Mal/adware invasion

Spybot has started reporting 4 entries of 'coolwwwsearch.badzonemap' (CWS) which it fixes. However, after every re-start, CWS is back again. Following the advice of a friend I installed Lavasoft Ad-Ware Personal SE & updated it to V7.5. It always reports 'downloader.delf', 'trackingcookie.2o7', 'adware.bugdoctor' BUT NOT 'CWS'. I delete or quarintine the malwares but they returen after every re-start. My PC is hanging frequently, usually when I'm surfing the WWW. I would be grateful for assistance.

CAVT

Welcome to Tom Coyote

You need to post a Hijackthis log for us to be able to assist you

Click http://ralphcaddell.com/Uploads/HjThis.exe to download a self extractable version of hijackthis.Double-click on hijackthis.exe to extract hijackthis to folder c:\hijackthis.
It will extract it to that folder and open the folder for you.
It will also create a shortcut on your desktop to Hijackthis.
Then run Hijackthis Select Scan and save logfile
When the scan complete's it will open in Notepad. Press Cntrl+A, Rt Click to copy and paste that log as a reply to this thread

thanks bamajim

CAVT

We need to temporarily disable Spybot S&D so it does not interfere with our fix

Disable Spybot S&D "resident tea timer"1) Run Spybot-S&D
2) Go to the Mode menu, select "Advanced Mode"
3) In the left pane, click Tools ->> Resident
4)Uncheck "Resident TeaTimer" and OK any prompts
5) Reboot your PC
Next Re Run Hijackthis (scan only) and place checks beside the following entryO2 - BHO: (no name) - {826B2228-BC09-49F2-B5F8-42CE26B1B712} - (no file)
Close all other open windows except Hijackthis and Select "Fix checked" and close Hijackthis

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

thanks bamajim

Neil - 06-12-09 22:03:36.89 Service Pack 2 ComboFix 06.11.27W - Running from: "C:\Data\Software" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) D:\WINDOWS\system32\winsys.exe ((((((((((((((((((((((((((((((( Files Created from 2006-11-09 to 2006-12-09 )))))))))))))))))))))))))))))))))) 2006-12-08 14:33 d——– D:\WINDOWS\WBEM 2006-12-06 12:42 d——– D:\6f900c79a05f4005784abe34d9d94067 2006-12-04 23:38 d——– D:\WINDOWS\system32\en-US 2006-12-04 23:37 d–h-c— D:\WINDOWS\ie7 2006-12-04 23:36 121,856 ——— D:\WINDOWS\system32\xmllite.dll 2006-12-04 23:36 d——– D:\WINDOWS\network diagnostic 2006-12-02 23:05 d——– D:\Documents and Settings\Neil\Application Data\Real 2006-12-02 22:24 3,968 –a—— D:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-02 22:23 d——– D:\Program Files\Grisoft 2006-12-02 22:19 d——– D:\Program Files\Lavasoft 2006-12-02 22:19 d——– D:\Documents and Settings\Neil\Application Data\Lavasoft 2006-11-30 22:00 24,072 –a—— D:\WINDOWS\system32\uxtuneup.dll 2006-11-25 05:41 151,552 ——— D:\WINDOWS\crllyrnt.dll 2006-11-25 05:41 d——– D:\Corel (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-08 14:32 ——– d——– D:\Program Files\Internet Explorer 2006-12-02 23:52 ——– d—s—- D:\Documents and Settings\Neil\Application Data\Microsoft 2006-11-30 22:00 ——– d——– D:\Program Files\TuneUp Utilities 2006 2006-11-07 21:03 6049280 ——— D:\WINDOWS\system32\ieframe.dll 2006-11-07 21:03 50688 ——— D:\WINDOWS\system32\msfeedsbs.dll 2006-11-07 21:03 458752 ——— D:\WINDOWS\system32\msfeeds.dll 2006-11-07 21:03 413696 –a—— D:\WINDOWS\system32\vbscript.dll 2006-11-07 21:03 231424 –a—— D:\WINDOWS\system32\webcheck.dll 2006-11-07 21:03 180736 ——— D:\WINDOWS\system32\ieui.dll 2006-11-07 21:03 156160 –a—— D:\WINDOWS\system32\msls31.dll 2006-11-07 03:27 382976 –a—— D:\WINDOWS\system32\iedkcs32.dll 2006-11-07 03:27 229376 –a—— D:\WINDOWS\system32\ieaksie.dll 2006-11-07 03:26 71680 –a—— D:\WINDOWS\system32\admparse.dll 2006-11-07 03:26 55296 –a—— D:\WINDOWS\system32\iesetup.dll 2006-11-07 03:26 54784 –a—— D:\WINDOWS\system32\ie4uinit.exe 2006-11-07 03:26 43008 –a—— D:\WINDOWS\system32\iernonce.dll 2006-11-07 03:26 152064 –a—— D:\WINDOWS\system32\ieakeng.dll 2006-11-07 03:26 13312 –a—— D:\WINDOWS\system32\ieudinit.exe 2006-11-07 03:26 123904 –a—— D:\WINDOWS\system32\advpack.dll 2006-11-07 03:25 161792 –a—— D:\WINDOWS\system32\ieakui.dll 2006-11-04 14:14 1245696 –a—— D:\WINDOWS\system32\msxml4.dll 2006-10-25 09:53 ——– d——– D:\Documents and Settings\Neil\Application Data\Roxio 2006-10-24 16:13 45056 –a—— D:\WINDOWS\system32\WNASPI32.DLL 2006-10-24 16:13 16512 –a—— D:\WINDOWS\system32\drivers\ASPI32.SYS 2006-10-20 04:20 ——– d——– D:\Documents and Settings\Neil\Application Data\Google 2006-10-19 22:25 ——– d——– D:\Program Files\Google 2006-10-17 12:06 78336 –a—— D:\WINDOWS\system32\ieencode.dll 2006-10-17 12:05 40960 –a—— D:\WINDOWS\system32\licmgr10.dll 2006-10-17 12:05 206336 ——— D:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 12:05 105984 –a—— D:\WINDOWS\system32\url.dll 2006-10-17 12:04 101376 –a—— D:\WINDOWS\system32\occache.dll 2006-10-17 12:03 17408 –a—— D:\WINDOWS\system32\corpol.dll 2006-10-17 11:58 61952 ——— D:\WINDOWS\system32\icardie.dll 2006-10-17 11:58 12288 ——— D:\WINDOWS\system32\msfeedssync.exe 2006-10-17 11:57 36352 –a—— D:\WINDOWS\system32\imgutil.dll 2006-10-17 11:57 266752 –a—— D:\WINDOWS\system32\iertutil.dll 2006-10-17 11:56 45568 –a—— D:\WINDOWS\system32\mshta.exe 2006-10-17 11:28 48128 –a—— D:\WINDOWS\system32\mshtmler.dll 2006-10-17 11:27 380928 ——— D:\WINDOWS\system32\ieapfltr.dll 2006-10-14 11:30 ——– d——– D:\Program Files\MSXML 4.0 2006-10-13 12:35 142336 –a—— D:\WINDOWS\system32\nwprovau.dll 2006-09-25 15:45 666240 –a—— D:\WINDOWS\system32\aswBoot.exe 2006-09-25 15:37 90112 –a—— D:\WINDOWS\system32\AVASTSS.scr 2006-09-13 05:01 1084416 –a—— D:\WINDOWS\system32\msxml3.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "SpybotSD TeaTimer"="D:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "swg"="D:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe" "ctfmon.exe"="D:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "Logitech Utility"="Logi_MwX.Exe" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "avast!"="D:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\ 6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00 @="" "dla"="D:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "C-Media Mixer"="Mixer.exe /startup" "BigDogPath"="D:\\WINDOWS\\VM_STI.EXE VideoCam 330Pro" "NvCplDaemon"="RUNDLL32.EXE D:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "!AVG Anti-Spyware"="\"D:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="D:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="D:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "CTFMON.EXE"="D:\\WINDOWS\\System32\\ctfmon.exe" "Desktop Architect"="\"D:\\Program Files\\Desktop Architect\\datray.exe\" -S" "Start WingMan Profiler"="\"D:\\Program Files\\Logitech\\Profiler\\lwemon.exe\" /noui" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "zBrowser Launcher"="D:\\Program Files\\Logitech\\iTouch\\iTouch.exe" "BigDogPath"="D:\\WINDOWS\\VM_STI.EXE VIMICRO USB PC Camera" "nwiz"="nwiz.exe /install" "Adobe Photo Downloader"="\"D:\\Program Files\\Adobe\\Photoshop Elements 4.0\\apdproxy.exe\"" "RemoteControl"="\"D:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "Ulead AutoDetector v2"="D:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\monitor.exe" "SunJavaUpdateSched"="D:\\Program Files\\Java\\j2re1.4.2_04\\bin\\jusched.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20061209-174529-920 O2 - BHO: (no name) - {826B2228-BC09-49F2-B5F8-42CE26B1B712} - (no file) Contents of the 'Scheduled Tasks' folder D:\WINDOWS\tasks\1-Click Maintenance.job D:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-12-09 22:04:13.93 D:\ComboFix.txt … 06-12-09 22:04

CAVT

Sorry for the delay

Looking Better

Run an online virus scan called Kaspersky from HERE.1. Click on "Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on "Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on "Next"->>"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
5. Then click on "My Computer". And the scan will start.
6. Once finished, save a log as ".txt" to the desktop.
Copy and post the results of the Kaspersky Online scan

thanks bamajim

Dear Bamajim, After many attempts i was eventually able to run kaspersky but it hung everytime. IE also was hanging (freezing) & two new malwares turned up according to Spybot. My situation had become time critical so I resorted to windows restore but that wouldn't work. I tried 4 different restore points but non worked. I ended up re-formating the hard disk last night & so the problem has ended. I've learnt a lot from my first encounter with spy/malware, mostly down to you. Thank you so much for your time & effort on my behalf. Have a relaxing holdiay!