Browser Hijacking - Hjt Log Posted

bluzdude · November 23, 2004

Hi, I have picked up a browser hijacker, at the very least, that resists automated removal programs, including HiJackThis, Ad-Aware6.0, SpyBot Search and Destroy, and CWS. It appears to be a variant of th Cool Web Search bug. I am experiencing IE slowdowns and lockups, pop ups, home page redirects, etc. Here is my HJT log:

Logfile of HijackThis v1.97.3

Scan saved at 6:04:53 PM, on 11/22/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\Program Files\DIGStream\digstream.exe

C:\WINDOWS\SYSTEM32\3cmlink.exe

C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exe

C:\WINDOWS\SYSTEM32\3cshtdwn.exe

C:\WINDOWS\SYSTEM32\3cmlink.exe

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\ScanSoft\OmniPageSE\opware32.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System\MSMSGSVC.exe

C:\Program Files\MA311 PCI Adapter Configuration Utility\wlanutil.exe

C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe

C:\WINDOWS\FSScrCtl.exe

C:\Program Files\U.S. Robotics\Internet Call Notification\CallWaiting.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\cnmsm58.exe

C:\Program Files\Sprint Virtual Assistant\bin\mpbtn.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Ray Baker.RAY-TWA0MACJQU8\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.e-finder.cc/search/ (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.e-finder.cc/search/ (obfuscated)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.e-finder.cc/search/ (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.e-finder.cc/search/ (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.e-finder.cc/search/ (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.e-finder.cc/search/ (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.e-finder.cc/search/ (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.e-finder.cc/search/ (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.e-finder.cc/search/ (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.e-finder.cc/search/ (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.e-finder.cc/search/ (obfuscated)

O2 - BHO: (no name) - {834261E1-DD97-4177-853B-C907E5D5BD6E} - C:\WINDOWS\dpe.dll

O4 - HKCU\..\Run: [MSMsgSvc] C:\WINDOWS\System\MSMSGSVC.exe

therock247uk · November 23, 2004

Woah what an old version of Hijackthis you have. Can you please download a newer Hijackthis version 1.98.2 from http://www.spywareinfo.com/~merijn/files/hijackthis.zip Unzip it into a permanent folder like c:/hjt and post a new Hijackthis log here in a reply from it.

bluzdude · November 23, 2004

HJT version 1.98.2 log:

Logfile of HijackThis v1.98.2

Scan saved at 7:17:16 PM, on 11/22/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\Program Files\DIGStream\digstream.exe

C:\WINDOWS\SYSTEM32\3cmlink.exe

C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exe

C:\WINDOWS\SYSTEM32\3cshtdwn.exe

C:\WINDOWS\SYSTEM32\3cmlink.exe

C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

C:\Program Files\ScanSoft\OmniPageSE\opware32.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System\MSMSGSVC.exe

C:\Program Files\MA311 PCI Adapter Configuration Utility\wlanutil.exe

C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe

C:\WINDOWS\FSScrCtl.exe

C:\Program Files\U.S. Robotics\Internet Call Notification\CallWaiting.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\cnmsm58.exe

C:\Program Files\Sprint Virtual Assistant\bin\mpbtn.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\HiJackThis\hijackthis\HijackThis.exe