Please Help With Coolwebsearch

Let's see if you have a hidden hijacker. Do this for me.

Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

Hi There and thanks for helping me out. I really aprisiate it. This is what the log file showed. * DLLCompare Log version(1.0.0.125) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\resgc.dll Sat 2004-05-01 23.47.26 A…R 57 344 56,00 K ________________________________________________ 1 268 items found: 1 268 files, 0 directories. Total of file sizes: 251 722 748 bytes 240,06 M Administrator Account = True ——————–End log——————— RGDS Trenter

OK looks like it's there.

Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

OK here comes the log file. Sun 19 Sep 04 23:28:13 »»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»» *System: Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600) *IE version: 6.0.2900.2180 SP2 MS-DOS version 5.00.500 *command.com test passed! __________________________________ !!*Creating backups…!! The operation completed successfully 23:28:11,91 2004-09-19 __________________________________ *Local time: den 19 september 2004 (2004-09-19) 23:28, Västeuropa, normaltid *Uptime: 23:28:15 up 0 days, 0:47:22 *Path: C:\FINDnFIX —————————————————- »»Member of…: ("ADMIN" logon + group match required!) User is a member of group LENNART\Ingen. User is a member of group \Alla. User is a member of group BUILTIN\Administratörer. User is a member of group BUILTIN\Användare. User is a member of group NT INSTANS\INTERAKTIV. User is a member of group NT INSTANS\Autentiserade användare. User is a member of group \LOKAL. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User: [LENNART\Lennarts_Bärbara], is a member of: BUILTIN\Administratörer \Everyone Running in WORKSTATION MODE. SystemDrive is C: SystemRoot is C:\WINDOWS Logon Domain is LENNART Administrator's Name is Lennarts_B„rbara Computer Name is LENNART LOGON SERVER is \\LENNART »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. Ex: read only files, s/h files, last modified date. size, etc. The filters provided and registry scan should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder ______________________________________________________________________________ ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!*** ______________________________________________________________________________ ……Scanning for file(s)… *Note! The list(s) may include legitimate files! »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Read access error(s)… C:\WINDOWS\SYSTEM32\RESGC.DLL +++ File read error \\?\C:\WINDOWS\System32\RESGC.DLL +++ File read error »»»»» (*2*) »»»»»…….. RESGC.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ resgc.dll Sat 2004-05-01 23.47.26 A…R 57 344 56,00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57 344 bytes 56,00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\RESGC.DLL SNiF 1.34 statistics Matching files : 1 Amount in bytes : 57344 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» ¯ Access denied ® ………………… RESGC.DLL …..57344 01.05.2004 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\RESGC.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… *List of files and specs according to 'size' : *Note: Not all files listed here are infected, but *may include* the name and spces of the offending file… ___________________________________________________________________________ Path: C:\WINDOWS\SYSTEM32 Including: *.DLL 220. Dpwsockx Dll 57,344 . . . . A 8-04-04 10:33 am 634. Msasn1 Dll 57,344 . . . . A 8-04-04 10:33 am 941. Resgc Dll 57,344 . . R . A 5-01-04 11:47 pm 192. Dmloader Dll 35,840 . . . . A 8-04-04 10:33 am 358. Imgutil Dll 35,840 . . . . A 8-04-04 10:33 am 216. Dpvacm Dll 21,504 . . . . A 8-04-04 10:33 am 266. Feclient Dll 21,504 . . . . A 8-04-04 10:33 am ____________________________________________________________________________ *By size and date… C:\WINDOWS\SYSTEM32\ dpwsockx.dll Wed 2004-08-04 10.33.34 A…. 57 344 56,00 K msasn1.dll Wed 2004-08-04 10.33.44 A…. 57 344 56,00 K resgc.dll Sat 2004-05-01 23.47.26 A…R 57 344 56,00 K 3 items found: 3 files, 0 directories. Total of file sizes: 172 032 bytes 168,00 K C:\WINDOWS\SYSTEM32\ dmloader.dll Wed 2004-08-04 10.33.34 A…. 35 840 35,00 K imgutil.dll Wed 2004-08-04 10.33.38 A…. 35 840 35,00 K 2 items found: 2 files, 0 directories. Total of file sizes: 71 680 bytes 70,00 K C:\WINDOWS\SYSTEM32\ dpvacm.dll Wed 2004-08-04 10.33.34 A…. 21 504 21,00 K feclient.dll Wed 2004-08-04 10.33.36 A…. 21 504 21,00 K 2 items found: 2 files, 0 directories. Total of file sizes: 43 008 bytes 42,00 K Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL Sniffed -> C:\WINDOWS\SYSTEM32\RESGC.DLL SNiF 1.34 statistics Matching files : 3 Amount in bytes : 172032 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 71680 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL SNiF 1.34 statistics Matching files : 2 Amount in bytes : 43008 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» BHO search and other files… **File C:\WINDOWS\SYSTEM32\AMBHD.DLL 000020E4: 25 25 25 30 32 78 00 00 . 00 00 00 00 C0 82 05 B3 %%%02x.. ….À‚.³ fgrep: can't open input C:\WINDOWS\SYSTEM32\RESGC.DLL No matches found. "C:\WINDOWS\system32\" ambhd.dll 2004-09-19 31744 "ambhd.dll" rtipxmib.dll 2004-08-04 31744 "rtipxmib.dll" 2 items found: 2 files, 0 directories. Total of file sizes: 63 488 bytes 62,00 K *sp.html found in temp folder: –a– - - - - - 7,976 09-19-2004 sp.html File: CRC-32 : 93866C48 MD5 : CE5B5B5B DFD4A959 9F4A95C7 6FA46BD2 *Filter keys search… HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html CLSID = {3B25C72C-BEFE-4272-984C-9FFB2B6005A5} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain CLSID = {3B25C72C-BEFE-4272-984C-9FFB2B6005A5} »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Checking for AppInit_DLLs (empty) value… ________________________________ !"AppInit_DLLs"=""! Value does not match ________________________________ »»Comparing *saved* key with *original*… REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com) Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows). Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 30) »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Anv„ndare (ID-IO) ALLOW Read BUILTIN\Anv„ndare (ID-NI) ALLOW Full access BUILTIN\Administrat”rer (ID-IO) ALLOW Full access BUILTIN\Administrat”rer (ID-NI) ALLOW Full access NT INSTANS\SYSTEM (ID-IO) ALLOW Full access NT INSTANS\SYSTEM (ID-IO) ALLOW Full access SKAPARE ŽGARE Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Anv„ndare Full access BUILTIN\Administrat”rer Full access NT INSTANS\SYSTEM »»Performing string scan…. 00001150: vk < f AppInit_DLLs G 00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ r e s g c . d l l 000011D0: h vk UDeviceNotSelectedTimeout 1 5 00001210: I 6* 9 0 | . vk ' zGDIProcessHandle 00001250:Quota" vk x Spooler2 y e s h h 00001290: ( X vk swapdisk vk 000012D0: TransmissionRetryTimeout h ( X 00001310: vk ' E USERProcessHandleQuota H 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT fùAppInit_DLLs֍æGÀÿÿÿC ————– ————– $01180: AppInit_DLLs $011EF: UDeviceNotSelectedTimeout $0123F: zGDIProcessHandleQuota $012D8: TransmissionRetryTimeout $01328: USERProcessHandleQuota ————– ————– C:\WINDOWS\System32\resgc.dll ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 …………. A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 60 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINDOWS\System32\resgc.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O. 0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e. 0020 6d 00 33 00 32 00 5c 00 72 00 65 00 73 00 67 00 | m.3.2.\.r.e.s.g. 0030 63 00 2e 00 64 00 6c 00 6c 00 00 00 | c…d.l.l… ———————– »»»»»»Backups list…»»»»»» 23:32:31 up 0 days, 0:51:39 ———————– Sun 19 Sep 04 23:32:31 C:\FINDNFIX\ keyback.hiv Sun 2004-09-19 23.28.12 A…. 8 192 8,00 K 1 item found: 1 file, 0 directories. Total of file sizes: 8 192 bytes 8,00 K C:\FINDNFIX\KEYS1\ winkey.reg Sun 2004-09-19 23.28.14 A…. 287 0,28 K 1 item found: 1 file, 0 directories. Total of file sizes: 287 bytes 0,28 K *Temp backups… "C:\Documents and Settings\Lennarts_B„rbara\Lokala inst„llningar\Temp\Backs2\" keyback2.hi_ 2004-09-19 8192 "keyback2.hi_" winkey2.re_ 2004-09-19 287 "winkey2.re_" 2 items found: 2 files, 0 directories. Total of file sizes: 8 479 bytes 8,28 K -D—- JUNKXXX 00000000 23:28.12 19/09/2004 A—– STARTIT .BAT 00000060 23:28.14 19/09/2004 ________________________________________________________________________________ ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)' AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS! MINIMAL REQUIREMENTS INCLUDE: _________XP HOME/PRO; SP1; IE6/SP1 _________2K/SP4; IE6/SP1 ________________________________________________________________________________ »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»» —–END—— Sun 19 Sep 04 23:32:33  RGDS Trenter

Completely disable any antivirus software you have running from this point on until we have finished.

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the RESGC.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

Nearly there, open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

Looks good - how is it running now?

Well I am not sure. After last bootup I run Adaware SE and then my virusprogram Norman find a Trojan Java/Byte verify. Adaware did not find any thing. I run SpySweeper and it found one adware CWS About blank. But my start page have not been hijacket so far. I will restart the PC and start ie a few times, it is then it happend and I will see. Any way a very big thank you for your support. It is very nice to know some one out there cares. BRGDS Trenter

Is it still running OK - if so I can close this topic.

Hi Daemon Yes it is still running OK now. You can close it. What a relive it is to get rid of this. I take my hat off for you and if you are a girl I would kiss you. Thanks allot. Have a nice day BRGDS Trenter

You're welcome - glad to help

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.