hey jabuck,,i looked for the coolweb search in the first hjt post,,couldnt find it,,,which line did you see it in and the two viruses,,,tks alot

0

The wierd R1's,R3',F1 and 01 are coolwebsearch. Download Ewido Security Suite then set it up this way Ewido Setup Instructions WE will run it in safe mode later. Please download ATF-Cleaner from this link http://www.atribune.org/content/view/19/2/ WE will run it from safe mode later Download killbox from this link Killbox We will run it from safe mode later Reboot the computer into safe mode by following the directions at this link in you need them How To Boot Into Safe Mode Run HT again from safe mode, close all windows except HT, place a check to the left of the following items and press "fix checked": R0 - HKLM\Software\Microsoft\InternetExplorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {4C1F677D-E1CD-4087-9D0F-6B20A3DA065E} - (no file) O2 - BHO: (no name) - {CE09BFE6-D3CE-4F40-ACA5-C6D4B5C52B15} - (no file) O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing) O4 - HKLM\..\Run: [2N85L533MR#GJT] C:\WINDOWS\System32\Irktpw.exe O4 - HKCU\..\Run: [Windows Update Checker] C:\WINDOWS\system32\deinst_qfe002.exe O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing) O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab O16 - DPF: {C8BAC37C-A8D2-425E-B7FC-80B9537FB14A} (SBFullS Control) - http://www.spyblast.com/download/SBFS.cab O16 - DPF: {D6E66235-7AA6-44ED-A06C-6F2033B1D993} - http://distribution.trafficsyndicate.com/msiein.cab O16 - DPF: {EF86873F-04C2-4A95-A373-5703C08EFC7B} - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab Double-click on Killbox.exe to run it. Put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time. C:\WINDOWS\System32\GnhY.exe C:\WINDOWS\System32\PzjK219.exe C:\WINDOWS\system32\deinst_qfe002.exe C:\WINDOWS\System32\Irktpw.exe Click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box. Run ATF-Cleaner from safe mode. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Run Ewido from safe mode. When the scan has completed, Ewido will create a report.txt file. Click the "Save Report" button on the bottom of the screen and save the log to your desktop. Post the Ewido log and a new HT log.

0

This is the peper trojan. 2N85L533MR#GJT You may want to run the removal tool. http://www.russelltexas.com/malware/peper/pepercomments.htm

0

ewido anti-malware - Scan report + Created on: 9:16:06 PM, 4/9/2006 + Report-Checksum: FF297F63 + Scan result: HKLM\SOFTWARE\BTIEIN -> Adware.WebSearch : Error during cleaning HKLM\SOFTWARE\BTIEIN\BTIEIN -> Adware.WebSearch : Error during cleaning HKLM\SOFTWARE\BTIEIN\BTIEIN\taskcache -> Adware.WebSearch : Error during cleaning HKLM\SOFTWARE\Classes\Softomate.IEToolbar -> Adware.CoolWebSearch : Cleaned with backup HKLM\SOFTWARE\Classes\Softomate.IEToolbar\CLSID -> Adware.CoolWebSearch : Cleaned with backup HKLM\SOFTWARE\Classes\Softomate.IEToolbar\CurVer -> Adware.CoolWebSearch : Cleaned with backup HKLM\SOFTWARE\Classes\Softomate.IEToolbar.1 -> Adware.CoolWebSearch : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\nCASE -> Adware.180Solutions : Cleaned with backup C:\!KillBox\Irktpw.exe -> Backdoor.VB.oq : Cleaned with backup C:\!KillBox\PzjK219.exe -> Backdoor.VB.nb : Cleaned with backup C:\install_soundfil.exe -> Adware.PurityScan : Cleaned with backup C:\WINDOWS\Downloaded Program Files\ISTactivex_mainstream.dll -> Downloader.IstBar : Cleaned with backup C:\WINDOWS\Explor.exe -> Trojan.Dialer.h : Cleaned with backup C:\WINDOWS\fntldr.exe -> Hijacker.StartPage.y : Cleaned with backup C:\WINDOWS\mshp.dll -> Downloader.WinShow.u : Cleaned with backup C:\WINDOWS\Q1350421.exe -> Trojan.Dialer.j : Cleaned with backup C:\WINDOWS\sys.reg -> Hijacker.StartPage : Cleaned with backup C:\WINDOWS\system32\AozDF.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\biK.exe/bi.dll -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\biK.exe/biprep.exe -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\biK.exe/bi.dll -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\biK.exe/biprep.exe -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\BmnuQ3q.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\BO2802040113.dll -> Adware.BargainBuddy : Cleaned with backup C:\WINDOWS\system32\BO2806040128.exe -> Adware.VirtualBouncer : Cleaned with backup C:\WINDOWS\system32\c58bKs.dll/bi.dll -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\c58bKs.dll/biprep.exe -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\c58bKs.dll/bi.dll -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\c58bKs.dll/biprep.exe -> Adware.BiSpy : Cleaned with backup C:\WINDOWS\system32\Etz3Gao2.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\Fbi1r6.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\Idk277.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\Jel3872.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\Lycos.dll -> Adware.BargainBuddy : Cleaned with backup C:\WINDOWS\system32\MhoL9W3.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\MvtCw.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\PcwbliJQ.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\PfjL0.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\PfoWP.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\sahagent1008.exe -> Adware.Sahat : Cleaned with backup C:\WINDOWS\system32\Saqu081B.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\soundmx.exe -> Hijacker.StartPage.y : Cleaned with backup C:\WINDOWS\system32\VexG0Jfv.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\WkmjJ60.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\wtscc.exe -> Trojan.Scapur.a : Cleaned with backup C:\WINDOWS\system32\Xbqe36uD.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\Xdex27.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\system32\Xej7.exe -> Backdoor.VB.oq : Cleaned with backup C:\WINDOWS\system32\Zoe3iL.exe -> Backdoor.VB.nb : Cleaned with backup C:\WINDOWS\wsem216.dll -> Downloader.Dyfuca.z : Cleaned with backup C:\WINDOWS\wsem217.dll -> Downloader.Dyfuca.cn : Cleaned with backup ::Report End Logfile of HijackThis v1.99.1 Scan saved at 9:19:21 PM, on 4/9/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Documents and Settings\ANGIE\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/ O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe jabuck ,,,here are the two reports..tks alot man

0

You log is clean but Ewido is picking up Huntbar or Websearch as software. Go to add/remove prograns and look for: Huntbar websearch webhancer Uninstall them if found. Do a manual search for "Btiein" , probably a folder, and delete it if found.

0

btiein with the quotes or not....

0

without the quotes

0

i know there is a good reason,,,why the running of these programs in safe mode vs..normal mode....

0

Only the essential programs run in safe mode. Most viruses and spyware nedd to be not running to remove them.

0

thats true,,,,tks...brad

0

here is another ht post in normal mode...how does it look,,,,brad Logfile of HijackThis v1.99.1 Scan saved at 11:36:53 PM, on 4/9/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\AOL Companion\companion.exe C:\Documents and Settings\ANGIE\Desktop\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/ O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

0

It looks clean.

0

tks alot,,hopefully all is good,,,,

0

jabuck,,,can i recover a lost password on xp

0