What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can Some One Help While I Still Have A Hair?

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hey Daemon I have a Question for ya,All the great work you all do here are you all useing this and other forums to sharpen your skills to find cures for all the crapware that's out there? what I mean is do forums like this contribute to writeing new software programs to combat this and other anti everything ? :P just askn's all
Post #17
Still not quite got rid of this one yet.

Click Start>run type regedit >OK

Expand this key:HKEY_CLASSES_ROOT\PROTOCOLS\Filter

Search for these two subfolders:

text/plain
text/html

Right-click one at a time >Permissions>Advanced and un-check the 'inherit ..permissions' lower box, hit 'ok' and 'remove' on the prompts.

Copy the contents of the quote box to notepad. Name as 'Fix2.reg'. Save as All Files on the desktop.

 
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B27D3B82-76C9-471D-82B4-6CDD499979FF}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9433538-D52E-4DC6-976E-ED89F116737D}]

[-HKEY_USERS\S-1-5-21-796845957-1275210071-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]



Close notepad and double click on the file. When asked to merge to the registry say yes.

To answer your question: all the helpers here and other similar forums are volunteers. We do maintain contact with the developers of anti-spyware/virus software and send them files/samples as we encounter them. These forums tend to be the front line.

Run findall.bat, regsrch.vbs and HJT again and post new logs from all.
Post #20
I turned off system restore and than did all the steps you just posted and here are the results I ran regsrch.vbs and it came up good to go so I ran it again just to make sure so here are the other two logs




Logfile of HijackThis v1.97.7
Scan saved at 2:13:08 PM, on 5/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\AVGANT~1\avgserv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
E:\PROGRA~1\AVGANT~1\avgcc32.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
E:\temp\Spy SweeperWebroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
E:\temp\Hijackthis\HijackThis.exe

O3 - Toolbar: Merriam-Webster - {9E1128F1-53FA-11D5-8490-0048548030CA} - C:\WINDOWS\Downloaded Program Files\m-wtoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Panicware Surf &Pal - {0ADCDFE7-8490-406D-91BF-88F71FD7F8AE} - E:\Program Files\surf pal\Surf Pal\pwicc.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG_CC] E:\PROGRA~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] E:\temp\Spy SweeperWebroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Collegiate &Dictionary - C:\Program files\Merriam-Webster Toolbar\dictionary.htm
O8 - Extra context menu item: Collegiate &Thesaurus - C:\Program files\Merriam-Webster Toolbar\thesaurus.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Add to Restricted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone (HKLM)
O9 - Extra button: Merriam-Webster (HKLM)
O9 - Extra button: Add to Trusted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7875.3880439815
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {F798683C-FE05-436C-B0FF-35B9122E9787} - http://www.m-w.com/tools/toolbar/cabs/m-w.cab


System Info:
E: "Local Disk(E:)" (7CC4:F04F) - FS:NTFS clusters:4k
Total: 122 935 001 088 [114G] - Free: 69 928 120 320 [65G]


Locked file(s) found…
\\?\C:\WINDOWS\System32\MSAHKM.DLL +++ File read error


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs"=""

REGEDIT4

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter]

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler]
@="AP Class Install Handler filter"
"CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate]
@="AP Deflate Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip]
@="AP GZIP Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml]
@="AP lzdhtml encoding/decoding Filter"
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml]
@="WebView MIME Filter"
"CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}"

Class Install Handler
{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}
C:\WINDOWS\system32\urlmon.dll

deflate
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

gzip
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

lzdhtml
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

text/html
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

text/plain
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

text/webviewhtml
{733AC4CB-F1A4-11d0-B951-00A0C90312E1}
%SystemRoot%\system32\SHELL32.dll


_______________________________


 I will stand by for your reply :thumbup:
Post #21
I think the site was down - I missed your last couple of posts.

Click here and download 'CopyLock'. Unzip it then click here to download and install Registrar Lite. You will need both tools. Reboot first and remain offline - print this page.

Method 1
*******

Open Copylock and set up these options:

-Check: 'Show Source paths'
-Check: 'Allow Downgrade'

Click the 'Add' tab->'Files to rename' In the 'Look in..' dialogue box navigate to your WINDOWS\System32 directory and stop there! (*you will not see the file!). Copy and paste into the 'File name' field: MSAHKM.DLL

Hit 'Add'. If you get an error here: "File not found" stop and move to Method 2.

If it works, in the result (destination) erase entire output (copy of…) and paste this instead: MSAHKM.DLX. Hit 'OK' and in main box menu hit the 'Apply' tab.

You will be asked to restart the computer. Do so right away. Next navigate to System32 and delete the MSAHKM.DLX file, as it'll now be visible.

Run HJT and findall.bat, post new logs for the final steps.

Method 2
*******

Use the Registrar Lite program you downloaded earlier. Navigate to (you can type the line directly into reglite address bar and hit 'go'):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Rename the Windows key in the left pane to something else - for example:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotWindows

(You should now be able to clear the hidden contents of the AppInit_DLLs value in the right pane without being undone by the hidden process.)

DoubleClick "Appinit_Dlls" value on right pane and erase the data on the lower box (in value field):

"C:\WINDOWS\System32\MSAHKM.DLL", hit 'apply' and 'ok' to set.

Rename NotWindows back to Windows in the left pane, close Registrar Lite and reboot the computer

If all goes well the hidden process will not run at startup and you should now be able to find and *see* the MSAHKM.DLL in C:\WINDOWS\System32.

Run findall.bat again and post a new log. Let me know if you can now see it.
Post #22
Yes sir Good Job ;) :thumbup: I can deffinetly see the file now I still can't open it with my hex tool but it's there here is the most current log of find all and here ya go Man I have to tell ya Daemon With your help I am stating to see the light at the end of the tunnel You Da Man !!!! :D System Info: E: "Local Disk(E:)" (7CC4:F04F) - FS:NTFS clusters:4k Total: 122 935 001 088 [114G] - Free: 69 926 612 992 [65G] Locked file(s) found… \\?\C:\WINDOWS\System32\MSAHKM.DLL +++ File read error REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "AppInit_DLLs"="" REGEDIT4 [HKEY_CLASSES_ROOT\PROTOCOLS\Filter] [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler] @="AP Class Install Handler filter" "CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate] @="AP Deflate Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip] @="AP GZIP Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml] @="AP lzdhtml encoding/decoding Filter" "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml] @="WebView MIME Filter" "CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}" Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} C:\WINDOWS\system32\urlmon.dll deflate {8f6b0360-b80d-11d0-a9b3-006097942311} C:\WINDOWS\system32\urlmon.dll gzip {8f6b0360-b80d-11d0-a9b3-006097942311} C:\WINDOWS\system32\urlmon.dll lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} C:\WINDOWS\system32\urlmon.dll text/html {8f6b0360-b80d-11d0-a9b3-006097942311} C:\WINDOWS\system32\urlmon.dll text/plain {8f6b0360-b80d-11d0-a9b3-006097942311} C:\WINDOWS\system32\urlmon.dll text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} %SystemRoot%\system32\SHELL32.dll _______________________________  I'll be waiting to hear from ya
Post #23
Using Explorer go to your root drive: C:\ and create new folder, name it: 'Junk'.

Unzip and run Winfile from here. Expand and navigate to System32 folder.

Open it up click File>Move…

Copy and paste this into the 'From' box: C:\WINDOWS\System32\MSAHKM.DLL
Copy and paste this into the 'To' box: C:\Junk\MSAHKM.DLL

And hit OK. Close Winfile and check in C:\Junk for that file. Let me know.
Post #24
Dude !!!! It Worked the bas turd is in the open Let me know when I can Shoot. I had an idea how this worked but the instructions were always broken up. I tried to put all the events in the rite order but it seemed that I was missing a few very important steps in the processes and with the efforts of your expertise we did the rite steps man what a long strange trip it’s been .Ok I am ready for the next step I still can’t open it with the hex tool Access Denied Is this where I learn how to use ATTRIB commands ? Waiting for your reply your friend in the Cyber World jkasj71 :thumbup:
Post #25
If you can't delete that file right-click the C:\Junk folder and hit properties. Click on security tab then the advanced button. Check the box that says reset permissions on all child objects. Hit apply.

You should now be able to delete the file and folder.

We also need to re-enable the BHO's. Click Start>run type regedit >OK

Expand this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects <– right-click that subfolder >Permissions>Advanced and check the 'inherit ..permissions' lower box, hit 'ok'.

Rescan with HJT and post a new log and let me know how you get on.
Post #26 last edited
Daemon I didwhat you told me,but when I did a right click on the folder and hit the properties security tab was not present.and well I finaly found out why that was.I found the answer under tools folder options and un checked Use simple file sharing (recommended) I am guessing that this hidden file DLL took control of that part of my PC also since it was there before I have seen that tab many many times before.I know My computer very well.And even better know I don't have to tell you.So here I am it took me a while to figer that one out had to do some soul searching and a lill help from my moms husband who by the way works for the state on all the computers but he couldn't help me here his option was [REBUILD] Because if a PC gets infected They would never even mess with all that I have been through they have what is called Cookie cut out OS reformat and reinstal and that's it . But that is not an option for me. so here I am can not DELETE yet when I try and delete it.It says Cannot delete MSAHKM:Access is denied Make sure the disc is not full or write protected and that the file is not currently in use.tried unchecking the Inherit from parent permission but nada. Sooooooooo here I am with my gun jamed and he's out in the open.So what next ? I'll be waiting for you reply thnx bro jkasj71
Post #27 last edited
Did you re-enable the BHO's following the instructions from my earlier post?

That file can't hurt you now - has about:blank returned since we quarantined it?

Try this - boot into Safe Mode by tapping F8 after the BIOS has loaded. Right-click on the C:\Junk\MSAHKM.DLL go to the Security tab>advanced and take ownership giving yourself 'Full control' (preferably to Administrators 'group'). Then repeat my instructions in my last post on the "junk" folder itself.

Let me know if yo are able to delete it now.
Post #28
Ok Daemon Sorry but I was a lill unsure on what it was that you were trying to explain took me a lill while but I figured out {FINALY} !!!!! I was able to delete it

but I am still dealing with part of the puzzle





Lavasoft Ad-aware Personal Build 6.181
Logfile created on :Sunday, May 09, 2004 8:54:50 PM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R303 08.05.2004
______________________________________________________

Reffile status:
=========================
Reference file loaded:
Reference Number : 01R303 08.05.2004
Internal build : 235
File location : E:\temp\ADWARE~1\ADWARE~1\AD-AWA~1\reflist.ref
Total size : 1096786 Bytes
Signature data size : 1078166 Bytes
Reference data size : 18556 Bytes
Signatures total : 24182
Target categories : 10
Target families : 463

Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium IV
Memory available:63 %
Total physical memory:392496 kb
Available physical memory:245196 kb
Total page file size:1141196 kb
Available on page file:1075988 kb
Total virtual memory:2097024 kb
Available virtual memory:2046956 kb
OS:

Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file


5-9-2004 8:54:50 PM - Scan started. (Smart mode)

Listing running processes
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 5-10-2004 2:30:19 AM
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\System32\
ThreadCreationTime : 5-10-2004 2:30:33 AM
BasePriority : High


#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 5-10-2004 2:30:36 AM
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Microsoft
Created on : 8/18/2001 12:00:00 PM
Last accessed : 5/10/2004 2:16:05 AM
Last modified : 8/18/2001 12:00:00 PM

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 5-10-2004 2:30:36 AM
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 8/18/2001 12:00:00 PM
Last accessed : 5/10/2004 2:15:35 AM
Last modified : 8/29/2002 10:41:26 AM

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 5-10-2004 2:30:40 AM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 8/18/2001 12:00:00 PM
Last accessed : 5/10/2004 2:16:36 AM
Last modified : 8/18/2001 12:00:00 PM

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 5-10-2004 2:30:40 AM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 8/18/2001 12:00:00 PM
Last accessed : 5/10/2004 2:16:36 AM
Last modified : 8/18/2001 12:00:00 PM

#:7 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 5-10-2004 2:31:01 AM
BasePriority : Normal
FileSize : 973 KB
FileVersion : 6.00.2800.1221 (xpsp2.030511-1403)
ProductVersion : 6.00.2800.1221
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Microsoft
Created on : 5/12/2003 3:12:10 AM
Last accessed : 5/10/2004 2:31:02 AM
Last modified : 5/12/2003 3:12:10 AM

#:8 [ad-aware.exe]
FilePath : E:\temp\ADWARE~1\ADWARE~1\AD-AWA~1\
ThreadCreationTime : 5-10-2004 2:31:30 AM
BasePriority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 4/23/2004 4:21:12 AM
Last accessed : 5/10/2004 2:27:53 AM
Last modified : 7/13/2003 3:00:20 AM

Memory scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 0


Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegValue
Data :
Category : Malware
Comment : "HOMEOldSP"
Rootkey : HKEY_LOCAL_MACHINE
Object : SOFTWARE\Microsoft\Internet Explorer\Main
Value : HOMEOldSP


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 1


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Possible browser hijack attempt : .Default\Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Category : Malware
Comment : Possible browser hijack attempt
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "about:blank"


Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 2


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Scanning Hosts file(C:\WINDOWS\System32\drivers\etc\hosts)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Hosts file scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
1 entries scanned.
New objects :0
Objects found so far: 2




Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
Value : ITBarLayout


Conditional scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 3


8:57:43 PM Scan complete

Summary of this scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Total scanning time :00:02:52:453
Objects scanned :48750
Objects identified :3
Objects ignored :0
New objects :3





And here is the new current HJT log





Logfile of HijackThis v1.97.7
Scan saved at 8:15:45 AM, on 5/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\AVGANT~1\avgserv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
E:\temp\Spy SweeperWebroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\devldr32.exe
E:\PROGRA~1\AVGANT~1\AVGCC32.EXE
E:\Program Files\AVG antivirus\avgw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\temp\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - E:\Program Files\surf pal\Surf Pal\CCHelper.dll
O2 - BHO: (no name) - {146FFC14-CAA9-4C18-A709-2CB6A2CDBC20} - (no file)
O3 - Toolbar: Merriam-Webster - {9E1128F1-53FA-11D5-8490-0048548030CA} - C:\WINDOWS\Downloaded Program Files\m-wtoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Panicware Surf &Pal - {0ADCDFE7-8490-406D-91BF-88F71FD7F8AE} - E:\Program Files\surf pal\Surf Pal\pwicc.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG_CC] E:\PROGRA~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] E:\temp\Spy SweeperWebroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Collegiate &Dictionary - C:\Program files\Merriam-Webster Toolbar\dictionary.htm
O8 - Extra context menu item: Collegiate &Thesaurus - C:\Program files\Merriam-Webster Toolbar\thesaurus.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Add to Restricted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone (HKLM)
O9 - Extra button: Merriam-Webster (HKLM)
O9 - Extra button: Add to Trusted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7875.3880439815
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {F798683C-FE05-436C-B0FF-35B9122E9787} - http://www.m-w.com/tools/toolbar/cabs/m-w.cab

I have updated all my antivirus and spyware deffientions to date May 10/04 and am now running full scans on my PC but I am sure there are a few steps left before I can say that this battle is won completely so I will wait for your response to you.


B)
Post #29
You've nailed it - well done :D

Set Ad-aware up like this. Click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done.

Then with only HJT running, have it fix:

O2 - BHO: (no name) - {146FFC14-CAA9-4C18-A709-2CB6A2CDBC20} - (no file)

We just need to reinstate the security settings on the key we renamed. Click Start>Run type regedit>OK. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

and right-click the key. UNcheck: "inherit permissions" box,-> Select COPY on next prompt. (That will restore last saved settings in database)

-Hilite "Everyone" (group/only!)->Select-> REMOVE!

-Hit 'Apply and 'ok' on all check boxes.

Sample pictures of correct/incorrect settings have been added to http://www10.brinkster.com/expl0iter/freeatlast/PVtool.htm

Let me know how you get on.
Post #30 last edited
Daemon We hit it on the head it’s gone completely gone. So far .This is the formula to CoolWebSearch Home Page Hijacker Trojan horse removal Tools and I would have to agree that this will probably work for most if not all. I knew we could do it good job and a huge kudos to ya bro I learned a lot over these past three weeks AKA [ SCHOOL OF HARD KNOCKS] and plan to continue on learning a whole lot more on how they develop and distribute these nasty computer viruses. The forum will rock now that there is a complete sequence of event’s that need to take place. it takes work to remove this virus it wasn’t easy but it can be accomplished prevention here is the best medicine surfing the internet is pretty risky business these days and is only going to get worse And Microsoft and ole Bill gates angry appetite for are hard earned money to build software to sell only to have to build patches to update us with daily updates just to keep are PC’s alive for one more day and with all the Crapeware advertisers working over time to jack us when were not looking and then theirs the Hackers that write this stuff of course they put a back door bundled with their version of legitimate files that they modify they trade on hacker forum web sites all day long to get all are goodies that the can .It was funny one day while I was waiting for a replay from the techs here I stumbled upon a website that turned out to be a under ground hackers site just got lucky while I was copying and pasting text files for a search on the internet browser and one of the moderators signature was as follows {I don’t have a my Documents folder I have a your Documents folder}which I thought was pretty funny since it’s true when someone gets one of these nasty computer viruses they are at the very mercy of the Attacker if they are not running any type of virus protection they are headed for a Whole lota trouble I run Comcast and a external hard wall fire wall port router a much better choice if you going to run High Speed on your PC because software is just what the name implies (It’s soft ware ) not hard ware but that’s just me to each there own I wont be using Microsoft’s Internet Explorer innless I absolutely have too I am spoiled with the next generation of Mozilla Firefox “…nothing short of a revelatory experience.”
- Maximum PC and“…a breath of fresh air… Microsoft should be worried.”
- FORBES http://www.mozilla.org/products/firefox/ I will tell all my friends FireFox 8.0 is the shnezzal nodoubt but what do I know Im surfing free now ….

Good Luck All Your Friend in the Cyber World Jkasj71 and Remember kiddies Surf safe and rap that rascal
:D :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI