Hijacked by www.motor-search.info

[tkwa11]

HI
Can somebody help me get rid of this pesky hijacker? I can run hijackthis and remove all the obvious "motor-search " entries but the pesky blighter is embedded elsewhere and comes back everytime I reboot. It also adds all sorts of unwanted 'favourites' to my web browser. (I.E. V 6.++)
The hijackthis log is attached. Please help? I tried using the registry backup and system restore to get back to a prior date but did not succeed for fear of undoing stuff I actually need.
Anyone...??
Thanks

 

[Flrman1]

Hi tkwa11

Welcome to TSG!

I am pasting your log in the thread. It is easier to analyze that way.

Give me a few minutes to look it over.


Logfile of HijackThis v1.97.3
Scan saved at 5:42:00 PM, on 1/04/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\CBA\PDS.EXE
C:\WINDOWS\SYSTEM\CBA\XFR.EXE
C:\PROGRAM FILES\INTEL\BOOTSTRAP AGENT\BSA.EXE
C:\PROGRAM FILES\INTEL\LDCM\BIN\IIDS.EXE
C:\WINDOWS\SYSTEM\MSGSYS.EXE
C:\PROGRAM FILES\INTEL\DMI\BIN\WIN32SL.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\INTEL\LDCM\BIN\USM.EXE
C:\WINDOWS\SYSTEM\WF2K.EXE
C:\PROGRAM FILES\SENSAURA\VIRTUAL EAR\VETRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\RDC-I_SOFTWARE\HTTPMT.EXE
C:\PROGRAM FILES\INTEL\LDCM\BIN\SSM.EXE
C:\MY DOCUMENTS\MY PICTURES\PHOENIX\HIJACKTHIS.EXE
C:\PROGRAM FILES\INTEL\LDCM\CI\CIMGR\CIMGR.EXE
C:\PROGRAM FILES\INTEL\LDCM\CI\INSTRUMENTATION\IOSMAL.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.motor-search.info/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.motor-search.info/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.motor-search.info/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.motor-search.info/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.motor-search.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.motor-search.info/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.motor-search.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.motor-search.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.motor-search.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.motor-search.info/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.motor-search.info/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [User Space Manager] C:\Program Files\Intel\LDCM\Bin\USM.exe
O4 - HKLM\..\Run: [WinFast_2K] C:\WINDOWS\SYSTEM\WF2K.EXE
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [VIRTEAR] C:\Program Files\Sensaura\Virtual Ear\vetray.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdobeFonts] C:\WINDOWS\FONTS\fonts.hta
O4 - HKLM\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Intel PDS] C:\WINDOWS\system\cba\pds.exe
O4 - HKLM\..\RunServices: [Intel File Transfer] C:\WINDOWS\system\cba\xfr.exe
O4 - HKLM\..\RunServices: [TMA Distribution] C:\WINDOWS\system\cba\lcfinst.exe
O4 - HKLM\..\RunServices: [Intel Bootstrap Agent] C:\PROGRAM FILES\INTEL\BOOTSTRAP AGENT\BSA.EXE
O4 - HKLM\..\RunServices: [DMIStart] C:\Program Files\Intel\LDCM\DMIStart.exe
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: RDC-i Virtual server process.lnk = C:\Program Files\RDC-i_Software\httpmt.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - https://www.ps.symetry.com.au/class/ScriptX.cab

 

[Flrman1]

Click here to download CWShredder. Close all browser windows,UnZip the file, click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.

When it is finished restart your computer.

IMPORTANT!: To help prevent this from happening again, I strongly recommend you install the patches for the vulnerabilities that this hijacker exploits.

The simplest way to make sure you have all the security patches is to go to Windows update and install all "Critical Updates and Service Packs"

Come back here and post another Hijack This log and we'll get rid of what's left.