i had problems with the nkvd.us thing too, and ive been searching in my reg and found parts of it here that HT, CWS or AV never found. I just deleted them so hopefully in a few hours it wont come back: hkey current user/software/microsoft/internetexplorer/explorerbars/C4ee...../filesnamedMRU same as above: "ContaingtaxtMRU" and not sure if this affects it or if its from an older trojan hkey_users/software/microsoft/windows/currentversion/telephone/handoffproperties had dialer.exe in there and deleted it. hope this helps guys. gary

0

oh yeah, sorry John, I didnt see you posted that already. and I found a myway folder too. under hkey_user/software/myway looks like a search redirect so i got rid of that too and also check out hkey_current_user/software/microsoft/internetexplorer/search and search properties i found 2 more redirects in there and erased the default name instead of deleting it hope this helps too guys. g*

0

I have the same problem and cannot get rid of nkvd.us. I have updated spybot S&D, Hijack this, and cwshredder to the latest versions and includes. Hijack this catches it and I have deleted EVERYTHING it catches, shredded the backups, ran spybot s&d, and ran CW shredder, as well as uninstalled myway websearch and cleaned up all of the regestries, all with no luck.It still comes back in about 6-8 hours. I have run Norton, Mcaffee, Avast, and a few other AV programs, all updated, and all with no luck. I have also deleted (shredded)any files that were created after I received this hijack, including mserv.exe which was coming back as a possible trojan during one of my many virus scans, and anything I didn't recognise as being a needed file. I have also uninstalled any programs that are not necessary to the basic OS to function (ie, office 2000, print drivers, etc), and completely cleaned out the system reg. I have a reg edit program which catches any new registery entries and lables them as new when they are added after the last date I checked them, and it did not catch any new registry entries around the time this started happening. I am out of ideas and reformatting my HDD is not an option. They really got us on this one, them B@#tards...

0

This info was obtained from http://www.merijn.org/cwschronicles.htm (cwshredder) Regarding nkvd.us: Approx date first sighted: January 11, 2004 Log reference: http://forums.spywareinfo.com/index.php?showtopic=27673&hl=nkvd\.us Symptoms: IE hijacked to nkvd.us and smart-finder.biz, redirections to nkvd.us and smart-finder.biz when typing incomplete URLs into address bar. Cleverness: 10/10 Manual removal difficulty: Involves some registry editing, and renaming the trojan file, restarting, and deleting it Identifying lines in HijackThis log: R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nkvd.us/s.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nkvd.us/s.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nkvd.us/s.htm O13 - DefaultPrefix: http://www.nkvd.us/1507/ O13 - WWW Prefix: http://www.nkvd.us/1507/ O13 - Home Prefix: http://www.nkvd.us/1507/ O13 - Mosaic Prefix: http://www.nkvd.us/1507/ Additional line in StartupList log: Enumerating ShellServiceObjectDelayLoad items: DDE Control Module: C:\WINDOWS\SYSTEM\mtwirl32.dll This variant was surprisingly smart: it used two startup methods (ShellServiceObjectDelayLoad and SharedTaskScheduler) that have to be the absolutely rarely used ones seen ever - and it used them differently on Windows 9x/ME and Windows NT/2k/XP. On top of that, both methods ensure that the file is loaded when Explorer is loaded, making it always in memory like CWS.Msconfd. Additionally, the actual responsible files are invisible in HijackThis, and only one shows in a StartupList logfile (ShellServiceObjectDelayLoad). The responsible file is mtwirl32.dll, and to delete it manually you need to rename it (deleting is impossible since it is in use), restart the system, and then delete the file and its Registry key. Thanks to cwshredder for the info, hope this helps Neo

0

To remove this browser tak over you need to do as follows… Click on start Open Run Type “regedit” and click ok Then Click on the following pluses: HKEY_LOCAL_MACHINE SOFTWARE MICROSOFT WINDOWS CURRENT VERSION SHELLSERVICEOBJECTDELAYLOAD Double click on SHELL SERVICE OBJECT DELAY LOAD And delete the following file (DDE CONTROL MODULE) Once you’ve done this open C:\Windows\System And delete the following two files MTWIRL32.DLL MTWCNL32.DLL Once you’ve done this run CWShredder AND URE DONE =p

0

hey guyz da above works for Windows Me...dats what im running so if ure running something else im not a hundred percent dat it will work...but giv it a go and tell me what happens jegz

0

hey guyz if when you try delete MTWIRL32.DLL MTWCNL32.DLL i suggest you reboot ure system and try if there are any problems plz post up..thx

0

Try going here: http://www.smart-finder.biz/uninstall.htm but remain sceptical - scan again to make sure

0

"This info was obtained from http://www.merijn.org/cwschronicles.htm (cwshredder) Regarding nkvd.us: Approx date first sighted: January 11, 2004" This thread was started December 30, 2003 Deleted files show my computer picked up the infection October 25, 2003 This little sucker has been around for a while now - glad to see folks have picked up on it.

0