|
WE HAVE MOVED. Please see our NEW Computer Forums |
11-25-2009: Sorry for the inconvenience. We finally upgraded to vBulletin 3 !! See you there, Larry 'about:blank Quick Web Search' Help much appreciated!Go to the Tech-Forums Discussion Home PagePosted by: bluebledthesea My mother's computer was been infected with all sorts of spyware, trogans, malware etc. I've run AVG, Adaware, Spybot and Winpatrol to get rid of a lot of it, but some still persists. Most noticeably is 'Quick Web Search' taking over IE with about:blank. (We do use Firefox, but it would be nice to clean out everything.) Here is a copy of the HijackThis logfile. Any help would be appreciated! Thank you so much: Logfile of HijackThis v1.99.1 Scan saved at 2:17:55 PM, on 3/30/2005 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\WINNT\System32\svchost.exe C:\WINNT\system32\LxrJD31s.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\WINNT\iecr32.exe C:\Program Files\EarthLink 5.0\updatemgr.exe C:\Program Files\EarthLink 5.0\ConMgr.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINNT\System32\mrtMngr.EXE C:\WINNT\System32\HPZipm12.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\hijackthis\HijackThis.exe C:\Program Files\EarthLink 5.0\CHCKNET.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xvlhv.dll/sp.html#37049 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {3F3C09C9-AD17-2579-FA98-6732FEE6300C} - C:\WINNT\sysgf.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - [url]http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab[/url] O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - [url]http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab[/url] O20 - Winlogon Notify: ATINotify - logonnfy.dll (file missing) O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\mfcjw.exe (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINNT\SYSTEM32\LxrJD31s.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe Posted by: Lobos Please print out or copy this page to [B]Notepad[/B] in order to assist you when carrying out the following instructions. Please download CWSserviceRemove([url]http://castlecops.com/modules/Forums/attachments/cwsserviceremove_568.zip[/url]). Unzip it to your desktop we'll run it later. Download, unzip to your desktop [url=http://www.majorgeeks.com/download4289.html]About:Buster[/url] and run it, then: 1. Click "[b][i]Update[/i][/b]". 2. Click "[b][i]Check For Update[/i][/b]" Close the program If you don't already have it, download, install and run [url=http://www.lavasoft.de/support/download/]AdAware SE Personal[/url]. - Next, check for, and download any available updates: 1. click "[b][i]Check for updates now[/i][/b]". 2. Click "[b][i]Connect[/i][/b]". 3. If updates(definitions) are available click "[b][i]Ok[/i][/b]", otherwise, click "[b][i]Ok[/i][/b]". 4. Click "[b][i]Finish[/i][/b]". close the program Download, unzip to your desktop [url=http://www.intermute.com/spysubtract/cwshredder_download.html]CWShredder[/url] and run it, then: 1. Click "[b][i]Check For Update[/i][/b]" make sure your version is 2.14 ([i]If an update isn't available, skip to step #4.[/i]) 2. Click "[b][i]Click here to Download the upate[/i][/b]". 3. When the new version has been downloaded, click "[b][i]Save[/i][/b]". close the program ------------------------ Safemode: Some motherboards have F8 bound as the boot menu, but if you wait till the BIOS screen summary goes away, then hit F8, it should take you into the Windows startup screen. If you still can't get to the menu with Safe Mode you can do it this way: Close all open programs as this will require a reboot. Click Start, Run and type in [b]MSCONFIG[/b] and click [b]OK [/b] The System Configuration Utility appears, click on the BOOT.INI tab, Check the "/SAFEBOOT" option, and then click OK and Restart your computer when prompted. The computer will restart in Safe mode. [b]Complete the instructions below.[/b] [b][color=red]When you are finished in Safe mode, open MSCONFIG again, on the BOOT.INI tab, uncheck "/SAFEBOOT" and click OK to restart your computer [/color][/b] -------------------------- Go to Start->Run and type in services.msc and hit OK. Then look for [b]Remote Procedure Call (RPC) Helper[/b] Double click on it. Click on the Stop button and under Startup type, choose Disabled. [b]DO NOT DISABLE [color=red]Remote Procedure Call (RPC)[/color] OR [color=red]Remote Procedure Call (RPC) Locator[/b][/color] Open Hijack This and click on Scan. Check the following entries, [color=red]if they are still there.[/color][B](make sure you do not miss any)[/B] [b]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xvlhv.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xvlhv.dll/sp.html#37049 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xvlhv.dll/sp.html#37049 O2 - BHO: (no name) - {3F3C09C9-AD17-2579-FA98-6732FEE6300C} - C:\WINNT\sysgf.dll O20 - Winlogon Notify: ATINotify - logonnfy.dll (file missing) O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\mfcjw.exe (file missing) [/b] [B][I]Please remember to close all other windows, including browsers then click Fix checked.[/I][/B] Delete the following Files indicated in [b][color=red]RED[/color][/b] and Folders indicated in [b][color=blue]BLUE[/color][/b][B] if they still exist.[/B] C:\WINNT\[b]sysgf.dll[/b] << This file C:\WINNT\[b]xvlhv.dll[/b] << This file C:\WINNT\[b]iecr32.exe[/b] << This file Now double-click on the cwsserviceremove.reg file and when it prompts to merge, say Yes. This will clear some registry entries left behind by the malware infections. then run these three in a row CWShredder.exe aboutbuster.exe. ad-aware comeback and post a new hijackthis log and the about buster logs let me know how it went Lobos Posted by: Warez Monster Remove entries at your own risk R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xvlhv.dll/sp.html#37049 Nasty This entry should be fixed by HijackThis! R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xvlhv.dll/sp.html#37049 Nasty This entry should be fixed by HijackThis! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank Possibly nasty This page could possibly be nasty. If you do not know the entry 'about :blank', delete it. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\xvlhv.dll/sp.html#37049 Nasty This entry should be fixed by HijackThis! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xvlhv.dll/sp.html#37049 Nasty This entry should be fixed by HijackThis! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xvlhv.dll/sp.html#37049 Nasty This entry should be fixed by HijackThis! R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xvlhv.dll/sp.html#37049 Nasty This entry should be fixed by HijackThis! R3 - Default URLSearchHook is missing Should be fixed if you do not know the application or if no application is mentioned. This entry should be fixed. O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - [url]http://a840.g.akamai.net/7/840/537/...all/xscan53.cab[/url] This entry is possibly nasty. Should be fixed. Please Visit the Online Configurator, Email Hosting, Internet Marketing , Computer Schools , Software for Real Estate , AAOutlook , Search Engine Site |