This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

log below for testaplus spyware problem ...

101 min read

This thread's last reply is from April 15, 2006, 3:27 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Linkmaster
February 27, 2006, 3:06 PM UTC
No the default should be fine !!

I am consulting one of our Experts. I will return !!
ccinmfd
February 27, 2006, 3:12 PM UTC
I admire your patience!! Looking forward to your next reply ... ccinmfd
Linkmaster
February 27, 2006, 4:34 PM UTC
Download VX2Finder© by Option^Explicit to your desktop
Run VX2Finder
Double-click on VX2Finder.exe

Click "Restore Policy"

In the File menu click "Exit"

In the File menu click "Exit"

Reboot the PC after

Open the import folder and run importbat.vbs again. Post logit.txt
Linkmaster
February 27, 2006, 11:19 PM UTC
Just a note :

Disable Spyware Guard and AOL Spyware Protection then run the VX2 Tool
ccinmfd
February 28, 2006, 4:34 AM UTC
OK ... but first, how do you disable a program without uninstalling it?
Linkmaster
February 28, 2006, 12:58 PM UTC
Spyware Guard

Right click the running icon, by your clock, of Spywareguard, it will open the program.
Click Menu, File, Exit, and confirm the programs close

AOL Spyware Protection

If there is an icon for this by the clock, right click it and select stop or disable if available.
ccinmfd
March 1, 2006, 4:28 PM UTC
Wed 03/01/2006 11:12:00.81
Deleting {62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}

Error: Access is denied.
....
Deleting {6537283D-964A-CBD4-C67B-7091E7AC8979}

Error: Access is denied.
....
Deleting {EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}

Error: Access is denied.
....
Linkmaster
March 1, 2006, 5:47 PM UTC
OK we are going to try again :

Let's try to get the perms on those keys and see what is going on.

Download RegDACL to your Desktop
http://www.heysoft.de/nt/reg/doc/RegDACLE.zip
Unzip it into the Import folder on your Desktop.

Copy/paste the following text into a new Notepad document. Make sure that wordwrap is turned off.

@echo off
If Exist regperms.txt del regperms.txt

For %%i in ("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}") Do regdacl %%i /l >>perms.txt & regdacl %%i /E >>regperms.txt

Notepad regperms.txt


Save it in the new Import folder on your desktop as readperm.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: readperm.bat

Open the Import folder on your Desktop. Double click readperm.bat. Notepad will open with regperms.txt. Post the content please.
ccinmfd
March 2, 2006, 3:22 AM UTC
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer:
Read BUILTIN\Users
QWCEN-DS-- BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects:
Q--E---S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}:
Q------S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}:
Q------S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}:
Q------S-- Everyone
ccinmfd
March 2, 2006, 3:25 AM UTC
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW QWCEN-DS-- BUILTIN\Power Users
(ID-IO) ALLOW QWCEN-DS-- BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects:
($07) DENY ----N----- Everyone
($07) ALLOW Q--E---S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}:
($07) DENY ----N----- Everyone
($07) ALLOW Q------S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}:
($07) DENY ----N----- Everyone
($07) ALLOW Q------S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}:
($07) DENY ----N----- Everyone
($07) ALLOW Q------S-- Everyone
Linkmaster
March 2, 2006, 5:06 PM UTC
I appreciate your patience with this !!

Here we go :

There is indeed something wrong with the permissions on the keys. We are going to create a system access now.

Copy/paste the following text into a new Notepad document. Make sure that wordwrap is turned off.

@echo off
if exist regperms.txt del regperms.txt
if exist perms.txt del perms.txt

regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /sgs:F(ci) >> regperms.txt

For %%i in ("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}") Do regdacl %%i /L /E >> regperms.txt

Notepad regperms.txt


Save it in the new Import folder on your desktop as setperm.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: setperm.bat

Open the Import folder on your Desktop. Double click setperm.bat. Notepad will open with regperms.txt. Post the content please
ccinmfd
March 3, 2006, 12:43 PM UTC
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Setting F(CI) permissions for predefined group "System"
- adding new entry


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects:
($07) DENY ----N----- Everyone
($07) ALLOW Q--E---S-- Everyone
(CI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW QWCEN-DS-- BUILTIN\Power Users
(ID-IO) ALLOW QWCEN-DS-- BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Full access SYSTEMAX\carrollc
(ID-IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects:
Q--E---S-- Everyone
QWCE-LDSAO NT AUTHORITY\SYSTEM
Q--E---S-- BUILTIN\Users
QWCE--DS-- BUILTIN\Power Users
QWCE-LDSAO BUILTIN\Administrators
QWCE-LDSAO SYSTEMAX\carrollc



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}:
($07) DENY ----N----- Everyone
($07) ALLOW Q------S-- Everyone

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}:
Q------S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}:
($07) DENY ----N----- Everyone
($07) ALLOW Q------S-- Everyone

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}:
Q------S-- Everyone



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}:
($07) DENY ----N----- Everyone
($07) ALLOW Q------S-- Everyone

Effective permissions for Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}:
Q------S-- Everyone
Linkmaster
March 6, 2006, 3:20 AM UTC
Sorry for the delay !! I was out of town !

Copy/paste the following text into a new Notepad document. Make sure that wordwrap is turned off.

@echo off
if exist regperms.txt del regperms.txt

regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /rgu >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}" /rgu >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}"/rgu >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}" /rgu >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /sgs:F(ci) >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62B92B1B-2FF4-C0C0-407F-FD1EF3FDEB7A}" /sgs:F(ci) >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6537283D-964A-CBD4-C67B-7091E7AC8979}" /sgs:F(ci) >> regperms.txt
regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBB4A740-CDEF-2FEA-7B76-BB8815E8A690}" /sgs:F(ci) >> regperms.txt
Notepad regperms.txt


Save it in the new Import folder on your desktop as setperm.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: setperm.bat

Overwrite the existing setpermbat. Open the Import folder on your Desktop. Double click setperm.bat. Notepad will open with regperms.txt
______________________________

Copy/paste the following text into a new Notepad document. Make sure that wordwrap is turned off in notepad - click the format menu and uncheck wordwrap.

(Echo %DATE% %TIME%
If exist empty.hiv del empty.hiv
If not Exist "original bho key.txt" Echo Backing up original BHO KEY & regedit /a "original bho key.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"
IF exist "original bho key.txt" Echo Backup Created Successfully
Echo.....
Echo Creating HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\empty

reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\empty
echo.....
Echo Saving HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\empty
Reg Save HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\empty Empty.hiv
echo.....
Echo Deleting HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\empty
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\empty /f
echo.....
Echo Replacing HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects with empty hive
reg restore "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" empty.hiv

)>logit.txt 2>&1

Start logit.txt

If exist empty.hiv del empty.hiv


Save it in the new Import folder on your desktop as r.bat. Save it as :
File Type: All Files (not as a text document or it wont work).
Name: r.bat

The file must be called r.bat and has to be saved the Import folder to work. Overwrite the existing r.bat.

Copy the following text to another new Notepad document. Make sure that wordwrap is turned off in notepad - click the format menu and uncheck wordwrap.

'create a file named r.bat
'Put r.bat in the same folder as this script
'run the script to set a task which will
'then run r.bat with System Privileges in a minute

'Written by Mosaic1
'Use at your own risk

Dim Future, NewD ,Short,Location ,batty

set fso = Wscript.CreateObject("Scripting.FilesystemObject")
Set Wshshell = Wscript.CreateObject("Wscript.shell")


NewD = DateAdd("n" , 1, Now)
Future = FormatDateTime(NewD,3)

Set Location = fso.GetFile("r.bat")
Short = Location.ShortPath

Wshshell.run "Cmd.exe /c" & "At" & Chr(32) & Chr(34) & Future & Chr(34) & Chr(32) & "/Interactive" & Chr(32) & Short ,vbhidden 'Set the task


MsgBox " Setup Done!"

Set fso = nothing
Set Wshshell = nothing
Set Location = nothing


Save it in the new Import folder on your desktop as Importbat.vbs. Save it as :
File Type: All Files (not as a text document or it wont work).
Name: Importbat.vbs

Overwrite the existing Importbat.vbs

Click Start then Run and type in services.msc and click Ok
Scroll down and double click on the service called Task Scheduler and set the Startup Type to Automatic if it isn't. Click Apply then click Ok.

Open the Import folder on your Desktop.
  • Watch the clock in your task bar.
  • When the minute turns over...
  • Double click Importbat.vbs
You will get a "Setup Done" prompt. The application will appear to do nothing ... wait a minute and Notepad will open with logit.txt.

If your antivirus alerts you about the script, allow it to run. It is not malicious.
______________________________

Copy/paste the following text into a new Notepad document. Make sure that wordwrap is turned off.

@echo off

regdacl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /L /E >> newperms.txt

Notepad newperms.txt


Save it in the new Import folder on your desktop as readperm.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: readperm.bat

Overwrite the existing readperm.bat. Open the Import folder on your Desktop. Double click readperm.bat. Notepad will open with newperms.txt.

Please post content of logit.txt & regperms.txt & newperms.txt. You might need several replies to post the logs.
Nick-YF19
March 18, 2006, 10:18 AM UTC
Whilst we appreciate that you may be busy, it has been 10 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.

Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. See Nellie2's blog here or post in our dedicated forum here
The infection you had was ......
ChrisRLG
March 19, 2006, 11:08 PM UTC
Moved back to active - on email request.