the frustration is maddening; cws is useless!!

Discussion in 'adware, spyware & hijack cleaning' started by characterhero, May 22, 2004.

Thread Status:
Not open for further replies.
  1. characterhero

    characterhero Registered Member

    Joined:
    May 21, 2004
    Posts:
    1
    my start page has started showing up as dubolom.com/index.htm, even after i change it back to google. i also have a bunch of stupid new links in my favorites, and whenever i shut down my computer i end up having to force a program called "win min" to shut down because it isn't responding. i did a little searching and discovered what (i thought) was wrong with my system, along with ways i could fix it (cwshredder). when i ran cws, it deleted the smartsearch strain & the new pages on my list of favorites but after i restarted the computer, my homepage and list of favorites were still different! every subsequent cwshredder scan had no effect whatsoever.
    somebody i went to for help looked at my hijackthis! report and advised me to delete 'broadjump' because it was what he called an 'ad server'. i tried to do this, but the same thing happens every time i click the 'change/remove' button: it confirms my decision and begins the uninstall process, but then totally fakes me out with a popup window declaring that an application exists which uses broadjump, and i must first delete THAT before i think i can go deleting broadjump. it says the same thing when i try to delete the other broadjump program, 'broadjump client foundation'. the particular application using broadjump happens to be my connection manager, and i'm wary of deleting it because i don't want to jeopardize my connection to the internet. could you please help me? i have no clue how to fix this, and the last forum i went to was pretty swamped. what do you think i should do?
    oh and here is an activity log from "iclean", a program included in a pack of cds i got when i purchased my computer (which i just got around to installing this week): o_O

    Clean Finished.
    Emptying Recycle Bins
    Cleaning IE Cache, Cookies, and History (index.dat)
    Cleaning NT AutoComplete and Passwords
    Cleaning IE AutoComplete and Passwords
    Unable to delete file C:\Documents and Settings\Owner\Cookies\index.dat with Error # 70 - Permission denied
    Cleaning IE Cookies
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Cleaning Temporary Internet Files
    Clean Started
    Clean Finished.
    Emptying Recycle Bins
    Cleaning IE Cache, Cookies, and History (index.dat)
    Cleaning NT AutoComplete and Passwords
    Cleaning IE AutoComplete and Passwords
    Unable to delete file C:\Documents and Settings\Owner\Cookies\index.dat with Error # 70 - Permission denied
    Cleaning IE Cookies
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Cleaning Temporary Internet Files
    Clean Started
    Clean Finished.
    Emptying Recycle Bins
    Cleaning IE Cache, Cookies, and History (index.dat)
    Cleaning NT AutoComplete and Passwords
    Cleaning IE AutoComplete and Passwords
    Unable to delete file C:\Documents and Settings\Owner\Cookies\index.dat with Error # 70 - Permission denied
    Cleaning IE Cookies
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Cleaning Temporary Internet Files
    Clean Started
    Clean Finished.
    Emptying Recycle Bins
    Cleaning IE Cache, Cookies, and History (index.dat)
    Cleaning NT AutoComplete and Passwords
    Cleaning IE AutoComplete and Passwords
    Unable to delete file C:\Documents and Settings\Owner\Cookies\index.dat with Error # 70 - Permission denied
    Cleaning IE Cookies
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Cleaning Temporary Internet Files
    Clean Started
    Clean Finished.
    Emptying Recycle Bins
    Cleaning IE Cache, Cookies, and History (index.dat)
    Cleaning NT AutoComplete and Passwords
    Cleaning IE AutoComplete and Passwords
    Unable to delete file C:\Documents and Settings\Owner\Cookies\index.dat with Error # 70 - Permission denied
    Cleaning IE Cookies
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Cleaning Temporary Internet Files
    Clean Started
    Clean Finished.
    Emptying Recycle Bins
    Cleaning IE Cache, Cookies, and History (index.dat)
    Cleaning NT AutoComplete and Passwords
    Cleaning IE AutoComplete and Passwords
    Unable to delete file C:\Documents and Settings\Owner\Cookies\index.dat with Error # 70 - Permission denied
    Cleaning IE Cookies
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ZBLRV18S\cm[1].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UVUN25UJ\cm[2].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UVUN25UJ\cm[1].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UVUN25UJ\24513[1].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ZBLRV18S\cm[1].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UVUN25UJ\cm[2].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UVUN25UJ\cm[1].htm with Error # 70 - Permission denied
    Unable to delete file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\UVUN25UJ\24513[1].htm with Error # 70 - Permission denied
    Cleaning Temporary Internet Files
    Clean Started



    ---------------------------




    and here's my most recent hijackthis report:

    Logfile of HijackThis v1.97.7
    Scan saved at 7:54:41 PM, on 5/21/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\LEXBCES.EXE
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\system32\LEXPPS.EXE
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINNT\System32\gearsec.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\wanmpsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINNT\System32\hkcmd.exe
    C:\Program Files\Gateway Utilities\GWInkMonitor.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\WINNT\GWMDMMSG.exe
    C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
    C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\program files\support.com\bin\tgcmd.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\AIM\aim.exe
    C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
    C:\Program Files\Internet Explorer\IEengine.exe
    C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Lexmark 3100 Series\lxbrcmon.exe
    C:\Program Files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\SBC\Connection Manager\CManager.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINNT\System32\taskmgr.exe
    C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dubolom.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://dubolom.com/index.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dubolom.com/index.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://dubolom.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://dubolom.com/index.htm
    O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: (no name) - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - C:\WINNT\msopt.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
    O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
    O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
    O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [tgcmdprovidersbc] "c:\program files\support.com\bin\tgcmd.exe" /server /startmonitor /deaf /nosystray
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] 1
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
    O4 - HKCU\..\Run: [IEengine] C:\Program Files\Internet Explorer\IEengine.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [iClean] "C:\Program Files\Aladdin Systems\iClean\iClean.exe" /I
    O4 - Startup: Connection Manager.lnk = C:\Program Files\SBC\Connection Manager\CManager.exe
    O4 - Global Startup: Personal Coach.lnk = ?
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O9 - Extra button: WeatherBug (HKCU)
    O10 - Broken Internet access because of LSP provider 'farlsp.dll' missing
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
    O16 - DPF: {99410CDE-6F16-42CE-9D49-3807F78F0287} (ZangoInstaller Class) - http://infinity.zango.com/gateway/resources/default/zangoinstaller.cab?productid=691
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{70A41C34-033B-41E2-9C89-F286577DDC98}: NameServer = 206.13.30.12 64.164.99.51
     
  2. Unzy

    Unzy Registered Member

    Joined:
    Nov 2, 2003
    Posts:
    1,098
    Location:
    Belgium
    Hi characterhero,

    have only HijackThis running and fix :

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dubolom.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://dubolom.com/index.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dubolom.com/index.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://dubolom.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://dubolom.com/index.htm

    O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - C:\WINNT\msopt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

    O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
    O4 - HKCU\..\Run: [IEengine] C:\Program Files\Internet Explorer\IEengine.exe

    O9 - Extra button: WeatherBug (HKCU)

    O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/mini...ransporter.cab?

    Restart PC after doing so and remove :

    C:\Program Files\MySearch\ <- this folder
    C:\PROGRAM FILES\AWS\ <- this folder
    C:\Program Files\Internet Explorer\IEengine.exe <- this file

    Cheers,
     
Thread Status:
Not open for further replies.