it’s usually a leftover Run key and can be removed after the backup. (learn.microsoft.com)

In context: ’s advice to use online scanners and a hijacker remover and ’s ComboFix suggestion were standard in 2004, but many of those tools are obsolete now. For an unsupported OS like Windows 98 (support ended in 2006) the long‑term, safest choice is to image important data and migrate to a supported OS; when cleanup is uncertain, a clean reinstall is the most reliable fix. (microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for crunchie

:eek: Go here for an on-line scan & set it to autoclean for you.
Go here for an on-line scan & set it to autoclean for you.

Just try CWShredder too plz.

Download CWShredder from & run it. Select the fix button & it will get rid of everything related to CoolWebSearch that is stored in it's database. Close ALL windows, including IE, before running CWShredder. Reboot.

To help prevent this from happening again, install the patches for the vulnerabilities that this hijacker exploits by going here for your critical updates.

Reboot after doing this & post another log please.

Member Avatar for moseti

a message appears when I start my computer saying: "there was a problem starting winry32 the specified module could not be found" as much as it disturbs me I do not know why it appears and how should I remove it

Member Avatar for dspnhn

u might wanna try combofix....use it from some other drive (pen,falsh whatever) and follow the instructions. donot worry about the messages just keep going forward....this is what i call the mother of all fixes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.