Google.com ad problem.

Discussion in 'adware, spyware & hijack cleaning' started by brainer, May 25, 2004.

Thread Status:
Not open for further replies.
  1. brainer

    brainer Registered Member

    Joined:
    May 25, 2004
    Posts:
    4
    I'm having a problem with my google search.
    Each time I put something into a search field and press SEARCH, it takes few seconds before next page shows up. it shows up with a PopUp window of ad ( like spyware stuff) and page with advertisment.
    Example:
    while searching for ad aware i get first page just as google, same address but all entries are advertisment, of free downloads of Spamsoftware.
    I scanned my whole machine with ad aware, SpyBot S&D, as well as scanned for viruses. Everything was cleared.
    I run HijackThis and got the following:

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\WINDOWS\System32\kxmixer.exe
    C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE
    C:\Program Files\Mediafour\XPlay\XPTRYICN.EXE
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\Trillian\trillian.exe
    C:\Program Files\MYIE2\MyIE.exe
    G:\--==Appz==--\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.userfriendly.org/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [kX Mixer] C:\WINDOWS\System32\kxmixer.exe --startup
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\IEXPLORE.EXE
    O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE" /auto
    O4 - HKLM\..\Run: [Mediafour XPlay Tray Notification Icon] C:\Program Files\Mediafour\XPlay\XPTRYICN.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - Startup: trillian.lnk = ?
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O9 - Extra button: Research (HKLM)
    O10 - Broken Internet access because of LSP provider 'xfire_lsp_6390.dll' missing
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38039.2998032407
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5E4B2633-7DDC-4405-9F70-526323F042EF}: NameServer = 192.168.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\..\{E91CAC65-943A-4A22-9B09-B521A3C26170}: NameServer = 192.168.0.2


    This is first time using this software, so i don't wanna touch anything without fidning out first.
    Thnx in advance for any help.
     
  2. brainer

    brainer Registered Member

    Joined:
    May 25, 2004
    Posts:
    4
    I just realized that there is a new forum for spyware and hijackthis log posting. I'm sorry for not posting it in there...
     
  3. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    No problem,

    I'll move it over there now. ;)


    snowbound
     
  4. brainer

    brainer Registered Member

    Joined:
    May 25, 2004
    Posts:
    4
    anyone can help me? or anyone have similar problem than me?
    Cuz i'm getting ready to load up my ghost image.
     
  5. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,430
    Location:
    Netherlands
  6. brainer

    brainer Registered Member

    Joined:
    May 25, 2004
    Posts:
    4
    THnx for your help Pieter.
    I already reinsstalled, so i'm problem free, however I did found what was the name of the ad. It is called CoolSearch, and yes the tool you recomended CWShredder.exe removes it. I sure will know for te future.
    Thnx again
     
  7. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,430
    Location:
    Netherlands
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.