The Undeletable Search Toolbar

  1. #1
    joshspazjosh is offline Newbie

    The Undeletable Search Toolbar

    Logfile of HijackThis v1.99.1
    Scan saved at 1:00:16 AM, on 9/6/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\Tablet.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\Program Files\Wacom\TabUserW.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Avant Browser\avant.exe
    C:\WINDOWS\System32\dllhost.exe
    C:\WINDOWS\System32\msdtc.exe
    C:\Documents and Settings\Josh\Desktop\hijackthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.joshspazjosh.com/projectamforums
    R3 - URLSearchHook: (no name) - {555B92C8-19B6-4BE0-BE22-42C5E61B7A64} - 34763.dll (file missing)
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\jibrl.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\jibrl.dll
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [PrcIdle] Serviceprocess.exe
    O4 - HKLM\..\Run: [backd] bnui.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [zantu] NukeSpan.exe
    O4 - HKCU\..\Run: [wormexe] gabber.exe
    O4 - HKCU\..\Run: [ParisM] atl_helper.exe
    O4 - HKCU\..\Run: [akl] C:\PROGRA~1\Winsoul\aklh\akl.exe -m -s
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
    O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...b?968182999342
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6F3C8CAE-0463-4433-92E2-49D8E3740278}: NameServer = 69.50.161.130,85.255.112.5
    O17 - HKLM\System\CCS\Services\Tcpip\..\{958549D6-DCC5-4C6E-939C-295C9DFD5A1B}: NameServer = 69.50.161.130 85.255.112.5
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

    -------------
    I posted a topic about this in the "Windows XP Help" thread and am posting this log from his advice.

    Some notes:
    -I'm currently in the middle of downloading SP2 as we speak; it's taking hours, however, because it's 100MB and I have 56k.

    -The keylogger (aklh) was intentionally installed by myself for various reasons.

    -Keyboard commands (Ctrl + C, Ctrl + A, etc.) are not working either, in addition to the TAB key's nonfunctionality.
    Last edited by joshspazjosh; 06-09-2005 at 06:09 AM.


  2. #2
    Neal is offline Dedicated Member
    Save 20% on AVG Internet Security 2012 Suite!
    Do not download SP2 on an infected machine as you will be sorry it will cause more problems then you care to deal with.

    You have a boatload of Trojans on your machine.

    Go look in add/remove program and remove WAREOUT if it is found in there.

    Reboot if it was removed.

    Please get these two spyware programs if you don't already have them.

    SpyBotS&D

    AdawareSE


    Reboot between scans and after last scan



    There is a new and improved version of AdAware that you need to have installed on your computer. The new version is AdAware SE
    If you have AdAware already installed on your system and it's NOT SE go to your Control Panel and click on Add/Remove Programs. Click on AdAware and then REMOVE and then just complete the removal process.

    Once it's un-installed. Download the FREE version of AdAware SE. Once it's downloaded double click on the new file to start the install process.
    Click Next>I accept>Next>Next> then be sure and put a dot in the bullet for Anyone Who uses this computer and then click Next>Next>

    In the next dialog box remove the dot in the bullets "Start Scan" and also "Launch Help Files" and click Finish

    Now if the program doesn't launch double click on the icon that should now be on your desktop to start AdAware SE

    Now click on the button for Check for Updates
    If updates are found click on the OK button and after it downloads to 100% click on the Finish button.

    Click the Start Button
    Click on the link for Customize
    in the Main Window under Scan Settings
    click on the red X in front of Scan within archives to change it to a green check

    Then click on the button on the left labeled Advanced
    click on the red X in front of Move deleted files to Recycle Bin to change it to a green check
    click on the red X in front of Include Environment Information to change it to a green check

    Then click on the button on the left labeled Defaults
    click on the Read current settings from system

    Then click on the button on the left labeled Tweak
    Click on the (+) in front of Scanning Engine to expand the group
    click on the red X in front of Obtain Command line of scanned processes to change it to a green check
    click on the red X in front of Run scan as background process to change it to a green check
    click on the red X in front of Use permanent archive caching to change it to a green check

    Click on the (+) in front of Cleaning Engine to expand the group
    click on the red X in front of Disable manual quarantine if auto-quarantine is selected to change it to a green check

    Click on the (+) in front of Safety Settings to expand the group
    click on the red X in front of Reanalyze results after scanning . . . to change it to a green check
    click on the red X in front of Write protect system files after repair to change it to a green check

    Click on the (+) in front of Log File to expand the group
    click on the red X Create Log File for removal operations to change it to a green check

    Click on the (+) in front of User Interface to expand the group
    click on the red X Remember window positions to change it to a green check
    click on the red X Snap windows to desktop borders to change it to a green check
    click on the red X Use gridlines in results list to change it to a green check

    Click on the (+) in front of Web Update Settings to expand the group
    click on the red X Create and save WebUpdate log file to change it to a green check

    Click on the (+) in front of Misc settings to expand the group
    click on the red X Dump details about unhandled exceptions to disk to change it to a green check


    Then click on the button at the bottom right labeled Proceed then click the Next button to start scanning.

    Once the scan is complete you'll have a flashing Bug and a brief sound to indicate scanning is complete and Adware is found. Click on the Next and then click on each of the empty boxes to the left of the found items under SCAN SUMMARY. Then hit the Next button. Then OK. This should clean your system of all the found nasties. When it's complete simply close the program until your next scan session. Always ALWAYS check for updates before very scan.
    # Reboot
    # Post us a fresh HijackThis log afterwards


    Run the scans rebooting between scans and after last scan and post a new Highjackthis log please. Info for Hijackthis at below link. Thanks.

    Hijackthis

+ Reply to Thread