c://winnt/secure and greatsearch.biz

Discussion in 'adware, spyware & hijack cleaning' started by billcon, Mar 30, 2004.

Thread Status:
Not open for further replies.
  1. billcon

    billcon Registered Member

    Joined:
    Mar 30, 2004
    Posts:
    1
    Please help

    Used ad-aware 6

    Logfile of HijackThis v1.97.7
    Scan saved at 12:42:05 AM, on 3/30/2004
    Platform: Windows 2000 SP1 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\stisvc.exe
    C:\WINNT\wanmpsvc.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\Explorer.exe
    C:\WINNT\System32\mspmspsv.exe
    C:\Program Files\Real\RealJukebox\tsystray.exe
    C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINNT\System32\winupdate.exe
    C:\WINNT\dkdial.exe
    C:\WINNT\dl.exe
    C:\WINNT\dlm.exe
    C:\WINNT\consol32.exe
    C:\WINNT\msstasks.exe
    C:\docume~1\admini~1\applic~1\services.exe
    C:\Program Files\America Online 9.0\aoltray.exe
    C:\Program Files\Sprint PCS\Download Manager\DLMgr.exe
    C:\WINNT\System32\appsys.exe
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe
    C:\Program Files\WebSiteViewer\121299.dlr

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://greatsearch.biz/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://greatsearch.biz/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://greatsearch.biz/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://greatsearch.biz/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://greatsearch.biz/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://greatsearch.biz/
    O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\ORL\VNC\WinVNC.exe" -servicehelper
    O4 - HKLM\..\Run: [RealJukeboxSystray] C:\Program Files\Real\RealJukebox\tsystray.exe
    O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe"
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [winupdate.exe] C:\WINNT\System32\winupdate.exe
    O4 - HKLM\..\Run: [DKDial] C:\WINNT\dkdial.exe
    O4 - HKLM\..\Run: [Dial32] C:\WINNT\dl.exe
    O4 - HKLM\..\Run: [Dial33] C:\WINNT\dlm.exe
    O4 - HKLM\..\Run: [Cons] C:\WINNT\consol32.exe
    O4 - HKLM\..\Run: [Serv] C:\WINNT\msstasks.exe
    O4 - HKLM\..\Run: [Windows Stortup] C:\WINNT\svchost.exe
    O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
    O4 - HKLM\..\RunServices: [winupdate.exe] C:\WINNT\System32\winupdate.exe
    O4 - HKCU\..\Run: [RealJukeboxSystray] C:\Program Files\Real\RealJukebox\tsystray.exe
    O4 - HKCU\..\Run: [System Update2] c:\docume~1\admini~1\applic~1\services.exe
    O4 - HKCU\..\RunServices: [winupdate.exe] C:\WINNT\System32\winupdate.exe
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\Realdownload.exe
    O4 - Global Startup: Sprint PCS Download Manager.lnk = C:\Program Files\Sprint PCS\Download Manager\DLMgr.exe
    O4 - Global Startup: Webcam32.lnk = C:\Program Files\Surveyor Corporation\Webcam32\webcam32.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O9 - Extra button: Run DAP (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O13 - DefaultPrefix: http://www.msn.com@showresult.com/search.php?
    O13 - WWW Prefix: http://www.msn.com@showresult.com/search.php?
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{514D17EF-AE21-485B-B436-C595D0A30BD7}: NameServer = 166.90.244.250,166.90.244.252
    O17 - HKLM\System\CCS\Services\Tcpip\..\{62E65FD6-3C27-47F2-BBFB-E916BCF97DF3}: NameServer = 205.188.146.146


    Thank you
     
    billcon, Mar 30, 2004
    #1
  2. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    First please find all these files, copy them and zip them up and send them to me at the email adress on the spykiller site in my signature

    C:\WINNT\svchost.exe
    C:\WINNT\msstasks.exe
    C:\WINNT\consol32.exe
    C:\WINNT\dlm.exe
    C:\WINNT\dl.exe
    C:\WINNT\dkdial.exe
    C:\WINNT\System32\winupdate.exe
    c:\document and settings\administrator\application data\services.exe
    C:\WINNT\System32\appsys.exe

    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://greatsearch.biz/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://greatsearch.biz/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://greatsearch.biz/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://greatsearch.biz/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://greatsearch.biz/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://greatsearch.biz/

    O4 - HKLM\..\Run: [winupdate.exe] C:\WINNT\System32\winupdate.exe
    O4 - HKLM\..\Run: [DKDial] C:\WINNT\dkdial.exe
    O4 - HKLM\..\Run: [Dial32] C:\WINNT\dl.exe
    O4 - HKLM\..\Run: [Dial33] C:\WINNT\dlm.exe
    O4 - HKLM\..\Run: [Cons] C:\WINNT\consol32.exe
    O4 - HKLM\..\Run: [Serv] C:\WINNT\msstasks.exe
    O4 - HKLM\..\Run: [Windows Stortup] C:\WINNT\svchost.exe
    O4 - HKLM\..\RunServices: [winupdate.exe] C:\WINNT\System32\winupdate.exe
    O4 - HKCU\..\Run: [System Update2] c:\docume~1\admini~1\applic~1\services.exe
    O4 - HKCU\..\RunServices: [winupdate.exe] C:\WINNT\System32\winupdate.exe

    O13 - DefaultPrefix: http://www.msn.com@showresult.com/search.php?
    O13 - WWW Prefix: http://www.msn.com@showresult.com/search.php?


    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Delete these files
    C:\WINNT\svchost.exe
    C:\WINNT\msstasks.exe
    C:\WINNT\consol32.exe
    C:\WINNT\dlm.exe
    C:\WINNT\dl.exe
    C:\WINNT\dkdial.exe
    C:\WINNT\System32\winupdate.exe
    c:\document and settings\administrator\application data\services.exe
    C:\WINNT\System32\appsys.exe
    then
    Reboot normally &
    download CWshredder from http://www.thespykiller.co.uk then Run it
    Close all browser windows, click on the cwshredder.exe then click "FIX" (Not "Scan only") and let it do it's thing.
    and make sure you follow the advice about the security updates listed on the last page, in order to prevent re-infection, otherwise you will be continually reinfected
    the patches are :
    http://support.microsoft.com/default.aspx?kbid=828026
    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-011.asp
    *Note: The simplest way to make sure you have all the security patches is to go to Windows update and install all "Critical Updates & service Packs"

    then reboot &

    Run an online antivirus check from at least one and preferably 2 of the following sites
    http://security.symantec.com/default.asp?
    http://housecall.trendmicro.com/
    http://www.pandasoftware.com/activescan/
    http://www.ravantivirus.com/scan/
    http://www3.ca.com/virusinfo/
    http://www.anti-trojan.net/en/onlinecheck.aspx

    reboot & post a new hijackthis log

    Now I don't see any running antivirus, that is a bit like standing in downtown Baghdad stark naked with a bulls eye on your chest waving an American Flag. Definitely not recommended

    Download and install & run an antivirus immediately

    lists here
    http://www.wilders.org/anti_viruses.htm

    one free one that many users of this forum use successfully is
    AVG from http://www.grisoft.com/us/us_dwnl_free.php
     
    dvk01, Mar 30, 2004
    #2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...