Hijacked

Discussion in 'adware, spyware & hijack cleaning' started by Gareth, Mar 18, 2004.

Thread Status:
Not open for further replies.
  1. Gareth

    Gareth Guest

    Have scanned with Adware 6.0 pro but have found nothing, everytime you start IE it has detected spyware system error #384. Have downloaded Hijackthis and results are below

    Logfile of HijackThis v1.97.7
    Scan saved at 12:52:56, on 18/03/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
    E:\WINDOWS\Explorer.EXE
    E:\WINDOWS\reg32.exe
    E:\WINDOWS\svchost.exe
    E:\WINDOWS\winh.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
    E:\Program Files\MSN Messenger\MsnMsgr.Exe
    E:\program files\GlobalDialer\wordi00031\7055184.exe
    E:\ScanPanel\ScnPanel.exe
    E:\Documents and Settings\Phil\Local Settings\Temp\Temporary Directory 1 for hijackthis1977.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://webcoolsearch.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://webcoolsearch.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://webcoolsearch.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.enjoysearch.info/
    R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = E:\WINDOWS\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.enjoysearch.info/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = E:\WINDOWS\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.enjoysearch.info/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file:///E:\WINDOWS\search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com%00@www.efinder.cc/search/ (obfuscated)
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://www-cache.freeserve.com:8080;ftp=http://www-cache.freeserve.com:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.inf/?id=54
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.freeserve.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.surfast.info/s.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.surfast.info/s.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = E:\WINDOWS\system32\searchbar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.008i.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.008i.com/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com%00@www.efinder.cc/search/ (obfuscated)
    O1 - Hosts: 213.159.117.235 auto.search.msn.com
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [UPSUtl] E:\WINDOWS\web.exe
    O4 - HKLM\..\Run: [Reg32] E:\WINDOWS\reg32.exe
    O4 - HKLM\..\Run: [Online Service] E:\WINDOWS\svchost.exe
    O4 - HKLM\..\Run: [Winhost] E:\WINDOWS\winh.exe
    O4 - HKLM\..\Run: [Image] rundll32 E:\WINDOWS\image.dll,Install
    O4 - HKLM\..\Run: [pccguide.exe] "E:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "E:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "E:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] E:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [od-stnd18] e:\program files\Webdialer\od-stnd18.exe -m
    O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [xxxvid] E:\Documents and Settings\Phil\My Documents\xxxvideo.hta
    O4 - HKCU\..\Run: [sws.exe] e:\program files\GlobalDialer\wordi00031\7055184.exe -remove
    O4 - HKCU\..\RunServices: [Image] rundll32 E:\WINDOWS\image.dll,Install
    O4 - Startup: AOL 5.0 Tray Icon.lnk = E:\AOL 5.0\aoltray.exe
    O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: ScanPanel.lnk = E:\ScanPanel\ScnPanel.exe
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O13 - DefaultPrefix: http://www.surfast.info/
    O13 - WWW Prefix: http://www.surfast.info/
    O13 - WWW. Prefix: http://%65%68%74%74%70%2E%63%63/?
    O13 - Home Prefix: http://www.surfast.info/
    O13 - Mosaic Prefix: http://www.surfast.info/
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:NXSFT.MHT!http://66.117.38.54:80/iex/ofile.exe?xdat=6230&url=http://66.117.38.54:80/dexUK542.exe
    O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://download4.payoutpal.com/download/dialer/cax.cab
    O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50087/QDow.cab
    O16 - DPF: {38545C2A-03CD-42C3-BC62-C537A6D5A8F6} (38545C2A-03CD-42C3-BC62-C537A6D5A8F6) - http://download.globaldialer.net/GlobalDialer.cab
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {C1C2AC28-5E4B-4228-B7A0-05E986FFCE14} (TIBSLoader Class) - http://ultimateplugin.com/tl4000.dll
    O16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.whenusearch.com/WUInstSEWC.cab
    O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://213.200.210.99/download/ceuutsm_adult.exe
    O18 - Protocol hijack: about - {53B95211-7D77-11D2-9F80-00104B107C96}
    O19 - User stylesheet: E:\WINDOWS\my.css
    O19 - User stylesheet: E:\WINDOWS\hh.htt (HKLM)

    Thanks in advance
     
    Gareth, Mar 18, 2004
    #1
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Wow. :eek:

    Please download and run http://www.spywareinfoforum.com/~merijn/files/CWShredder.exe
    Use the Fix button and follow the directions given by the program.

    Then reboot, run HijackThis again and post a new log.

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 18, 2004
    #2
  3. Gareth

    Gareth Guest

    Have run cwshredder and hijackthis agin, here is the new log

    Logfile of HijackThis v1.97.7
    Scan saved at 13:06:48, on 18/03/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
    E:\WINDOWS\Explorer.EXE
    E:\WINDOWS\winh.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
    E:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
    E:\Program Files\MSN Messenger\MsnMsgr.Exe
    E:\program files\GlobalDialer\wordi00031\7055184.exe
    E:\ScanPanel\ScnPanel.exe
    E:\Documents and Settings\Phil\Local Settings\Temp\Temporary Directory 2 for hijackthis1977.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = E:\WINDOWS\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = E:\WINDOWS\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://www-cache.freeserve.com:8080;ftp=http://www-cache.freeserve.com:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.inf/?id=54
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.freeserve.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [Winhost] E:\WINDOWS\winh.exe
    O4 - HKLM\..\Run: [pccguide.exe] "E:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "E:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "E:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] E:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [od-stnd18] e:\program files\Webdialer\od-stnd18.exe -m
    O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [sws.exe] e:\program files\GlobalDialer\wordi00031\7055184.exe -remove
    O4 - Startup: AOL 5.0 Tray Icon.lnk = E:\AOL 5.0\aoltray.exe
    O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: ScanPanel.lnk = E:\ScanPanel\ScnPanel.exe
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:NXSFT.MHT!http://66.117.38.54:80/iex/ofile.exe?xdat=6230&url=http://66.117.38.54:80/dexUK542.exe
    O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://download4.payoutpal.com/download/dialer/cax.cab
    O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50087/QDow.cab
    O16 - DPF: {38545C2A-03CD-42C3-BC62-C537A6D5A8F6} (38545C2A-03CD-42C3-BC62-C537A6D5A8F6) - http://download.globaldialer.net/GlobalDialer.cab
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {C1C2AC28-5E4B-4228-B7A0-05E986FFCE14} (TIBSLoader Class) - http://ultimateplugin.com/tl4000.dll
    O16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.whenusearch.com/WUInstSEWC.cab
    O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://213.200.210.99/download/ceuutsm_adult.exe
     
    Gareth, Mar 18, 2004
    #3
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Hi Gareth,

    A bit better already. :)

    Before you start, please unzip hijackthis to a separate folder. The program will make backups in the folder in the folder it's in.
    These easily get lost in a Temp folder.

    Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = E:\WINDOWS\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = E:\WINDOWS\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = E:\WINDOWS\secure.html

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.inf/?id=54

    O4 - HKCU\..\Run: [od-stnd18] e:\program files\Webdialer\od-stnd18.exe -m

    O4 - HKCU\..\Run: [sws.exe] e:\program files\GlobalDialer\wordi00031\7055184.exe -remove

    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:NXSFT.MHT!http://66.117.38.54:80/iex/ofile.exe?xdat=6230&url=http://66.117.38.54:80/dexUK542.exe
    O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://download4.payoutpal.com/download/dialer/cax.cab
    O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50087/QDow.cab
    O16 - DPF: {38545C2A-03CD-42C3-BC62-C537A6D5A8F6} (38545C2A-03CD-42C3-BC62-C537A6D5A8F6) - http://download.globaldialer.net/GlobalDialer.cab
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {C1C2AC28-5E4B-4228-B7A0-05E986FFCE14} (TIBSLoader Class) - http://ultimateplugin.com/tl4000.dll
    O16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.whenusearch.com/WUInstSEWC.cab
    O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://213.200.210.99/download/ceuutsm_adult.exe

    Then reboot into safe mode
    and delete:
    e:\program files\Webdialer
    E:\program files\GlobalDialer <= entire folder
    E:\WINDOWS\winh.exe
    E:\WINDOWS\secure.html

    Do pay the Windows Update site a visit.
    Other tips on how to minimize the risk of infection: http://boards.cexx.org/viewtopic.php?t=957.

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 18, 2004
    #4
  5. Gareth

    Gareth Guest

    Have done the above but now when IE starts up it gives a FORBIDDEN, you were denied access because : Access denied by access control list
     
    Gareth, Mar 18, 2004
    #5
  6. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Hi Gareth,

    That message is what you get at the site where IE opens in, I hope?

    You can change your StartPage in IE under Tools > Internet-options > General Tab.

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 18, 2004
    #6
  7. Gareth

    Gareth Guest

    Hi Pieter,

    no matter what I type as my homepage, or if i type a different url it still gives me the same message.
     
    Gareth, Mar 18, 2004
    #7
  8. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    In IE > Tools > Internet-options > Connections.

    Set the Connections through you ISP as Default.
    Delete any connections, that you recognize as belonging to one the dialers we removed.

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 18, 2004
    #8
  9. Gareth

    Gareth Guest

    Have sorted problem out, problem with LAN settings in Internet Options, was trying to use a proxy server with no settings. Have sorted problem out, thank you for you help.

    Cheers Pieter
     
    Gareth, Mar 18, 2004
    #9
  10. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    My pleasure. :)

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 18, 2004
    #10
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...