Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
05-Nov-2006, 12:09 AM
#1 | |||||
| Browser Hijack, probable CWS, please help |
| |
05-Nov-2006, 11:23 AM
#3 | |||||
| Hi.........you have a pretty severe infection.....1st thing I would do is completely uninstall Norton because its totally bloody useless!!! I have not much time today but......... Run an online antivirus check from at least one and preferably 2 of the following sites... http://www.kaspersky.com/beta?product=161744315 http://housecall.trendmicro.com/ http://www3.ca.com/securityadvisor/virusinfo/scan.aspx http://www.pandasoftware.com/activescan/ http://antivirus.about.com/gi/dynami...%2Fdefault.asp Post a new log after and if you dont get help PM a Moderator. 
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security |
06-Nov-2006, 02:48 AM
#6 | |||||
| Update: went to http://aumha.org/win5/a/noads2.htm to possibly specifically identify what I have. I got the message... Your browser appears to have the "MySearch/MyWeb" parasite installed. This software can compromise your computer's security. It might have been installed without your knowledge. Information and removal instructions. Anyways, my friend advised me to look it up in the add/remove programs and there i found a program called mywebsearch (zwinky), also found some files when i searched for mywebsearch on my computer. Hope this all helps  |
07-Nov-2006, 03:25 PM
#10 | |||||
| spicy....your infected with all sorts of crap!!! Not just "MyWebSearch" but also a number of worms/virii You really need a better A/V than Norton ...which is doing a pathetic job. Uninstall Norton and download NOD32 from here: http://www.eset.com/ Make sure its updated and then run an indepth scan. I want to see if it will remove at least some of this infection. Let me know what it finds/removes and post a new log please.
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security |
12-Nov-2006, 07:34 AM
#12 | |||||
| Hi again...... You still need to remove Norton in Add/Remove Programs!! ======================================== Please Download MsnVirRem.exe to your desktop from one of the following http://downloads.malwareremoval.com/MsnVirRem.exe http://www.thespykiller.co.uk/forum/...tpmod;dl=item9
C:\msnvirrem.log along with a fresh HijackThis log
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security Last edited by $teve; 12-Nov-2006 at 07:46 AM.. |
13-Nov-2006, 02:37 AM
#13 | |||||
| Hi $teve, thanks for your ongoing support, I hate to go against your advice but my parents strictly prohibit me from uninstalling norton. I'd like to update you with some of the symptoms that I still have: -desktop and toolbar occasionally disappear, come back on restart though -I still don't have sound when I play winamp or windows media player, however it works for youtube and general internet surfing, it might have unconfigured it but Im not sure how to check. Just thought I'd lay that down in a quick easy to access list for you. Anyways following is the HJT and MSN log that you requested. Thank you msnvirem log : Infection file found, thats all it says, I followed your steps up until the last one, i forgot that i needed to double click and instead just restarted my computer, however I ran the program again and it didn't find any infections HJT Log: Logfile of HijackThis v1.99.1 Scan saved at 11:02:57 PM, on 12/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\WINDOWS\system32\DllHost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Abby Brown-John\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hiddenhour.blogspot.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by SHAW Internet R3 - URLSearchHook: (no name) - {01BE52CC-EF08-CBD2-2A55-B6CE65BFBEB0} - C:\WINDOWS\system32\zqfa.dll (file missing) R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvsew.dll,startup O4 - HKLM\..\Run: [uivfsoh.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\uivfsoh.dll,dmracjf O4 - HKLM\..\Run: [Ultimate Cleaner] C:\Program Files\Ultimate Cleaner\App.exe O4 - HKLM\..\Run: [UDC6cw] "C:\Program Files\DriveCleaner 2006 Free\UDC6cw.exe" -c O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Ncao] "C:\WINDOWS\system32\MANTEC~1\winlogon.exe" -vt yazb O4 - HKCU\..\Run: [Txgtjtis] C:\Program Files\Common Files\??mantec\scanregw.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/inst...l/pinstall.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136659099937 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.rightnowtech.com/702.../java/RntX.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe Last edited by Spicyice; 13-Nov-2006 at 03:10 AM.. |
13-Nov-2006, 05:37 PM
#14 | |||||
| Right click on the clock in your task bar, click on Task Manager, locate viewmgr.exe in the Processes tab, right click on it and select End Process. Then go into Add/Rem Programs and uninstall ViewPont Media Player ======================================================================= Run hijackthis again and put a checkmark against these entries....double check in case you miss anything.... .....then,close all browser and outlook windows INCLUDING THIS ONE and "fix checked" R3 - URLSearchHook: (no name) - {01BE52CC-EF08-CBD2-2A55-B6CE65BFBEB0} - C:\WINDOWS\system32\zqfa.dll (file missing) R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Ultimate Cleaner] C:\Program Files\Ultimate Cleaner\App.exe O4 - HKLM\..\Run: [UDC6cw] "C:\Program Files\DriveCleaner 2006 Free\UDC6cw.exe" -c O4 - HKCU\..\Run: [Ncao] "C:\WINDOWS\system32\MANTEC~1\winlogon.exe" -vt yazb O4 - HKCU\..\Run: [Txgtjtis] C:\Program Files\Common Files\??mantec\scanregw.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing ======================================================================= Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT...rc=sec_doc_nam Then as some of the files or folders you need to delete may be hidden do this: Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders" Click "Apply" then "OK"(reverse these steps when your clean!!) Locate and delete these files/folders: C:\WINDOWS\system32\MANTEC~ (This folder will have a longer name) C:\Program Files\Common Files\??mantec (Folder) C:\WINDOWS\system32\uivfsoh.dll (File) C:\Program Files\Ultimate Cleaner (Folder) C:\WINDOWS\system32\drvsew.dll (File) ============================== Empty the Recycle Bin. ============================== Go to Start > Run and type %temp% in the Run box, press OK . The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of that Temp folder. Then go to C:\windows\temp and select EVERYTHING except temporary internet files, cookies and history folders and delete all that and then do the same for C:\temp 1) Open Control Panel 2) Click on Internet Options 3) On the General Tab, in the middle of the screen, click on Delete Files 4) Check the box "Delete all offline content" 5) Click on OK.....wait for the hourglass icon to stop after it deletes the temporary internet files 6) You can now click on "Delete Cookies" and click OK to delete cookies that websites have placed on your hard drive ============================== Turn off System Restore: On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. (reverse these steps when you know your clean) Restart your computer into normal Windows. See how things are running and lets see another log. Now then....at least disable Norton from running,two A/V programs dont work! If your parents think Norton does a good job then let them take a look at all the crap it lets through.   Its the most popular A/V on the planet and probably one of the worst. 
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 10:16 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile