What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Jacked

61 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50032
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZServ.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - HKLM\..\Run: [4S2NSLA3QS#366] C:\WINDOWS\System32\OwmQ9t0X.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKCU\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into Safe Mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\Program Files\SurfSideKick 2\ <– folder
C:\WINDOWS\system32\wsxsvc\ <– folder
C:\Program Files\COMMON FILES\WinTools\ <– folder
C:\Program Files\Windows TaskAd\ <– folder
C:\Program Files\Toolbar\ <– folder

Reboot back to Normal Mode when done. Rescan with HJT and post a new log here.
Post #17
Okey………….. Logfile of HijackThis v1.98.2 Scan saved at 8:54:04 PM, on 2/4/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\MsgSys.EXE C:\WINDOWS\system32\wvkyvq.exe C:\WINDOWS\System32\rsvnxv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE N2 - Netscape 6: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) N2 - Netscape 6: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll O4 - HKLM\..\Run: [VTPreset] VTPreset.exe O4 - HKLM\..\Run: [rwwuzgaljav] C:\WINDOWS\System32\rsvnxv.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
Post #18
Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O4 - HKLM\..\Run: [rwwuzgaljav] C:\WINDOWS\System32\rsvnxv.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into Safe Mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\System32\rsvnxv.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\WINDOWS\farmmext.exe
C:\WINDOWS\wupdt.exe

Reboot back to Normal Mode when done. Rescan with HJT and post a new log here.

Go here, download, extract the files from the zip:

http://forums.skads.org/index.php?act=Attach&type=post&id=66

Go to the new qoologic folder and run the batch file. Give it time to complete. Look for a log called C:\log.txt - post the contents here.
Post #19
ok….. Logfile of HijackThis v1.98.2 Scan saved at 9:19:30 PM, on 2/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\wvkyvq.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\system32\MsgSys.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\HijackThis\HijackThis.exe N2 - Netscape 6: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) N2 - Netscape 6: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZServ.dll O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file) O4 - HKLM\..\Run: [VTPreset] VTPreset.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe C:\Documents and Settings\Jerry\Desktop\qoologic PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— C:\WINDOWS\system32\clpgli.dll: updates.qoologic.com C:\WINDOWS\system32\eiazis.dll: updates.qoologic.com C:\WINDOWS\system32\hlqplx.exe: updates.qoologic.com C:\WINDOWS\system32\installer.exe: .aspack C:\WINDOWS\system32\ntdll.dll: .aspack C:\WINDOWS\system32\pwvqwg.dat: .aspack C:\WINDOWS\system32\randreco.exe: .aspack C:\WINDOWS\system32\wvkyvq.exe: .aspack Files Found in all users startup Folder………… ———————— C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hknykf.exe: .aspack Files Found in all users windows Folder………… ———————— Finished
Post #20
Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file to your desktop.

Start Killbox, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\WINDOWS\system32\clpgli.dll
C:\WINDOWS\system32\eiazis.dll
C:\WINDOWS\system32\hlqplx.exe
C:\WINDOWS\system32\pwvqwg.dat
C:\WINDOWS\system32\randreco.exe
C:\WINDOWS\system32\wvkyvq.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hknykf.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Reboot if it doesn't do so automatically. Post a new qoologic log.
Post #21
Okay……. C:\Documents and Settings\Jerry\Desktop\qoologic PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— C:\WINDOWS\system32\installer.exe: .aspack C:\WINDOWS\system32\ntdll.dll: .aspack Files Found in all users startup Folder………… ———————— Files Found in all users windows Folder………… ———————— Finished
Post #23
Okay, Here's new HJ log….. Logfile of HijackThis v1.98.2 Scan saved at 11:15:47 AM, on 2/20/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NavNT\vptray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\system32\MsgSys.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HijackThis\HijackThis.exe N2 - Netscape 6: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) N2 - Netscape 6: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZServ.dll O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file) O4 - HKLM\..\Run: [VTPreset] VTPreset.exe O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\wvkyvq.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
Post #24
Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZServ.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\wvkyvq.exe

Reboot. Open HJT>Config>Misc Tools and update to v1.99.1

Post a new log when done.
Post #25
Okay… Logfile of HijackThis v1.99.1 Scan saved at 9:11:08 PM, on 2/21/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NavNT\vptray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\system32\MsgSys.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMJB.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMJB.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMJB.EXE C:\Program Files\Java\j2re1.4.1_02\bin\javaw.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMJB.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMJB.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMJB.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\DOCUME~1\Jerry\LOCALS~1\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe N2 - Netscape 6: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) N2 - Netscape 6: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js) O4 - HKLM\..\Run: [VTPreset] VTPreset.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe (file missing)
Post #26
Click here to download eScan's mwav application. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.
Post #27
Oops.. Tried to post MWAV log. Error message says “post too long”…( 371231 characters) Is there a way to send attachment or should I send log in separate posts? Thanks, G
Post #29
Yes, lower panel… I did save the log. Just not sure how to get it to you… – G Here's the unfortunate summary: Sat Feb 26 07:23:08 2005 => ***** Scanning complete. ***** Sat Feb 26 07:23:08 2005 => Total Files Scanned: 228928 Sat Feb 26 07:23:08 2005 => Total Virus(es) Found: 2259 Sat Feb 26 07:23:08 2005 => Total Disinfected Files: 0 Sat Feb 26 07:23:08 2005 => Total Files Renamed: 0 Sat Feb 26 07:23:08 2005 => Total Deleted Files: 0 Sat Feb 26 07:23:08 2005 => Total Errors: 159 Sat Feb 26 07:23:08 2005 => Time Elapsed: 07:08:56 Sat Feb 26 07:23:08 2005 => Virus Database Date: 2005/02/25 Sat Feb 26 07:23:08 2005 => Virus Database Count: 119374 Sat Feb 26 07:23:08 2005 => Scan Completed.
Post #30
Yes, lower panel… I did save the log. Just not sure how to get it to you… – G Here's the unfortunate summary: Sat Feb 26 07:23:08 2005 => ***** Scanning complete. ***** Sat Feb 26 07:23:08 2005 => Total Files Scanned: 228928 Sat Feb 26 07:23:08 2005 => Total Virus(es) Found: 2259 Sat Feb 26 07:23:08 2005 => Total Disinfected Files: 0 Sat Feb 26 07:23:08 2005 => Total Files Renamed: 0 Sat Feb 26 07:23:08 2005 => Total Deleted Files: 0 Sat Feb 26 07:23:08 2005 => Total Errors: 159 Sat Feb 26 07:23:08 2005 => Time Elapsed: 07:08:56 Sat Feb 26 07:23:08 2005 => Virus Database Date: 2005/02/25 Sat Feb 26 07:23:08 2005 => Virus Database Count: 119374 Sat Feb 26 07:23:08 2005 => Scan Completed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI