Help with clicksearchclick.com

[redneckokie]

I need help getting rid of this clicksearchclick. I am at my wits end, I have tried everything I could think of. I used both hijack this and xoftspy. The xoftspy found it and said it deleted it and when I started the computer up again there is was again.....
Also Xoftspy is finding agbot.fx, but it wouldn't delete that either.

I have enclosed my hijack this report.

Any help would be greatly appreciated!!

Logfile of HijackThis v1.99.1
Scan saved at 1:03:19 PM, on 7/3/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\XoftSpy\XoftSpy.exe
C:\Documents and Settings\Redneckokie\Desktop\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\AUserInit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthBHO.cBHO - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - C:\Program Files\Cox\Applications\app\AuthBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9620D33362C1} - C:\Program Files\Cox\Applications\app\AuthBHO.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunOnce: [XoftSpy] "C:\Program Files\XoftSpy\XoftSpy.exe" -b
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [wupd] C:\WINDOWS\System32\win32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120306645559
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: System - {3C1384AF-EE7E-4DFC-80D0-E1B281118DB4} - vr_sys.dll (file missing)
O23 - Service: Curtains for Windows System Service (CurtainsSysSvc) - Authentium, Inc. - c:\program files\cox\applications\app\CurtainsSysSvcNt.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe

 

[D_Trojanator]

From previous experience xoft spyware is crap, try spybot S+D or pctools.com spyware doctor.
TRhen try ewido which i think personally is the best.
All can be found by using google.

 

[Flrman1]

Hi redneckokie

Welcome to TSG!

* Go here to download CCleaner.

• Install CCleaner
• Launch CCleaner and look in the upper right corner and click on the "Options" button.
• Click "Advanced" and remove the check by "Only delete files in Windows temp folders older than 48 hours".
• Click OK
• Do not run CCleaner yet. You will run it later in safe mode.

* Click Here and download Killbox and save it to your desktop.


* Click here for info on how to boot to safe mode if you don't already know how.


* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to.


* Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

O4 - HKCU\..\Run: [wupd] C:\WINDOWS\System32\win32.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O21 - SSODL: System - {3C1384AF-EE7E-4DFC-80D0-E1B281118DB4} - vr_sys.dll (file missing)


* Restart your computer into safe mode now. Perform the following steps in safe mode:


* Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste the following line then click on the button that has the red circle with the X in the middle. It will ask for confimation to delete the file. Click Yes.

C:\WINDOWS\System32\win32.exe

Exit the Killbox.


* Start Ccleaner and click Run Cleaner


* Go to Control Panel > Internet Options. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


* Restart back into Windows normally now.


* Go here and download Ad-Aware SE.

• Install the program and launch it.
• First in the main window look in the bottom right corner and click on Check for updates now
• Click Connect and download the latest reference files.
• From main window click Start then under Select a scan Mode tick Perform full system scan.
• Next deselect Search for negligible risk entries.
• Now to scan just click the Next button.
• When the scan is finished mark everything for removal and get rid of it.
• Right-click the window and choose select all from the drop down menu and click Next
• Restart your computer.

* Run ActiveScan online virus scan here

When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
- Save the results from the scan!

Post a new HiJackThis log along with the results from ActiveScan

 

[redneckokie]

Hi Flrman1, I followed the directions on your post and I still have the clicksearchclick....I am enclosing the hijack report and the virus scan......

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cox\Applications\app\Prism.exe
c:\program files\cox\applications\app\CurtainsSysSvcNt.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.EXE
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Redneckokie\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=19
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\AUserInit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AuthBHO.cBHO - {A4D90779-6CB2-4752-83C2-A2AB4D9A672D} - C:\Program Files\Cox\Applications\app\AuthBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9620D33362C1} - C:\Program Files\Cox\Applications\app\AuthBHO.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.EXE
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120306645559
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

Incident Status Location

Adware:Adware/CWS.Yexe No disinfected C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.DLL
Adware:Adware/Startpage.XY No disinfected C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST32.DLL
Adware:Adware/WinTools No disinfected C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.EXE
Adware:Adware/WinTools No disinfected C:\WINDOWS\System32\Services\{AC6B6~1\SVCHOST.EXE
Adware:Adware/CWS.Yexe No disinfected C:\WINDOWS\System32\Services\{AC6B6~1\SECURITY.EXE
Adware:Adware/CWS No disinfected C:\WINDOWS\System32\services\
Adware:Adware/CWS.Yexe No disinfected C:\WINDOWS\System32\services
Adware:Adware/WinTools No disinfected C:\sys.exe
Adware:Adware/MediaTickets No disinfected Windows Registry
Adware:Adware/Adsmart No disinfected C:\WINDOWS\System32\vx.tll
Virus:Trj/Hooker.G Disinfected Operating system
Adware:Adware/Searchterror No disinfected Windows Registry
Virus:Bck/Pidor.A Disinfected Operating system
Adware:Adware/SpySheriff No disinfected C:\winstall.exe
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc3\SECURITY.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc3\SECURITY.EXE
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc3\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc3\SVCHOST.EXE
Adware:Adware/Startpage.XY No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc3\SVCHOST32.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc4\SECURITY.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc4\SECURITY.EXE
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc4\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc4\SVCHOST.EXE
Adware:Adware/Startpage.XY No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc4\SVCHOST32.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc5\SECURITY.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc5\SECURITY.EXE
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc5\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc5\SVCHOST.EXE
Adware:Adware/Startpage.XY No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc5\SVCHOST32.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc6\SECURITY.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc6\SECURITY.EXE
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc6\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc6\SVCHOST.EXE
Adware:Adware/Startpage.XY No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc6\SVCHOST32.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc7\SECURITY.DLL
Adware:Adware/CWS.Yexe No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc7\SECURITY.EXE
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc7\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc7\SVCHOST.EXE
Adware:Adware/Startpage.XY No disinfected C:\RECYCLER\S-1-5-21-329068152-861567501-839522115-1003\Dc7\SVCHOST32.DLL
Adware:Adware/WinTools No disinfected C:\sys.exe
Adware:Adware/CWS.Yexe No disinfected C:\WINDOWS\system32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.DLL
Adware:Adware/CWS.Yexe No disinfected C:\WINDOWS\system32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.EXE
Adware:Adware/WinTools No disinfected C:\WINDOWS\system32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.DLL
Adware:Adware/WinTools No disinfected C:\WINDOWS\system32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.EXE
Adware:Adware/Startpage.XY No disinfected C:\WINDOWS\system32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST32.DLL
Adware:Adware/Adsmart No disinfected C:\WINDOWS\system32\vx.tll
Adware:Adware/SpywareNo No disinfected C:\WINDOWS\system32\vxh8jkdq2.exe
Adware:Adware/Adsmart No disinfected C:\WINDOWS\system32\vxh8jkdq7.exe
Adware:Adware/SpywareNo No disinfected C:\winstall.exe

 

[Flrman1]

* Click here to download smitRem.zip.

• Save the file to your desktop.
• Unzip smitRem.zip to extract the two files it contains.
• Do not do anything with it yet. You will run the RunThis.bat file later in safe mode.

* Download the trial version of Ewido Security Suite here.

• Install ewido.
• During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Launch ewido
• It will prompt you to update click the OK button and it will go to the main screen
• On the left side of the main screen click update
• Click on Start and let it update.
• DO NOT run a scan yet. You will do that later in safe mode.

* Click here for info on how to boot to safe mode if you don't already know how.



* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.



* Click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"



* Restart your computer into safe mode now. Perform the following steps in safe mode:



* Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=19

O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.EXE

O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present



* Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.



* Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.EXE

C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.DLL

C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST32.DLL

C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SECURITY.EXE

C:\WINDOWS\System32\Services\{AC6B6404-CF12-402D-8A11-1A678F5B69CD}\SVCHOST.DLL

C:\sys.exe

C:\WINDOWS\System32\vx.tll

C:\WINDOWS\system32\vxh8jkdq2.exe

C:\WINDOWS\system32\vxh8jkdq7.exe

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

Exit the Killbox.



* Run Ewido again:

• Click on scanner
• Put a check by the following before you scan:
  • Binder
    [*]Crypter
    [*]Archives
• Click the Start Scan button to start the scan.
• During the scan it will prompt you to clean files, click OK
• When the scan is finished, look at the bottom of the screen and click the Save report button.
• Save the report to your desktop

* Start Ccleaner and click Run Cleaner



* Go to Control Panel > Internet Options. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.



* Next go to Control Panel > Display. Click on the "Desktop" tab then click the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" you should see an entry checked called something like "Security info" or similar. If it is there, select that entry and click the "Delete" button. Click OK then Apply and OK.



* Restart back into Windows normally now.



* Download DelDomains.inf from here.

Rightclick DelDomains.inf and choose install.



* Go here and do an online virus scan. Choose "Complete Scan" and select all drives to scan.

When the scan is finished, anything that it cannot clean have it delete it. Click "Print Report". The report will open in your browser. Go to File > Save As and save the file to your desktop. Under "Save as type" click the dropdown menu and choose "Text file (*.txt) and save it as a text file.

Post a new HiJackThis log along with the report from the Housecall scan