wwwfind.biz removal + others

Discussion in 'adware, spyware & hijack cleaning' started by mr2fyre, Jul 16, 2004.

Thread Status:
Not open for further replies.
  1. mr2fyre

    mr2fyre Registered Member

    Jul 16, 2004
    I have managed to get a bunch of crap on my computer including wwwfind.biz, purityscan and others. I have done the removal of purityscan but it has come back twice now. I have run adaware and Spybot. I also relize that all the R1's for wwwfind.biz should be deleted, but they comeback everytime i reboot so i just left them there for now. I can't seem to find any information esleware about this hijack.


    Logfile of HijackThis v1.97.7
    Scan saved at 12:34:13 PM, on 7/16/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\ICQPlus\vplus.exe
    C:\Program Files\ICQ\ICQ.exe
    C:\Documents and Settings\jcacka\Application Data\otup.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Documents and Settings\jcacka\Start Menu\Programs\Startup\TransparentW.exe
    C:\Program Files\Webshots\WebshotsTray.exe
    C:\Program Files\AutoCAD 2002\acad.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\John's files\downloads\HiJackThis\HijackThis07-16-04.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wwwfind.biz
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.wwwfind.biz
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wwwfind.biz
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.wwwfind.biz
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.wwwfind.biz
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.wwwfind.biz
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wwwfind.biz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.wwwfind.biz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wwwfind.biz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.wwwfind.biz
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.wwwfind.biz
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.wwwfind.biz
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.wwwfind.biz
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DMSDOS] C:\WINNT\system32\Explorer.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
    O4 - HKCU\..\Run: [ICQ Plus] "C:\Program Files\ICQPlus\vplus.exe"
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Tata] C:\Documents and Settings\jcacka\Application Data\otup.exe
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\RunOnce: [ICQ] C:\Program Files\ICQ\ICQ.exe -trayboot
    O4 - Startup: TransparentW.exe
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: AIM (HKLM)
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT 2002\AcDcToday.ocx
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38068.6734837963
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
    O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT 2002\InstBanr.ocx
    O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD LT 2002\InstFred.ocx
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT 2002\AcPreview.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = amceinc.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = amceinc.com
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = amceinc.com
  2. Marianna

    Marianna Spyware Fighter

    Apr 23, 2002
    B.C. Canada
    Hi mr2fyre

    I did a google search for :: WWW find.biz ::

    Found this:

    Search the web: HOT SEARCH. To uninstall our "Search ToolBar" you
    have to download and run this file: Download Here, Online casinos ...

    I have NO idea if you can trust them !!!!!

    As to purity scan -

    purityscan - manual instructions here:

    If you decide to try find.biz - is UP to you ! - run immediately ad aware and spybot !

    Sorry, but I can NOT find more info :(
  3. mr2fyre

    mr2fyre Registered Member

    Jul 16, 2004
    I could not get to any of the wwwfind.biz webpages from my computer. I used my gf's computer and got to the page with the removal program. Downloaded it, ran it. all of wwwfind.biz was removed. I then ran adaware and spybot and nothing new showed up. I ran hijackthis and had a couple of new R1's that showed up, as was an attempt to change my homepage was noted by spy sweeper. I deleted the new R1's that showed up after running the removal program. Restarted the computer and there does not appear to be any bad stuff left. So I guess the removal program worked.

    Purityscan is gone now. I have made it through one re-boot without it coming back. I gues i just have to wait and see if it is gone for good.

  4. Marianna

    Marianna Spyware Fighter

    Apr 23, 2002
    B.C. Canada
    Hi mr2fyre

    Well, that seems to be "good news". Thanks for your feedback !

    Yep, wait a couple of days - if it comes back - pls. use this thread and post a fresh HJT log - this way we have everything together :)

    Crossing my fingers - it stays away :D
Thread Status:
Not open for further replies.