Hey People, I'm working on a customers computer that's been hijacked by Cool Web Search. I've tried everything...spybot, CWShredder, Norton, Panda etc. Trendmicro won't run..I get an internet explorer error. Here's my Hijack this log...I'll be checking back in a couple of hours...gotta get away from this comp before I kill it. Thanks guys.
Logfile of HijackThis v1.97.7
Scan saved at 4:01:25 PM, on 30/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc3
C:\windows\system\hpsysdrv
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-0
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-F
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-8
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtr
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.ex
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O9 - Extra button: TREND MICRO HouseCall (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.
O16 - DPF: {0E5F0222-96B9-11D3-8997-0
O16 - DPF: {74D05D43-3236-11D4-BDCD-0
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5
O16 - DPF: {9F1C11AA-197B-4942-BA54-4
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O16 - DPF: {EF791A6B-FC12-4C68-99EF-F
Hope for a quick response
P.S. spybot and cwshredder were both updated versions.
<--CREE-->
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Get rid of these using Hijack this
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-
Hello cree_comp =)
>> R0 - HKCU\Software\Microsoft\In
>> R1 - HKCU\Software\Microsoft\In
>> R0 - HKLM\Software\Microsoft\In
>> R1 - HKLM\Software\Microsoft\In
>> R1 - HKCU\Software\Microsoft\Wi
>> R0 - HKCU\Software\Microsoft\In
>> R0 - HKLM\Software\Microsoft\In
>> R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-
O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-0
======================
Fix these entries !!!!
!! GOOD LUCK !!
Then run these
Double Check for viruses
Online Scanners
Norton Web Services
Virus Detection provides an analysis of your results and offers suggestions for further action. It does not examine compressed files or fix infected files.
When Symantec receives notification about a new virus, we develop and post a solution as quickly as possible. We are committed to providing swift responses to all virus threats, including Trojan horses.
http://security.symantec.c
======================
Trend Micro HouseCall
http://housecall.antivirus
======================
eTrust Online antivirus scanner
http://www3.ca.com/virusin
======================
PC Pitstop Virus Scan
When the download completes, you will receive an ActiveX security dialog for the PC Pitstop virus scanner. Click Yes to install the scanner and proceed to the virus scan.
If you are currently running an antivirus package such as Norton Antivirus, it may detect our own virus detection file as a virus. If this occurs and you wish to use our scanner, please (temporarily) disable any active background virus checking software before scanning, or add our signature file (PAV.SIG) to the scanner's file exclusion list
http://www.pcpitstop.com/a
Hi cree_comp,
Tick the checkbox in front of these lines and click "fix checked"
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-
O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-0
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-8
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.ex
Greetings,
LucF
>> O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.ex
LucF check here >> http://www.liutilities.com
:)
Hey guys...thanks for all the suggestions...sorry to say none of them worked. I checked all the items that everyone suggested in HijackThis and clicked fix...but they showed right up again as soon as I opened my browser. I did all the online scans...and they found alot of stuff and deleted or fixed them...but I still get redirected. Could this be a new string of the CoolWWWSearch? I also disabled everything in msconfig startup. That didn't work too. Anyway, thanks for all the suggestions so far...be back to check after work.
<--CREE-->
Try other tools in this list aswell
http://www.experts-exchang
That might help ..
If u have another user on the system(if u dont then create a new user), then try loggin there and check if u face the saem problem there also or not ??
if NO then this problem is ONLY ONE PROFILE problem, and we can transfer ur damage profile to the new one,,,,,
How to copy data from a corrupted user profile to a new profile:
http://support.microsoft.c
Hi!
Start regedit and navigate to the following key: (you may want to back up this key!)
[HKEY_LOCAL_MACHINE\SOFTWA
"System"=-
Delete the following CLSID's -
[HKEY_CLASSES_ROOT\CLSID\{
[HKEY_CLASSES_ROOT\CLSID\{
[HKEY_CLASSES_ROOT\CLSID\{
It's also, probably a good idea to do a complete registry search for any other instances of the above CLSID's
and delete any instances that you find.
Then, search your computer for any instances of - system32.dll (probably in C:\WINDOWS\system32 folder) and
delete all instances you find - search your whole system though, just to be sure.
Next, have HijackThis fix the following:
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-
O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-0
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-8
Then, clean out ALL your temp files, including all those within all users in "Documents and Settings", delete your
"Temporary Internet Files", including "Delete all offline content" and cookies, empty the recycle bin.
Reboot your computer and, hopefully, it's gone.
One important note about this pest - quite often, it attacks the updater modules for Antivirus programs.
So, check on your ability to run Anti-virus updates - you may have to reinstall your anti-virus program. (Ouch!)
Or rely on manual updates.
Good luck!
Business Accounts
Answer for Membership
by: sunray_2003Posted on 2004-05-30 at 13:07:27ID: 11192298
remove these
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In