Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

You have a nasty CoolWebSearch infection [CLOSED]


  • This topic is locked This topic is locked

#1
nosnit

nosnit

    New Member

  • Member
  • Pip
  • 4 posts
Here is my log from SpSeHjfix.

(5/5/05 12:10:03 PM) SPSeHjFix started v1.1.2
(5/5/05 12:10:03 PM) OS: Win2000 Service Pack 4 (5.0.2195)
(5/5/05 12:10:03 PM) Language: english
(5/5/05 12:10:03 PM) Win-Path: C:\WINNT
(5/5/05 12:10:03 PM) System-Path: C:\WINNT\system32
(5/5/05 12:10:03 PM) Temp-Path: C:\DOCUME~1\user\LOCALS~1\Temp\
(5/5/05 12:10:18 PM) Disinfection started
(5/5/05 12:10:18 PM) Bad-Dll(IEP): c:\docume~1\user\locals~1\temp\se.dll
(5/5/05 12:10:18 PM) UBF: 7 - UBB: 3 - UBR: 8
(5/5/05 12:10:18 PM) UBF: 7 - UBB: 3 - UBR: 8
(5/5/05 12:10:18 PM) Bad IE-pages:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\user\locals~1\temp\se.dll/spage.html
(5/5/05 12:10:18 PM) Stealth-String not found
(5/5/05 12:10:18 PM) No locked Files to delete. End without Reboot
(5/5/05 12:10:27 PM) Disinfection started
(5/5/05 12:10:27 PM) Bad-Dll(IEP): c:\docume~1\user\locals~1\temp\se.dll
(5/5/05 12:10:27 PM) UBF: 7 - UBB: 3 - UBR: 8
(5/5/05 12:10:27 PM) UBF: 7 - UBB: 3 - UBR: 8
(5/5/05 12:10:27 PM) Bad IE-pages: (none)
(5/5/05 12:10:27 PM) Stealth-String not found
(5/5/05 12:10:27 PM) No locked Files to delete. End without Reboot
  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
You should really try to keep up with the followup to your problem. I know we are all busy, but if you wait too long, your topic gets closed (like your other one).

OK, post a new HijackThis log also. I need to take a look at it to see where you are now.
  • 0

#3
nosnit

nosnit

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Thanks. Sorry this is the computer that I rarley use.
Here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 4:47:02 PM, on 5/7/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.EXE
C:\Program Files\Trend Micro\Internet Security\PCCGUIDE.EXE
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Jim\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {8ADBF62B-28F1-43BA-B627-6BDDC7CCB25A} - C:\WINNT\system32\ejfm.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {FB35EFBF-FC63-375D-B126-C7CD9B31510B} - C:\WINNT\mspq32.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Games\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [TorrentSearch] C:\Games\TSx\TSx.exe minimized
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [NBJ] "C:\Games\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Microsoft AntiSpyware helper - {68D869AE-C995-4D38-8A56-261821F49311} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {68D869AE-C995-4D38-8A56-261821F49311} - (no file) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {CFAC00A4-E9E7-4A40-97A4-1E888B3DF0A6} - ms-its:mhtml:file://c:\nosuxxx.mht!http://toolbar.dworx...::/xtoolbar.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Trend Micro Personal Firewall (PccPfw) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
  • 0

#4
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Reboot into Safe Mode by hitting the F8 key until menu shows up. In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

O2 - BHO: (no name) - {8ADBF62B-28F1-43BA-B627-6BDDC7CCB25A} - C:\WINNT\system32\ejfm.dll (file missing)
O2 - BHO: (no name) - {FB35EFBF-FC63-375D-B126-C7CD9B31510B} - C:\WINNT\mspq32.dll (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {68D869AE-C995-4D38-8A56-261821F49311} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {68D869AE-C995-4D38-8A56-261821F49311} - (no file) (HKCU)
O16 - DPF: {CFAC00A4-E9E7-4A40-97A4-1E888B3DF0A6} - ms-its:mhtml:file://c:\nosuxxx.mht!http://toolbar.dworx...::/xtoolbar.cab


Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINNT\system32\ejfm.dll
C:\WINNT\mspq32.dll
c:\wp.exe
c:\wp.bmp


Reboot into Normal Mode run a new HijackThis scan. Save the log file and post it here.

Do you have a background/wallpaper problem also?
  • 0

#5
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP