Ie Windows Links

Hello Blake and Cindy, Welcome to TomCoyote forum. First, look at your log, you show that you are running two instances of HJT from your Desktop:
C:\Documents and Settings\Blake and Cindy\Desktop\hjt\HijackThis.exe
C:\Documents and Settings\Blake and Cindy\Desktop\hijackthis\HijackThis.exe Please delete one of these copies.

I have to tell you that you have a CoolWebSearch infection. This is one of the older varities so we will hopefully be able to remove it with CoolWebShredder.
Download the standalone version of CWShredder from here: http://www.intermute.com/spysubtract/cwshr…r_download.html Then use this tutorial to run CWShredder, making sure you "Check for updates" first, then choose "Fix" not Scan:
http://www.bleepingcomputer.com/forums/tutorial47.html The version is older in the tutorial, but the information is correct. You may wish to print this information as we will be doing this proceedure in safe mode because that will give
us a better chance for success.

Once you have CWShredder in place, and are familiar or have printed the instructions, please use the information for your Operating system to enter Safe Mode. Stay in Safe mode until you are told to restart your computer.
http://www.bleepingcomputer.com/forums/ind…showtutorial=61

Enter Safe Mode, run CWShredder, remember to Fix not scan. It will not hurt to run it a second time. After it tells you that you are clean of the CWS infection, close the program.


HijackThis instructions:
Note the Adobe items are missing files and will not work correctly. If you use those items, you will need to download them again.

Scan with HJT and put a check in front of each of these items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.placeforsearch.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.placeforsearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.placeforsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://weba.directwebsearch.net/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://weba.directwebsearch.net/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.placeforsearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.placeforsearch.com/search.html
(this is Adobe, but a file is missing. You need to download it again if you use it. Not working correctly like this)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - (no file)
(same with this toolbar)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)

with no windows open except HijackThis, "click on Fix Checked"

Empty the recycle bin and restart your computer, then run Cleanmgr like this: Start, Run type "cleanmgr" without the quotes then ok. Allow windows to remove anything it locates. Using Add Reply to stay in the same thread, post a new log, please include any feedback you think we should have.

Thanks…pskelley
TomCoyote forum
Classroom Advanced

Thanks,pskelly for your reply
I tried your solutions but I still have the same problem.Hijack this still finds the same nine entrys.CWShredder said after I ran the fix.Coolwebsearch was not found onthis system.It also says it is restoring nine IE pages. However in safe mode it says restoring 0 pages. Ever file it scannedit says not present. I have tried to delete these entrys in the registry but they come back. Need more ideas,
goathair
file of HijackThis v1.98.2
Scan saved at 4:01:35 PM, on 12/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Matrox X.tools\System\digisc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\SM1BG.EXE
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\mgabg.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\PDesk\PDesk.exe
C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Blake and Cindy\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.placeforsearch.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.placeforsearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.placeforsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://weba.directwebsearch.net/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://weba.directwebsearch.net/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.placeforsearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.placeforsearch.com/search.html
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [DSOutputEnabler] "C:\Program Files\Matrox X.tools\DSOutputEnabler.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} (DetInstaller Class) - http://www.pandasoftware.es/avchecker/cont…s/AvDetInst.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D662A14E-6017-11D5-B92C-0080AD7A7022} (Open3DPlayer Class) - http://www.openv3d.com/vr_samples/caps/Ope…pen3DPlayer.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?319

goathair, Did you attempt to remove the lines with HJT this? Both of these lines that I asked you to remove, are still there.

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93}

Did you follow the directions for the HJT removal? You mentioned nothing about that portion of the instructions.
Please try this, run both of these free online scans, please have them fix anything they locate. Let me know of anything they found, and if they find anything they can't remove, post that also.

http://www.windowsecurity.com/trojanscan/
http://scan.sygatetech.com/pretrojanscan.html

At this point, follow the instruction above and enter safe mode again. Run CWShredder, making sure you choose FIX. then please follow the above directions for HijackThis, then empty the recycle bin and restart the computer. Stay in this thread, post a new log with your comments.
Thanks…pskelley

Hi goathair, If you have not proceeded with the last instruction I gave you, please hold for me. It appears that Ad-watch keeps these registry changes from being made. See here: http://computercops.biz/startuplist-115.html
The instructions I have received is to uninstall, appears there is no way to just turn it off like Spybots TeaTimer. I have asked that question, as soon as I get an answer I will let you know. Thanks…pskelley

OK goathair, I must apologize for the delay, and the fact that I was unaware of what this feature of Ad-aware Plus does. I use the free version and I am very familiar with it. The very nature of this software would not let you make the changes you need to make.
I asked about a way to exit or turn it off, and this is the answer I received from our Group Administrator:

It has stopped several of the fixes I have done it the past - it even remembers if you disable it, for the next reboot when it runs - a full uninstall is my recommendation.

So, please disregard my last instruction post and return to the first post in this tread from me. Start at this point: I have to tell you that you have a CoolWebSearch infection.
Prior to proceeding with the instructions, the first instruction should have been: Because Ad-watch will not let you make the changes we must make,
please uninstall Ad-watch. Once your computer is clean, you can reinstall it. Once it is uninstalled, then proceed with the instructions again, and please post a new log and give me your feedback along with it.

Thanks…pskelley

Thanks pskelly I am working on it now. I did notice however that adwatch opened after every delete. Guess I should learn more about it. Thanks, goathair

No problem, take your time and proceed carefully. Even though this is not one of the newer varieties of CWS that are very dificult to remove, it is still CWS and needs to be off of your computer. I am always notified when you post, but I am not always online, so I will respond as soon as possible. Good luck…pskelley

YES!! If you have not already done so, here are intructions for ordering a Free SP2 CD, and you should read all of the information in the second link. Please give me a little time to review this new log. I will respond as soon as possible…pskelley

SP2 CD
http://www.microsoft.com/windowsxp/downloa…us/default.mspx

What you should know
http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx

Hello goathair, I guess we both learned from this post. I learned that changes can't be made with Ad-watch running and you learned that you need to learn more about what is running on your computer. Later in the post I will supply links where you can do exactly that.

First, it looks to me like you are running Selective Startup in msconfig as you have many fewer running programs than before. This is a matter of personal taste, and as it is your computer you may do as you want to control what loads at startup. The problem is, I can't see either. I need to see everything to make sure some issue of malware is not turned off. After we complete this post, please enable all in msconfig, then scan with HJT and post that log. No need to reboot, once you have the log for me, return to Selective Startup to save your resources.

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
To be sure, this is a valid program but with the missing (no name) it may not be functioning properly. If this is the case, download it again, that should fix the problem. Please note that this does not apply to the second BHO which is Spybot. All Spybot BHO's show like that in the logs.

These are just a few programs that are set to RUN at startup, the link below each line item will give you information to help you make an intelligent decision concerning the item. The links below all will give you information about everything in the log. Caution: If you are not sure about an item, leave it alone. Certain items must run for the computer to work properly:

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
http://computercops.biz/startuplist-4512.html
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
http://computercops.biz/startuplist-3315.html
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
http://www.liutilities.com/products/wintas…library/qttask/

INFORMATION LINKS:
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
http://www.pacs-portal.co.uk/startup_index.htm
http://computercops.biz/StartupList.html
http://www.sysinfo.org/startuplist.php

And since you are clean now, here is some great information from Tony Klein, Texruss and ChrisRLG to help you stay that way:

http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://www.cjwd.demon.co.uk/compsafetyonline.html

You may post the log discussed above at your convience, I will reply when possible.
Here's wishing you and yours a great holiday season
Thanks…pskelley
TomCoyote forum
Classroom Advanced
If you get help here consider a donation:
http://tomcoyote.com/donate.php
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.

OK…thanks, when you stop some programs with the msconfig utility, that is called Selective Startup, see this tutorial: http://netsquirrel.com/msconfig/
It is very important that you keep your antivirus program and your firewall If you are running a third party firewall running, they can't protect you otherwise. I really do suggest you take the time to look at what you disable to make sure it is not something that should be running. I can report that all is clean, safe surfing to you…pskelley

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?