What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

CoolWWWSearch

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Daveai,

Wow! A new variant. Being that kind of leader is not something I aspire to. :-)
Thanks for your honesty and dilligence in finding a solution for me.
The boot up went smoother this time. No troubling pop-ups.
Here is the new HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 9:18:03 PM, on 6/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\appsf32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\d3wv32.exe
C:\Program Files additional\AT&T Worldnet Accelerator\PropelAC.exe
C:\Program Files addition\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files addition\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {E350DCDC-9A76-985D-AE90-CDD6F5D74D1C} - C:\WINDOWS\javaat32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SandIcon] C:\Program Files addition\compact flash \SandIcon.Exe
O4 - HKLM\..\Run: [AT&T WorldNet Software Update] C:\Program Files additional\At&T_6.2\WnClient\Temp\patch623.exe
O4 - HKLM\..\Run: [HP Lamp] c:\program files addition\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe
O4 - HKLM\..\Run: [Propel Accelerator] "C:\Program Files additional\AT&T Worldnet Accelerator\trayctl.exe" /STARTUPLAUNCH
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files additional\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files addition\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [d3wv32.exe] C:\WINDOWS\d3wv32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files addition\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~3\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files additional\AT&T Worldnet Accelerator\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files additional\AT&T Worldnet Accelerator\pac-image.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.gsu.edu/activex/AxisCamControl.ocx
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedCon…n/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appsf32.exe" /s (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files additional\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #17 last edited
I'm back…and have not forgotten you :) I have recieved some feedback about your case, and will post the next fix later this evening. Sorry for the delay, but I wanted to have a valid 'plan of attack'. daveai
Post #18
Okay…I'm back with the next fix.

This variant of About:Blank is well known to resist removal. So we are going to make a few changes and emphasize some important points to make this process simpler and more automatic.

First, we are going to start by downloading a different browser for you to use. It is called Firefox, and is (currently) immune to the infection that resides in your copy of IE. Instructions for downloading Firefox are below. Once youstart using it…stay with it until we have you cleaned up.

Also, It is vital that the fix be conducted in Safe Mode, so be extra sure to be doing that when instructed.

And in your reply, if any issues or questions come up in any steps, please make a note and brief me about that in your reply.


Step#1:Getting Ready

(the reason Wordpad was chosen is that Notepad is sometimes deleted by this variant)


Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available.

After downloading the tools, you must disconnect from the internet totally, because staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening either will reinstall the infection.

To replace Internet Explorer to use during this fix, please use Internet Explorer once to download and install FireFox, to be used as your alternate browser throughout this fix.

Close Outlook Express and Internet Explorer for the duration of this fix


Please start by downloading the tools you will need to clean this infection. If you have a problem or question with any please continue to follow the list step by step to the end and ask the questions when you are asked to reply. Just be sure to let us know what the problem was when you finally reply.




Step#2:Show All Hidden Files

Double check that 'show hidden files' is correctly set up:

Windows XP

* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.


Step#3:Download CWShredder and About Buster

CWShredder and AboutBuster are already downloaded. Do NOT use them yet


Step#4:Download About Buster

Download HSfix.zip and unzip it to your desktop:

http://users.telenet.be/marcvn/regfiles/HSfix.zip

It will probably create a folder for itself (it does on my XP system)

Please Do NOT use it yet


Step#5:Download Registrar Lite


Registrar Lite is already downloaded but will not be needed this time.


Please disconnect from the Internet




Step#6:Disable The Bad Service
  • Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE
  • NOTE: Mandatory Step – Click on start > control panel > administrative programs > services. Look for a service called Remote Procedure Call (RPC) Helper . Double click on that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.


Step#7:Stop The Running Processes



Press control-alt-delete to get into the task manager and end the following processes if they exist:

C:\WINDOWS\system32\appsf32.exe

C:\WINDOWS\d3wv32.exe



Step#8:Use HijackThis to Delete About Blank

I now need you to delete the following files:

C:\WINDOWS\system32\appsf32.exe <– this file

C:\WINDOWS\d3wv32.exe <– this file

C:\WINDOWS\system32\ubnmj.dll <– this file

C:\WINDOWS\javaat32.dll <– this file


If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.



Step#9:Cleaning With HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ubnmj.dll/sp.html#37049

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {E350DCDC-9A76-985D-AE90-CDD6F5D74D1C} - C:\WINDOWS\javaat32.dll

O4 - HKLM\..\Run: [d3wv32.exe] C:\WINDOWS\d3wv32.exe

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS
\system32\appsf32.exe" /s (file missing)


click "fix checked"



Step#10: Backup The Registry

Step not needed this time


Step#11: Delete the Registry Entries


Then double-click on the HSfix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

You should get a message reporting that the changes were successfully merged.



Step#12:Fixing With CWShredder
  • CLOSE ALL WINDOWS except CWShredder
  • Run the program by clicking 'fix' and letting it fix all CWS remnants.


Step#13:Fixing With About Buster

This is the step where we will use About:Buster that you had downloaded previously.
  • Navigate to the c:\aboutbuster directory
  • double-click on aboutbuster.exe
  • When the tool opens press the OK button, then Start button, then the OK button
  • then finally the Yes button. It will start scanning your computer for files.
  • If it asks if you would like to do a second pass, allow it to do so.
  • Post the log file in your next reply


Step#14:Saving and Using a Reg File

Reg fix was done previously in Step #11

Reboot your computer back to normal mode


Step#15:Scan and Post a New HJT log with other logs
  • Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.

    Reconnect To The Internet

  • Post both your log from About Buster and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.
Good Luck!

daveai
Post #19
Daveai,

Ok…Here we go again.
# 1-5 are some background info that might be of help if further plans of attack need to be made.
#6 and #8 are clarification that I need about these steps. I'll wait for a response before applying this fix.

#1. When I first noticed troble with this machine, before I contacted this forum, I closed down Internet explorer, downloaded firefox from a friends machine and have been using it ever since.

I don't use Outlook Express but do use Outlook for email. Neither of these programs are open when I attempt the posted fixes.

#2
Show all hidden files is correctly set up.

#3 I've got CWShredder & AboutBuster. Both are up to date.

#4 I have HS fixx.zip

#5 I have Reg Lite

#6 What do you mean "Click Stop" in this step (Double Click onthat service and click stop then set startup to disabled). I see where to set to disabled but do not have a stop button. However the properties of the past services (from previous fixes) have showed the services to be stopped.

#8
To delete the files indicated in this step I have been opening the c:\\Windows\system32 folder, right clicking on a files and choosing delete. If I should be deleting these files another way tell me how.

Thanks.
Post #20
Thanks

Ok…Here we go again.
# 1-5 are some background info that might be of help if further plans of attack need to be made.
#6 and #8 are clarification that I need about these steps. I'll wait for a response before applying this fix.

#1. When I first noticed troble with this machine, before I contacted this forum, I closed down Internet explorer, downloaded firefox from a friends machine and have been using it ever since.

Good. The instructions are generic, and many folks do not have FF. I appreciate the clarification.

I don't use Outlook Express but do use Outlook for email. Neither of these programs are open when I attempt the posted fixes.

#2
Show all hidden files is correctly set up.

#3 I've got CWShredder & AboutBuster. Both are up to date.

#4 I have HS fixx.zip

#5 I have Reg Lite

Good

#6 What do you mean "Click Stop" in this step (Double Click onthat service and click stop then set startup to disabled). I see where to set to disabled but do not have a stop button. However the properties of the past services (from previous fixes) have showed the services to be stopped.

On many systems the service will not be stopped, so the instructions are to make sure it is so. If it is stopped on your system, that is good. Also be sure that the startup type is set to disable.

#8
To delete the files indicated in this step I have been opening the c:\\Windows\system32 folder, right clicking on a files and choosing delete. If I should be deleting these files another way tell me how.

You are doing it right. Some of the files are in C:\windows\ istead of C:\windoes\system32\/

Thanks
daveai
Post #21
Daveai, I understand the instructions are generic and why they must be this way. Since this seems not to be a "typical" instance of ABout:Blank I wanted to be sure we were both clear on what was being done. Thanks. I'll run thru this and post new logs later this afternoon. Suzanne
Post #22
Thanks Suzanne. The questions are all good :) I'm glad youare asking them. And, we'll beat this pest, even though it is being difficult. I have several senior experts following along and backing us up here. I'll look forward to the next results. Dave
Post #23
Daveai,

I'm in the middle of applying the latest fix and I noticed something that I have to ask about so I pulled the old 233 out of the closet and crossed my fingers. Luck is with me 'cause it booted right up and dialed in without needing any tweaks. :thumbup:

My infected machine is in safe mode and I'm at Step #9 Cleaning with HijackThis.
I ran a scan and came up with only two files out of the list that are there. I removed them. Then I noticed that four of the files that you listed are very similar to four of the files my HijackThis scan listed.

You listed this:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32
\ubnmj.dll/sp.html#37049

I see this:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32
\fmagr.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32
\fmagr.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32
\fmagr.dll/sp.html#37049

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32
\fmagr.dll/sp.html#37049

When I get more info from HijackThis about these entries it says that they are not original values and may redirect IE Search pages etc… I don't remember the exact wording.

Should I remove these entries now or leave them?
Post #26
Daveai,

Darn! This thing has more lives than any cat I've known.
Had a lot of pop up boxes announcing " blankty_blank is not a valid image" and "blankty_blank is not a valid Win32 application" on startup again.

Froze up again on AboutBuster scan. There were about 15 "Removed Stream" entries at the time of freeze that are not on the final log. If you need/want to see those entries I have an image I can send.

Here are the logs:

AboutBuster 5.0 reference file 30
Scan started on [7/3/2005] at [7:28:52 PM]
————————————————
Removed Stream! C:\WINDOWS\WindowsUpdate.log:lmvudm
————————————————
Removed File! : C:\Windows\pfunf.dll
Removed File! : C:\Windows\System32\eetyi.dll
Removed File! : C:\Windows\System32\hlqkh.dat
Removed File! : C:\Windows\System32\zpmos.dat
————————————————
Scan was COMPLETED SUCCESSFULLY at 7:32:19 PM

Logfile of HijackThis v1.99.1
Scan saved at 10:02:01 PM, on 7/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\javave32.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files addition\ZoneAlarm\zlclient.exe
C:\Program Files additional\AT&T Worldnet Accelerator\PropelAC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files addition\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\zgohh.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\zgohh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\zgohh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\zgohh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\zgohh.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\zgohh.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {D0120366-6D16-1396-60F6-A7427AF4E10E} - C:\WINDOWS\system32\mfcue.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [SandIcon] C:\Program Files addition\compact flash \SandIcon.Exe
O4 - HKLM\..\Run: [AT&T WorldNet Software Update] C:\Program Files additional\At&T_6.2\WnClient\Temp\patch623.exe
O4 - HKLM\..\Run: [HP Lamp] c:\program files addition\Hewlett-Packard\HP PrecisionScan\PrecisionScan\HPLamp.exe
O4 - HKLM\..\Run: [Propel Accelerator] "C:\Program Files additional\AT&T Worldnet Accelerator\trayctl.exe" /STARTUPLAUNCH
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files additional\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files addition\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [javave32.exe] C:\WINDOWS\system32\javave32.exe
O4 - HKLM\..\RunOnce: [msqq32.exe] C:\WINDOWS\system32\msqq32.exe
O4 - HKLM\..\RunOnce: [addda.exe] C:\WINDOWS\addda.exe
O4 - HKLM\..\RunOnce: [addxt32.exe] C:\WINDOWS\addxt32.exe
O4 - HKLM\..\RunOnce: [mfcnx32.exe] C:\WINDOWS\system32\mfcnx32.exe
O4 - HKLM\..\RunOnce: [appxo32.exe] C:\WINDOWS\system32\appxo32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files addition\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~3\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files additional\AT&T Worldnet Accelerator\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files additional\AT&T Worldnet Accelerator\pac-image.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.gsu.edu/activex/AxisCamControl.ocx
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedCon…n/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\msqq32.exe" /s (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files additional\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Thanks again for your help.
Post #27
Thanks. I'm going back through some of the logs, and discussing this case with some others here. I'll have new instructions either later today or early tomorrow. One thing…there is a possibility that this new variant changes itself on some sort of timer basis, in addtion to whenever it is partially removed. So…for one of our next rounds, I'd like to schedule our work as follows. You tell me when you have enough free time to reboot, run an HJT log, send it, wait for my response, run the fix, and send a follow-up log. You are fairly experienced with the fix steps now, so you should be able to estimate how long you will need. The basic idea is to do the analysis and fix quickly…get in and kill it. I can do the analysis part and turn a fix around in about 30 mins. I am online many mornings and most evenings, so we can schedule the esercise to suit your schedule. Let me know, and meanwhile I'll take a look at the latest log. I may also be asking you to find some of the files in it and to send them in for further analysis. Thanks daveai
Post #28
Daveai, The timer concept is an interesting twist. Is there a name for this new variant? I can boot into safe mode, run thru the fixes, boot back up and post logs in about 30 mins. Which time zone are you in? I'm on Eastern Time. I'm ready now … it is raining here…no fireworks tonight or I usually have time on the computer early to mid afternoon (2-4 pm, est) or late evening/night (after 9 pm, est). I could also do a morning session (9 -11 am, est) on Wednesday or Friday of this week. Fit this with your online time and post what day and time (include time zone yu are working in) I should post a new log. Suzanne
Post #29
Thanks

Sorry for the delayed response…very busy weekend…seven fire department and emergency medical calls in 48 hours out here over the 4th and 5th. I caught up on sleep today :)

Wednesday morning would work well for me. I'll be online about 9:30 AM PST time.

The improtant thing is that we work through a fix in hours, not days, so if you generate a log and post it in the morning, and then work the fix I send back in the afternoon session, we'll be able to accomplish that.

To anwswer your question…the indection is called CoolWebSearch (CWS) About:Blank. There are numerous variants (depending on how you count them). We refer to yours as 'AB type-2', and believe it is currently being changed by the authors to get around the automated fixes for it that were successfully developed last fall/winter. Prior to the new development, I believe there were 3-5 'flavors' of 'type-2' (based on differences in those 'funny charater names' in the O23 service entry).

I'll look forward to your next log. If Wednesday doesn't work, we'll find a more convenient time.

Also, I'd appreciate if you would run the following scan prior to sending the next log:
  • Download DLLCompare.
  • Double-click on DllCompare.exe to run the program.
  • Click "Run Locate.com" and it will scan your system for files.
  • Once the scan has finished click "Compare" to compare your files to valid Windows files.
  • Once it has finished comparing click "Make a Log of what was found".
  • Click "Yes" at the View Log file? prompt to view the log.
  • Copy and paste the entire log into this topic.
  • If you accidentally close out of the log it is also saved as log.txt to where you saved DllCompare.exe.
  • Click "Exit" to exit DLLCompare.
Thanks
daveai
Post #30
Daveai, Wednesday (today) will be fine to hit this thing. Hope you are well rested and ready to go. :) Here is the DLL compare log. * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found :)" ________________________________________________ 1,549 items found: 1,549 files, 0 directories. Total of file sizes: 266,684,922 bytes 254.33 M Administrator Account = True ——————–End log——————— New HJT log on its way in a few mins. S.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI