Coolwwwsearch.googlems

best to all on the board and I appreciate all the help you have already given me. I am running xp/service pack 1. spybot s/d 1.3 returns the following log. I am unable to reapir the infected registry key. Can anyone help me on how to eradicate/repair this registry? thanks. log follows: Cache: Cache (435) (Cache, nothing done) Cookie: Cookie (29) (Cookie, nothing done) CoolWWWSearch.Googlems: RAS profile (Registry key, fixing failed) HKEY_USERS\S-1-5-18\Software\Microsoft\RAS Autodial\Addresses\gateway.messenger.hotmail.com CoolWWWSearch.Googlems: RAS profile (Registry key, fixing failed) HKEY_USERS\.DEFAULT\Software\Microsoft\RAS Autodial\Addresses\gateway.messenger.hotmail.com Log: Shutdown: System32\wbem\logs\wmiprov.log (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\wmiprov.log Log: Activity: SchedLgU.Txt (Backup file, nothing done) C:\WINDOWS\SchedLgU.Txt Log: Shutdown: System32\wbem\logs\wbemess.log (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\wbemess.log Log: Shutdown: System32\wbem\logs\winmgmt.log (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\winmgmt.log MS DirectDraw: Most recent application (Registry change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name!= MS Media Player: Anonymous ID (Registry change, nothing done) HKEY_USERS\S-1-5-21-927890586-1653462319-1608279117-1006\Software\Microsoft\MediaPlayer\Preferences\SendUserGUID!=B=0 MS Search Assistant: Typed search terms history (Registry key, nothing done) HKEY_USERS\S-1-5-21-927890586-1653462319-1608279117-1006\Software\Microsoft\Search Assistant\ACMru Windows Explorer: User Assistant history files (31 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-927890586-1653462319-1608279117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count Windows Explorer: User Assistant history IE (1 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-927890586-1653462319-1608279117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count Windows Media SDK: Computer name (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName Windows Media SDK: Computer name (Registry change, nothing done) HKEY_USERS\S-1-5-21-927890586-1653462319-1608279117-1006\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName Windows Media SDK: Computer name (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName — Spybot - Search && Destroy version: 1.3 — 2004-08-11 Includes\Cookies.sbi 2004-10-26 Includes\Dialer.sbi 2004-10-26 Includes\Hijackers.sbi 2004-10-07 Includes\Keyloggers.sbi 2004-05-12 Includes\LSP.sbi 2004-10-26 Includes\Malware.sbi 2003-11-12 Includes\QA Tests.sbi 2004-10-05 Includes\Revision.sbi 2004-10-25 Includes\Security.sbi 2004-10-26 Includes\Spybots.sbi 2004-10-21 Includes\Tracks.uti 2004-10-26 Includes\Trojans.sbi

Here's how to post a Hijack This log

Download "HijackThis" here
When downloading, choose "save to disk" and NOT open!

Now create a new folder for it, C:\Hijackthis, for example.
After unzipping the file. to C:\Hijack This, you'll end up with the file itself, which is Hijackthis.exe, and that's the one you'll need to doubleclick.'

When the program launches, hit the "Scan" button
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, and save the log anywhere you like.

Now if you doubleclick the log file.Go to Edit > Select all, then to Edit > copy.
Now you've copied the entire text to the Windows Clipboard (this happens behind your back.)

Next, go back to this forum thread, and click "Add Reply".
In an empty area click your RIGHT mouse button, and choose 'Paste' from the context menu.
There's your Hijack This log.

And there is a newer of HijackThis1.98.2 Download it here
Please scan with this version.

If you run it out of a compressed file, like a zip file, instead of running it from a directory, the backups will not be made.

Please unzip Hijack this by a right click on the zipped folder click extract all here. Then delete the folder with the zipper on it.


Download the latest version of Ad-Aware here:

After installing Ad-Aware, and before running the program.
Please be sure to update the reference file following the instructions here:

Reconfigure Ad-Aware for Full Scan:

Launch the program, and click on the Gear at the top of the start screen.

Click the "Scanning" button.
Under Drives, Folders and Files, select "Scan within Archives".
Click "Click here to select Drives + folders" and select your installed hard drives.

Under Memory & Registry, select all options.
Click the "Advanced" button.
Under "Log-file detail level", select all options.
Click the "Tweaks" button.

Under "Scanning Engine", select the following:
"Unload recognized processes during scanning."
Under "Cleaning Engine", select the following:
"Let Windows remove files in use after reboot."
Click on 'Proceed' to save these Preferences.

Run the Ad-Aware scan and allow it to remove everything it finds and then REBOOT to allow it to finish.


Then post another log.

little eagle thanks for the reply. I did what you instructed: ran the hijack this as an exe, and configured the ad-ware. upon reboot i did a spybot scan and the googlem item was gone. thank you very much for your time, not to mention your help. much appreciated.

Can you post another log.

Looks clean.

Please read through the ideas and free software listed below that will help to keep your computer clean.
Some of these you may already have installed or may have done already.

Install a firewall.ZoneAlarm FREE

Ensure that an Antivirus is updated weekly and running. AVG antivirus from Grisoft is a very good FREE antivirus program. But you only need one AV

Make sure you have the latest critical updates from windows update.

SpywareBlaster will prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.

IE-SPYAD puts over 4000 known 'bad' sites into your IE restricted zone so that they cannot install malware on your PC.

Google toolbar has a very good built in popup blocker with a nice search bar. To provide privacy, select disable advanced features when installing.

Check your system for latest virus definitions with an online virus scan every week or two.
TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan

Check your system for latest trojan definitions with an Online trojan scan also every week or two.

And also see this link for additional security information.
So how did I get infected in the first place?

Please consider using Firefox
http://texturizer.net/firefox/index.html

Please read this

appreciate it little eagle. im running norton, but will install spypad as you siggest. I cannot update from windows, as i am unable to install service pac2—tried twice and was unable to boot computer. thanks again for your help.

Glad we could help.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?