Spyware Advert Took Over My Desktop

1. Download Service Filter
2. Extract it to it's own folder.
3. Click on ServiceFilter.vbs
4. A text file called POST_THIS will be in the same folder
5. Please use Edit>Select all then Edit>Copy to obtain the contents
6. Please Post this into this thread using 'Add Reply'

Download: Registry Search Tool (RegSrch.zip) [freeware]
http://billsway.com/vbspage/

Open the Registry Search tool (RegSrch.vbs) and enter: software.exe and post the contents found. If your antivirus pops up (like mine did), tell it to allow this script to run.

Post the log file it produces.

Sorry for delay man, computer crashed here's the requested info thanks again: The script did not recognize the services listed below. This does not mean that they are a problem. To copy the entire contents of this document for posting: At the top of this window click "Edit" then "Select All" Next click "Edit" again then "Copy" Now right click in the forum post box then click "Paste" ######################################## ServiceFilter 1.1 by rand1038 Microsoft Windows XP Professional Version: 5.1.2600 Service Pack 1 Nov 27, 2004 23:35:14 —> Begin Service Listing <— Unknown Service # 1 Service Name: AVWUpSrv Display Name: AntiVir Update Start Mode: Auto Start Name: LocalSystem Description: … Service Type: Own Process Path: "c:\program files\anti virus personal\avwupsrv.exe" State: Running Process ID: 244 Started: True Exit Code: 0 Accept Pause: True Accept Stop: True Unknown Service #2 Service Name: SwPrv Display Name: MS Software Shadow Copy Provider Start Mode: Manual Start Name: LocalSystem Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this … Service Type: Own Process Path: c:\windows\system32\dllhost.exe /processid:{d65682b5-0b24-4fe8-824f-e33f6caed9be} State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False —> End Service Listing <— Reg Search: REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "software.exe" 27/11/2004 23:39:31 ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Software"="C:\\WINDOWS\\System32\\Software\\software.exe" [HKEY_USERS\S-1-5-21-1708537768-115176313-682003330-1003\Software\Microsoft\Search Assistant\ACMru\5603] "003"="software.exe" There are 80 Win32 services on this machine. 2 were unrecognized. Script Execution Time: 3 seconds.

one more thing: when i log on in safe mode, there are two user options - conil and administrator (which i didn't know i had but might have been put on by the guy who installed xp for me)

Can you log-in as "administrator"?

when i logged on zone alarms asked twice to allow 'generic process for win32 tying to access intenet' app.svchost.exe

As long as it's this "svchost.exe":

C:\WINDOWS\System32\svchost.exe

You can allow it.

hi mate i cannot log in as administrator in normal mode - the option only comes up in safe mode i have just downloaded the outpost firewall - which, unlike zonelabs, is letting me access the web!

Then boot in safe mode, log on as"administrator",

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [Software] C:\WINDOWS\System32\Software\software.exe

Reboot in normal mode, and run Hijack This! again.

Is that entry still there?

I didn't see anything using the other programs (servicefilter or regsearch) that should make that entry return after being "fixed".

I am thinking that maybe you don't have "administrator privileges" using your regular logon, and they may be required to get rid of that entry.

should i fix the checked item in hijack this?

My bad!!!! Yes. It needs "fixed".

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Me\LOCALS~1\Temp\sp.html

Means you have picked up a new infection.

Please do this:

Download FxAgentB.exe from here and save it to your desktop. After downloading, double-click the FxAgentB file to run it and the program will scan your entire hard drive - this may take a while. When it is done, it will generate a log file called FxAgentB.log - save that information as you will need to paste it here later. Reboot when done.

Next click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1. Reboot when done.

Then click here to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done, rescan with HijackThis and post a new log here, together with the FxAgentB log.

where are they coming from? perhaps they are latent in my browser pages - after adaware deleted 14 infected files i was prompted by teatimer that google.com would be replace by none i did replace some infected browser entries with google.com in spybot before you started helping me perhaps this is where they are coming from what do you think?… well i ran those three programs (FX, CW, AdAware).. here's the ad aware log: Ad-Aware SE Build 1.05 Logfile Created on:28 November 2004 02:55:14 Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R20 25.11.2004 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch(TAC index:10):13 total references MRU List(TAC index:0):26 total references Tracking Cookie(TAC index:3):1 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 28-11-2004 02:55:14 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\windows\currentversion\applets\wordpad\recent file list Description : list of recent files opened using wordpad MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\search assistant\acmru Description : list of recent search terms used with the search assistant MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\mediaplayer\player\recentfilelist Description : list of recently used files in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\internet explorer Description : last download directory used in microsoft internet explorer MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\ahead\nero - burning rom\recent file list Description : list of recently used files in nero burning rom MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\mediaplayer\preferences Description : last cd record path used in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\mediaplayer\preferences Description : last playlist index loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\mediaplayer\preferences Description : last playlist loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\ahead\cover designer\recent file list Description : list of recently used files in ahead cover designer MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\mediaplayer\medialibraryui Description : last selected node in the microsoft windows media player media library MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-21-1708537768-115176313-682003330-1003\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : C:\Documents and Settings\Me\recent Description : list of recently opened documents Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 712 ThreadCreationTime : 28-11-2004 02:46:26 BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 760 ThreadCreationTime : 28-11-2004 02:46:27 BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 784 ThreadCreationTime : 28-11-2004 02:46:27 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 828 ThreadCreationTime : 28-11-2004 02:46:27 BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 840 ThreadCreationTime : 28-11-2004 02:46:27 BasePriority : Normal FileVersion : 5.1.2600.1106 (xpsp1.020828-1920) ProductVersion : 5.1.2600.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1048 ThreadCreationTime : 28-11-2004 02:46:28 BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1128 ThreadCreationTime : 28-11-2004 02:46:28 BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1340 ThreadCreationTime : 28-11-2004 02:46:29 BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1416 ThreadCreationTime : 28-11-2004 02:46:29 BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1532 ThreadCreationTime : 28-11-2004 02:46:30 BasePriority : Normal FileVersion : 6.00.2800.1106 (xpsp1.020828-1920) ProductVersion : 6.00.2800.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:11 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1692 ThreadCreationTime : 28-11-2004 02:46:30 BasePriority : Normal FileVersion : 5.1.2600.0 (XPClient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:12 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1784 ThreadCreationTime : 28-11-2004 02:46:30 BasePriority : Normal FileVersion : 5.1.2600.1106 (xpsp1.020828-1920) ProductVersion : 5.1.2600.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:13 [aswupdsv.exe] FilePath : C:\Program Files\Alwil Anti Virus Software\Avast4\ ProcessID : 1824 ThreadCreationTime : 28-11-2004 02:46:31 BasePriority : Normal #:14 [ashserv.exe] FilePath : C:\Program Files\Alwil Anti Virus Software\Avast4\ ProcessID : 1844 ThreadCreationTime : 28-11-2004 02:46:31 BasePriority : High FileVersion : 4, 5, 514, 0 ProductVersion : 4, 5, 0, 0 ProductName : avast! Antivirus FileDescription : avast! antivirus service InternalName : aswServ LegalCopyright : Copyright © 2003 ALWIL Software OriginalFilename : aswServ.exe #:15 [outpost.exe] FilePath : C:\PROGRA~1\Agnitum\OUTPOS~1\ ProcessID : 1900 ThreadCreationTime : 28-11-2004 02:46:31 BasePriority : Normal FileVersion : 2.5.370 ProductVersion : 2.5 ProductName : Outpost Firewall CompanyName : Agnitum FileDescription : Outpost Firewall main module InternalName : Outpost Firewall LegalCopyright : © Agnitum, 1999-2004 OriginalFilename : outpost.exe #:16 [wdfmgr.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2032 ThreadCreationTime : 28-11-2004 02:46:32 BasePriority : Normal FileVersion : 5.2.3790.1230 built by: DNSRV(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:17 [ashdisp.exe] FilePath : C:\PROGRA~1\ALWILA~1\Avast4\ ProcessID : 704 ThreadCreationTime : 28-11-2004 02:46:34 BasePriority : Normal FileVersion : 4, 1, 415, 0 ProductVersion : 4, 1, 0, 0 ProductName : avast! Antivirus FileDescription : avast! service GUI component InternalName : aswDisp LegalCopyright : Copyright © 2003 ALWIL Software OriginalFilename : aswDisp.exe #:18 [teatimer.exe] FilePath : C:\Program Files\Spybot - Search & Destroy\ ProcessID : 740 ThreadCreationTime : 28-11-2004 02:46:34 BasePriority : Idle FileVersion : 1, 3, 0, 12 ProductVersion : 1, 3, 0, 12 ProductName : Spybot - Search & Destroy CompanyName : Safer Networking Limited FileDescription : System settings protector InternalName : TeaTimer LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten. LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen. OriginalFilename : TeaTimer.exe Comments : Schützt Systemeinstellungen vor ungewollten Änderungen. #:19 [mfwakeys.exe] FilePath : C:\Program Files\MOTU\FireWire Audio\ ProcessID : 1252 ThreadCreationTime : 28-11-2004 02:46:36 BasePriority : Normal #:20 [sgmain.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 1348 ThreadCreationTime : 28-11-2004 02:46:37 BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SpywareGuard FileDescription : SpywareGuard InternalName : sgmain LegalCopyright : Copyright © 2002-2003 Javacool Software LLC OriginalFilename : sgmain.exe Comments : SpywareGuard #:21 [mpbtn.exe] FilePath : C:\Program Files\ntl\broadband medic\bin\ ProcessID : 1452 ThreadCreationTime : 28-11-2004 02:46:38 BasePriority : Normal #:22 [sgbhp.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 1612 ThreadCreationTime : 28-11-2004 02:46:40 BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SG Browser Hijacking Protection FileDescription : SG Browser Hijacking Protection InternalName : sgbhp LegalCopyright : Copyright © 2002-2003 Javacool Software LLC. OriginalFilename : sgbhp.exe Comments : SG Browser Hijacking Protection #:23 [ashmaisv.exe] FilePath : C:\Program Files\Alwil Anti Virus Software\Avast4\ ProcessID : 1868 ThreadCreationTime : 28-11-2004 02:46:43 BasePriority : Normal #:24 [wuauclt.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 328 ThreadCreationTime : 28-11-2004 02:47:38 BasePriority : Normal FileVersion : 5.4.3790.2182 built by: srv03_rtm(ntvbl04) ProductVersion : 5.4.3790.2182 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Automatic Updates InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wuauclt.exe #:25 [iexplore.exe] FilePath : C:\Program Files\Internet Explorer\ ProcessID : 392 ThreadCreationTime : 28-11-2004 02:52:12 BasePriority : Normal FileVersion : 6.00.2800.1106 (xpsp1.020828-1920) ProductVersion : 6.00.2800.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Internet Explorer InternalName : iexplore LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : IEXPLORE.EXE #:26 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft Ad Aware\Ad-Aware SE Personal\ ProcessID : 1100 ThreadCreationTime : 28-11-2004 02:53:45 BasePriority : Normal FileVersion : 6.2.0.206 ProductVersion : VI.Second Edition ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 26 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : "HOMEOldSP" Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\internet explorer\main Value : HOMEOldSP Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 1 Objects found so far: 27 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 27 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : me@atdmt[1].txt Category : Data Miner Comment : Hits:1 Value : Cookie:[removed]/ Expires : 27-11-2009 LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 1 Objects found so far: 28 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 28 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch Object Recognized! Type : Regkey Data : Category : Malware Comment : CWS.About:Blank Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\uninstall\searchassistant uninstall CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : CWS.About:Blank Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\uninstall\searchassistant uninstall Value : DisplayName CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : CWS.About:Blank Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\uninstall\searchassistant uninstall Value : UninstallString CoolWebSearch Object Recognized! Type : Regkey Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotch.com CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotch.com Value : * CoolWebSearch Object Recognized! Type : Regkey Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\internet settings\zonemap\domains\mt-download.com CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\internet settings\zonemap\domains\mt-download.com Value : * CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_CURRENT_USER Object : software\microsoft\internet explorer\main Value : Search Bar CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\internet explorer\main Value : Use Custom Search URL CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\internet explorer\main Value : Use Search Asst CoolWebSearch Object Recognized! Type : RegData Data : 2 Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\internet settings\zonemap\protocoldefaults Value : http Data : 2 CoolWebSearch Object Recognized! Type : File Data : systime.exe Category : Malware Comment : Object : C:\WINDOWS\System32\ Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 12 Objects found so far: 40 03:07:26 Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:12:12.547 Objects scanned:94857 Objects identified:14 Objects ignored:0 New critical objects:14 coming up is the hijack this log…

The log looks good now.

How are things working for you?

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.
(Personally, I'm NOT recommending SP2 for XP at this time)

thank you so much for your help micah - i owe you a drink things are working fine now (i think) and with the new avast and outpost i feel i bit more secure i think its a great thing that you guys do i am a poor musician who would never be able to afford to pay a technician to come round and fix the problems you fixed for me today you are the main man! i'll let you know how things go… but for now i'm going to bed - its nearly 4am here in london…. by the way where are you mailing from? thanks so much again man speak to you soon conil

Glad we could help. I'm in Kansas (USA), Toto.