What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

promotion page highjack

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
And this isn't actaully a "bad thing".

The malware that you just got infected with shouldn't be very difficult to remove (Gosh, I hope i didn't jinx us :o ). Believe me there are much tougher things to remove.

Look at this as a blessing in disguise. This gives you a chance to "harden your defenses" before you get hit with something truly "nasty".

And don't feel alone. My wife got our machine infected with a CoolWebSearch (02/27/04 at 2:27 PM - The entries are still in my Norton Internet security log ) the same way you just did when she was looking for song lyrics for a church project. That's how I got invlolved in the "War against Malware".

And if it wasn't her, it would have been me eventually. Before that happened, I had no idea of all the dangers lurking on the Internet. I thought as long as we were careful about downloading, we were safe.

NOT SO!

Adding Spybot and Adaware is a good thing. You would have had to do it sooner or later.

By the way, here's the list of things we'll need to remove from your machine (one way or another):

c:\program files\180searchassistant <— FOLDER

c:\program files\bullseye network <— FOLDER

c:\program files\internet optimizer <— FOLDER

c:\program files\istsvc <— FOLDER

c:\program files\power scan <— FOLDER

c:\program files\surfaccuracy <— FOLDER

c:\program files\tsrc <— FOLDER

c:\windows\hyf.exe <— file

c:\windows\lrflh.exe <— file

c:\windows\nem220.dll <— file

c:\windows\system32\msbe.dll <— file

c:\windows\vsmom.exe <— file

c:\windows\wkssvc.exe <— file

If you see any of the FOLDER items in "Add/Remove Programs", please remove them before we begin.
Post #17
Logfile of HijackThis v1.99.1
Scan saved at 1:10:19 PM, on 8/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\wkssvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\winmon.exe
C:\Program Files\BellSouth\Connection Tool\IPClient.exe
C:\Program Files\BellSouth\Connection Tool\IPMon32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\SurfAccuracy\SAcc.exe
C:\WINDOWS\vsmom.exe
C:\Program Files\tsrc\csre.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\hjt\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\BellSouth\Connection Tool\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\BellSouth\Connection Tool\IPMon32.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [hyf] C:\WINDOWS\hyf.exe
O4 - HKCU\..\Run: [Odac] C:\Program Files\tsrc\csre.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc…/bridge-c11.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://jcs.chat.dcn.yahoo.com/v45/yacscom.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - C:\WINDOWS\wkssvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Windows Process Moniter - Unknown owner - C:\WINDOWS\winmon.exe
O23 - Service: AntiSpyUltra (Zonelaps) - Unknown owner - C:\WINDOWS\vsmom.exe
Post #18
Please disable Teatimer, it can interfere with the cleaning process:

How to Disable Teatimer

After we have cleaned your system, please be sure to reverse this process, and re-enable Teatimer.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe

O4 - HKLM\..\Run: [hyf] C:\WINDOWS\hyf.exe

O4 - HKCU\..\Run: [Odac] C:\Program Files\tsrc\csre.exe

O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - C:\WINDOWS\wkssvc.exe

O23 - Service: Windows Process Moniter - Unknown owner - C:\WINDOWS\winmon.exe

O23 - Service: AntiSpyUltra (Zonelaps) - Unknown owner - C:\WINDOWS\vsmom.exe

Then click "Fix checked and close Hijack This!.

Now, please go to:

Start –> Run

In the box type in services.msc then hit (or click OK)

In the Name column for:

Workstation Service Library (Microsoft Locator Service)

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\wkssvc.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column for:

Windows Process Moniter

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\winmon.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column for:

AntiSpyUltra (Zonelaps)

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\vsmom.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

Close the services.msc window.

Reboot in "safe" mode.

Delete all of these noted file(s)/FOLDER(s) you can find:

c:\program files\surfaccuracy <— FOLDER

c:\program files\tsrc <— FOLDER

c:\windows\hyf.exe <— file

c:\windows\vsmom.exe <— file

c:\windows\winmon.exe <— file

c:\windows\wkssvc.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #20
Revised instructions for removing the services:
———————————————-

Now, please go to:

Start –> Run

In the box type in services.msc then hit [ENTER] (or click OK)

In the Name column for:

Workstation Service Library (Microsoft Locator Service)

Double-click it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\wkssvc.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column for:

Windows Process Moniter

Double-click it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\winmon.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column for:

AntiSpyUltra (Zonelaps)

Double-click it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\vsmom.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

Close the services.msc window.
————————————–

I have my replies generated by a Perl program (then I look them over), and I have a bug or two to work out.
:oops:

Just do the instructions as posted.

Check the things I said & "fix" them.

Stop the services as listed above.

Then find and delete the files/folders I requested.
:thumbup:
Post #22
Logfile of HijackThis v1.99.1 Scan saved at 2:37:48 PM, on 8/7/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe C:\Program Files\BellSouth\Connection Tool\IPClient.exe C:\Program Files\BellSouth\Connection Tool\IPMon32.exe C:\WINDOWS\System32\hkcmd.exe C:\hjt\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\BellSouth\Connection Tool\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\BellSouth\Connection Tool\IPMon32.exe" O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
Post #23
Now that's a clean log!!!! :thumbup:
(And a short one as well)

I hope you can keep it that way. ;)

Here's my "all clear" speech.

GOD bless you, Sir!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #24
thanx for your help. it was my dad's p.c. so i told him to dload zone alarm. and refered him to this site and gave him the id and pass. again thanx. :thumbup:
Post #25 last edited
Some of those services may have made registry changes you need to reverse.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
EnableDCOM="N"

Should be "Y"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
Restrictanonymous=dword:00000001

Should be 0 (ZERO)

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

Not sure about his one. I don't have that one in my registry. Set it to 0 (ZERO)

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings
ProxyEnable
1

Should be 0 (ZERO)

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings
ProxyEnable
1

Should be 0 (ZERO)

Let me know if you need help reversing these changes.
Post #26
Just found more items:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify = "dword:00000001"

(The default entry is UpdatesDisableNotify = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify = "dword:00000001"

(The default entry is AntiVirusDisableNotify = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify = "dword:00000001"

(The default entry is FirewallDisableNotify = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AntiVirusOverride = "dword:00000001"

(The default entry is AntiVirusOverride = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
FirewallOverride = "dword:00000001"

(The default entry is FirewallOverride = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
Windows\WindowsUpdate
DoNotAllowXPSP2 = "dword:00000001"

(The default entry is DoNotAllowXPSP2 = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
WindowsFirewall\StandardProfile
EnableFirewall = "dword:00000001"

(The default entry is EnableFirewall = "dword:00000000")

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
WindowsFirewall\DomainProfile
EnableFirewall = "dword:00000001"

(The default entry is EnableFirewall = "dword:00000000")

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "0x00000004"

(The default entry is Start = "0x00000000")
Post #27
ok had him put the p.c. out of order until i resolve the registry. just post any more changes/info that you find. i'll post a new log after i undo the corupt registery. it may be a day or two. thanx for the update/continued interest. :)
Post #28
everything seems fine so far… thanx :thumbup: Logfile of HijackThis v1.99.1 Scan saved at 10:51:23 AM, on 8/8/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe C:\Program Files\BellSouth\Connection Tool\IPClient.exe C:\Program Files\BellSouth\Connection Tool\IPMon32.exe C:\WINDOWS\System32\hkcmd.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\hjt\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\BellSouth\Connection Tool\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\BellSouth\Connection Tool\IPMon32.exe" O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
Post #30
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI